Skip to main content
Glama

BoteX: Execution Harness for AI Coding Agents

License: Apache-2.0 Python 3.10+ CI BoteX MCP server – quality and maintenance score on Glama

Giving an LLM direct, unrestricted access to your repository usually ends the same way: it hallucinates line numbers, corrupts indentation, writes broken syntax, eats your token budget reading thousands of irrelevant lines, or gets stuck in an infinite fix-break loop.

BoteX is a guardrail harness designed specifically for autonomous code-editing agents. It sits between an MCP client (such as Devin, Antigravity, Claude Desktop, or Cursor) and your codebase, enforcing deterministic safeguards before any code ever touches your disk.


Why BoteX?

Instead of trusting the model to behave, BoteX wraps every action in safety gates:

  • Outline-first inspection: Agents inspect symbol skeletons (get_outline) before asking for specific line ranges. This prevents dumping massive files into context and slashes token waste.

  • Prompt Injection & Untrusted Data Isolation (OWASP LLM01: Prompt Injection): External content retrieved by tools (file contents, web pages, memory notes) is automatically wrapped in XML-like untrusted data boundary tags (<untrusted_file_content>, <untrusted_web_content>, <untrusted_memory_content>). System prompt rules instruct the LLM to treat bounded content strictly as data, significantly reducing prompt injection risks.

  • Sensitive Information Disclosure & Secret Guardrails (OWASP LLM02: Sensitive Information Disclosure): Prevents accidental leaks by blocking access to environment files (.env*), SSH keys, credentials, and local configurations (botex.config.local.json). Automatically redacts API keys, Bearer tokens, private keys, and provider secrets in tool outputs and logs.

  • Read-before-write gate: Models cannot patch a file they haven't inspected in the current session. No blind edits, no guessing.

  • Pre-write syntax validation: Code modifications are validated in memory (e.g. ast.parse for Python) before saving. If the patch breaks syntax, it gets rejected on the spot.

  • Multi-tier fuzzy patching: Patches are whitespace- and newline-resilient (CRLF/LF agnostic with indentation detection), so minor formatting mismatches don't break execution.

  • Unbounded Consumption Protection (OWASP LLM06: Unbounded Consumption): Prevents "Denial of Wallet" and infinite loop resource exhaustion. BoteX evaluates USD spend dynamically mid-loop to enforce the budget cap instantly, and aborts with an automatic rollback if the agent falls into a mutation streak or stagnation loop.

  • Misinformation Protection (OWASP LLM07: Misinformation): Generated code undergoes rigorous in-memory AST and syntax validation (including ruff for Python and bash -n for shell scripts) to reject hallucinated or invalid code before touching disk. Post-write verify_command acts as a mandatory final test gate.

  • Improper Output Handling (OWASP LLM10: Improper Output Handling): Strict Read-Before-Write gates ensure no blind writes occur, and every touched file is backed by a pre-mutation snapshot. If an agent hits an error, the automatic snapshot rollback reverts the workspace cleanly.

  • Hard budget & pricing caps: Pre-flight checks verify model pricing against live provider catalogs. If a task exceeds its budget or a model is overpriced, BoteX aborts before spending a cent.

  • Strict privacy & Zero Data Retention (ZDR): Enforces provider.data_collection: deny on OpenRouter calls, blocks .env/secrets, masks API keys in logs, and prevents path traversal attacks. Free (:free) models that cannot guarantee ZDR are rejected locally. Opt out explicitly per run (allow_non_zdr) or via the openrouter-free provider preset.

  • Enhanced Permission Controls (OWASP LLM03: Excessive Agency): BoteX protects against Excessive Agency via a centralized Agency Middleware. Tools are strictly defined with Risk Levels (LOW, MEDIUM, HIGH) and required scopes. High-risk destructive actions automatically require explicit interactive operator approval (or pre-authorized task scopes in headless mode), limiting the potential damage of prompt injections or hallucinations.


Related MCP server: dsh-codex-bridge

Quickstart

1. Installation

Requires Python 3.10+:

pip install -r requirements.txt

(Optional: install globally via pip install . to get the botex CLI command).

2. Add your API key

BoteX handles provider keys internally, so calling MCP clients don't need to pass credentials on every request. Create a .env file next to server.py:

OPENROUTER_API_KEY=sk-or-v1-...

Key lookup order: OPENROUTER_API_KEY env var → local .env → custom paths.env_file → botex.config.local.json (gitignored).

3. Connect to your MCP client

You can run BoteX as a local stdio process or as a remote service over SSE.

Option A: Local Process (stdio)

Register BoteX using the included zero-install launchers (botex.cmd on Windows, botex.sh on Linux/macOS) or directly with Python:

{
  "mcpServers": {
    "botex": {
      "command": "C:/path/to/harness/botex.cmd"
    }
  }
}

Option B: Remote MCP via SSE (Cloud or VPS)

Start the gateway with botex cloud and connect via Server-Sent Events (SSE):

{
  "mcpServers": {
    "botex-cloud": {
      "url": "http://127.0.0.1:8000/mcp/sse",
      "headers": {
        "Authorization": "Bearer <your_token>"
      }
    }
  }
}

How It Works

Every delegated task goes through an explicit contract-driven lifecycle:

Delegated Task
     │
     ▼
[Pre-flight check] ──► Validate budget, model capabilities & price cap
     │
     ▼
[Tool Loop]        ──► Symbol outline ─► Target read ─► In-memory patch ─► Syntax check
     │
     ├─► Success   ──► Verify contract (file exists, syntax valid, verify_command passed) ─► DONE
     │
     └─► Failure   ──► Rollback snapshots ─► Try next candidate (model_fallbacks) or abort

A task returns ok: true only when its completion is verified on disk, not just because an LLM said "I'm done".


MCP Tools Reference

BoteX exposes a focused set of MCP tools:

Task Execution

  • run_subagent(task, ...): Runs a full coding task synchronously and blocks until finished. Returns both human-readable text and detailed structured metadata.

  • start_task(task, ...): Launches a task asynchronously in the background and returns a task_id.

  • get_task_status(task_id): Polls progress, logs, and results for a background task.

Two-Tier Memory Vault

  • save_memory(title, content, workspace_dir, kind, tags, memory_id, scope): Saves persistent notes, decisions, handoffs, or lessons. Scope can be "local" (<workspace_dir>/.botex/memory/) or "global" (~/.botex/memory/).

  • read_memory(memory_id, workspace_dir, scope) / search_memory(workspace_dir, query, tag, kind, scope): Retrieves saved memory across local or global storage (scope="all" searches both).

Diagnostics & Utility

  • get_outline(path, workspace_dir): Returns a high-level symbol outline of a file without reading all lines.

  • get_stats(period): Generates token usage and cost reports from the local analytics ledger.

  • check_health(): Checks readiness of providers, models, keys, and budget limits.

  • clean_snapshots(max_age_days, max_total_mb): Prunes old workspace backup snapshots.

  • recommend_models(task_type, limit, include_free, provider, profile, tier): Queries /api/v1/models with authenticated headers, classifies models into high / standard / budget tiers, filters for tool-calling support (require_tools=true) and interactive endpoints (excluding :batch), and ranks models by task aptitude and token cost. include_free=true admits :free variants.

  • fetch_url(url, max_bytes): Safe, caller-side URL fetching with strict host and size filters.


Task Delegation & Parameters

Example payload for run_subagent:

{
  "task": "Add email validation to auth/validators.py and cover it with unit tests",
  "files": ["auth/validators.py"],
  "workspace_dir": "./my-project",
  "profile": "coding"
}

Key Parameters

Parameter

Default

Description

task

(required)

Clear description of what needs to be implemented or fixed.

files

[]

List of primary target files to nudge the agent toward.

workspace_dir

""

Root directory the agent is restricted to. Empty = engine.default_workspace from config, else the server's current directory. An explicit value (including .) always wins.

provider

""

API provider from botex.config.json (openrouter, nvidia, openrouter-free; empty = configured default or BOTEX_PROVIDER).

model

""

Explicit provider model ID; overrides profile.

profile

""

Model profile from botex.config.json (default, coding, auto-beta, fast). Empty = picked per mode via engine.mode_profiles.

api_key

""

Provider API key per-request; highest priority (overrides env/.env/config).

mode

"edit"

Capability preset: readonly, edit, destructive, full (empty = engine.default_mode).

recipe

""

Specialized workflow persona (planner, code-explorer, reviewer, security-reviewer, build-resolver, tdd).

max_turns

0

Max tool-loop iterations (0 uses engine.max_turns, usually 15, overridable per mode via engine.mode_max_turns).

max_tokens

0

Per-turn completion cap (0 = config value; reasoning models need ~8000+).

max_duration_s

0

Total wall-clock limit in seconds (0 = config value).

budget_limit_usd

-1

Hard spend limit for this task (-1 uses global config, 0 = unlimited).

allow_destructive

false

Explicit opt-in for delete_file and move_file.

allow_exec

false

Explicit opt-in for run_command (requires exec.enabled: true in config).

allow_net

false

Explicit opt-in for web access via read_url.

net_allowed_hosts

[]

Per-run host authorization for read_url (interacts with net.policy).

net_allowed_urls

[]

Per-run URL authorization; a trailing / authorizes that subtree.

allow_non_zdr

false

Per-run consent to relax the ZDR gate; required for :free models (provider may log/train on prompts). The result carries zdr_enforced: false.

output_path

""

Enforce that this exact file must be written and non-empty for DONE status.

verify_command

""

Verification command (e.g. pytest tests/test_auth.py) that must pass before completion. Requires exec.enabled: true and exec authorization.


Recipes & System Prompts

BoteX builds the API System Prompt dynamically for each run. It fuses a hardcoded operational core (tool rules, syntax validation checks, output formats) with an optional Recipe (a markdown file). This means that providing a --recipe <name> (or the "recipe": "<name>" JSON parameter) acts as an injection mechanism for your custom System Prompts, giving the agent specialized personas or specific constraints.

Recipes live in the botex/recipes/ directory.

Examples of custom System Prompts for Modding and Analysis

If you are using BoteX as an MCP Server to analyze game mods or reverse-engineer engine behavior, you can create custom recipes like botex/recipes/ue4.md or botex/recipes/lua_audit.md.

  • Unreal Engine 4 Modding (--recipe ue4)

    You are an expert C++ and UE4 Blueprint reverse engineer. Your primary goal is to identify memory leaks in object instantiation and unsafe cast operations. Always prioritize stability over performance optimizations. Adhere strictly to Epic Games naming conventions.
  • Security Audit (--recipe lua_audit)

    You are a strict security auditor analyzing game mods. Review this Lua codebase for potential sandbox escapes, arbitrary file read/write vulnerabilities, and networking exploits. Do not attempt to fix logic bugs; focus only on security vulnerabilities.
  • Code Refactoring & Optimization (--recipe optimize)

    You are an optimization expert. The target codebase runs in a heavily restricted environment. Identify inefficient loops, excessive global variable usage, and unnecessary memory allocations. Suggest changes using only standard libraries.

When provided, BoteX automatically appends your recipe to the system instructions before starting the LLM loop.


Safety & Capability Modes

Permissions follow the principle of least privilege. Modes are presets over core capabilities:

Mode

Allowed Operations

Typical Use Case

readonly

Outline inspection, ranged file reads, memory search.

Architecture reviews, exploratory passes.

edit (default)

Read tools + apply_patch + create_file.

Standard feature work and bug fixing.

destructive

Edit tools + delete_file + move_file.

Refactoring, renaming, file reorganizations.

full

Destructive tools + gated run_command execution.

Full autonomous loop (edit → test → fix).

NOTE

Network access (allow_net) is never enabled by default in any preset. It must be explicitly enabled per request or configured via net.allowed_hosts.

Command Execution (run_command) Safety

BoteX is not a full OS sandbox. When allow_exec is granted, processes run under the operator's account. However, BoteX guards execution with multiple layers:

  1. Disabled by default: Requires exec.enabled: true in configuration.

  2. Binary allowlist: Only pre-approved executables (pytest, python, ruff, git, etc.) can be called.

  3. Deny rules: Blocks dangerous arguments (python -c, git push, rm, shell piping, network downloads).

  4. Isolated environment: Executes directly (shell=False), workspace set as cwd, secret environment variables stripped, and execution timeouts strictly enforced.

Human-in-the-Loop (HITL) Approvals

BoteX integrates an interactive approval manager for high-risk operations. Configure the policy in botex.config.json under approval.policy:

  • NONE: Auto-approves operations permitted by the capability mode.

  • HIGH_RISK (default): Blocks destructive actions (delete_file, move_file) and shell execution (run_command) until an operator approves.

  • MUTATIONS: Requires operator approval for any file modifications (create_file, apply_patch).

  • ALL_RISKY: Intercepts all mutating tools and system execution commands.

In REPL mode, BoteX prompts for interactive confirmation. In Cloud Gateway mode, actions enter a pending approval queue and can be approved or rejected via REST API (POST /api/approvals/{id}/decide).


Model Fallbacks & OpenRouter Live Routing

If a model refuses a task, burns its token limit without output, or hits provider rate limits, BoteX falls back to alternative models defined in botex.config.json:

"model_fallbacks": {
  "default": ["deepseek/deepseek-v3.2", "anthropic/claude-sonnet-4", "openai/gpt-5.4-mini"],
  "coding": ["deepseek/deepseek-v3.2", "anthropic/claude-sonnet-4", "openai/gpt-5.4-mini"],
  "auto-beta": ["qwen/qwen3-coder", "deepseek/deepseek-v3.2", "anthropic/claude-sonnet-4"],
  "fast": ["google/gemini-2.5-flash-lite", "deepseek/deepseek-v3.2"]
}

BoteX uses two complementary failover layers:

  1. In-Payload OpenRouter Failovers (extra_body.models): Before sending the first turn to OpenRouter, BoteX runs each fallback candidate through all five safety gates (Denylist, Decisions, ZDR, Price, Tools) and passes up to three validated slugs in extra_body["models"]. If the primary endpoint is overloaded on the initial request, OpenRouter switches to the next validated model on the wire without an extra client round-trip. Meta-routers (openrouter/auto, openrouter/pareto-code, openrouter/free) are excluded from models: [...], and once a run modifies any file (files_touched) or executes a command (exec_ran), BoteX strips models from subsequent turns so a different model never takes over a mutated workspace mid-task.

  2. Engine-Level Rollback & Retry: If an attempt fails mid-run, BoteX verifies that all partial file changes from the failed attempt were rolled back before starting the next candidate model. A fallback model never inherits a dirty workspace.

For OpenRouter runs, BoteX also sets extra_body.provider (data_collection: "deny" when ZDR is active, require_parameters: true when tools or response_format are present, allow_fallbacks: true, and sort: "throughput"), automatically stripping reasoning parameters for non-reasoning model slugs so require_parameters: true never triggers HTTP 404 rejections. On DONE, BoteX queries GET /api/v1/generation?id=... in parallel (with a short 404 retry) to record official billing (total_cost), queue latency (queue_time_ms), inference time (generation_time_ms), and prompt cache read/write tokens in .agent_analytics.json and .botex/memory/ task receipts.


Free Models (Non-ZDR Opt-in)

ZDR is on by default and :free slugs are rejected pre-flight with ZDR_VIOLATION. Operators without a paid subscription (or anyone who accepts that free endpoints may log/train on prompts) can opt in two ways; both leave an audit trail (zdr_enforced: false in the result and a stderr warning):

# Persistent: switch to the bundled free-tier provider preset
# (all profiles resolve to tool-capable :free models)
botex config provider openrouter-free          # or BOTEX_PROVIDER=openrouter-free

# or relax ZDR on the current provider (keeps paid models, widens routing)
botex config zdr off                            # 'on' restores enforcement

# Per-run only, no config change:
botex run "task" --provider openrouter-free
botex run "task" --model qwen/qwen3.8-27b:free --allow-non-zdr
{"task": "...", "provider": "openrouter-free"}
{"task": "...", "model": "qwen/qwen3.8-27b:free", "allow_non_zdr": true}
NOTE

:free variants also require the OpenRouter account-level free-model opt-in (privacy settings); without it requests surface as provider_policy_denied. Free models carry per-day rate limits. The model_fallbacks chains in the preset stay entirely on :free slugs.


Configuration

Settings are resolved hierarchically (lowest to highest priority):

  1. botex.config.json: committed defaults (provider profiles, engine limits, security lists).

  2. botex.config.local.json: machine-local overrides (gitignored; place custom keys or limits here).

  3. BOTEX_* environment variables.

Config files are re-read automatically when they change (file mtime check on every access), so edits to botex.config.local.json - manual or via botex config ... - take effect on the next call, including in a running MCP server; no restart is needed. Environment variables are read from the server process environment, so changing them requires a restart.

Example botex.config.local.json:

{
  "engine": {
    "budget_limit_usd": 1.0,
    "max_turns": 20,
    "default_workspace": "C:/projects/my-project"
  },
  "pricing": {
    "max_input_per_mtok": 3.0,
    "max_output_per_mtok": 6.0
  }
}

Standalone CLI & REPL

BoteX can be run directly from your terminal without any MCP client:

Interactive REPL

botex repl -w ./my-project --profile coding

Prompts for [y/N] confirmation whenever the agent wants to delete or move files.

The startup banner shows the resolved absolute workspace and where it came from (explicit, default_workspace or cwd), and warns when it is the BoteX repository itself. Inside the REPL, workspace (or cd) prints the current workspace, and workspace <DIR> / cd <DIR> switches the target project for the rest of the session (relative paths are resolved against the current workspace; the directory must exist).

Set a persistent default so that running botex without -w never targets the harness itself:

botex config workspace C:/projects/my-project   # writes engine.default_workspace
botex config workspace none                      # clear it (falls back to cwd)

Workspace resolution: explicit -w / workspace_dir > engine.default_workspace > current directory. BOTEX_DEFAULT_WORKSPACE overrides the config value.

Headless One-Shot Tasks

# Run a specific task
botex run "Add --verbose flag to cli.py" -w ./my-project --profile coding

# Fix a bug with a tight turn budget
botex run "Fix the failing auth test" --files tests/test_auth.py --max-turns 15

# Refactoring with destructive permissions
botex run "Clean up legacy modules" -w ./my-project --allow-destructive

Conversational Chat Mode

Multi-turn discussion with token streaming, read-only tools, and automatic context pruning:

# Start interactive chat in the terminal
botex chat --model openrouter/auto

# With a custom system prompt and temperature
botex chat --system "Focus on security analysis" --temp 0.2

In-chat commands: /clear (reset session), /history (review transcript), /help, /exit.

Cloud Gateway & Remote MCP (FastAPI)

Run BoteX as a background cloud daemon with SSE transport, WebSocket chat, and REST endpoints:

# Start cloud server on default port 8000
botex cloud --host 0.0.0.0 --port 8000

Zero-Friction Local mode runs unauthenticated when BOTEX_ACCESS_TOKEN is unset. Set BOTEX_ACCESS_TOKEN in .env to enforce Bearer token verification on all protected endpoints.

Maintenance & Observability

botex health               # Verify API keys, provider connectivity, and model pricing
botex wallet               # Check OpenRouter balance, key limits, and daily query caps
botex config               # Inspect or modify local configuration defaults
botex --stats              # View weekly token consumption and spend per model
botex --stats --month      # Monthly cost report
botex --history <task_id>  # Inspect exact prompts, tool calls, and diffs for a run
botex --snapshots          # Check disk usage of backup snapshots
botex --clean-snapshots    # Prune old snapshot backups
botex models [--refresh]   # List configured provider models (refresh catalog)
botex serve                # Force MCP stdio server mode explicitly

Project Structure

server.py              MCP server entry point & CLI dispatcher
botex.cmd / botex.sh   Zero-install launchers (auto-detects python environment)
pyproject.toml         Package configuration (exposes `botex` CLI command)
requirements.txt       Runtime dependencies
botex.config.json      Committed defaults (providers, engine limits, exec/net policy)
ROADMAP.md             Deferred features & technical rationale
botex/
  approval.py          Human-in-the-loop approval manager, async actions, and rollback integration
  chat.py              Conversational chat sessions, token streaming, and read-only sandbox
  server_cloud.py      FastAPI cloud gateway, Remote MCP SSE, WebSocket chat, and REST API
  catalog.py           Dynamic model catalog, TTL caching, and live provider query
  denylist.py          Hierarchical model exclusions (globs and regex)
  wallet.py            Key credits, spend analytics, and daily query limits
  engine.py            Autonomous execution loop, context management & rollback triggers
  file_tools.py        Safe outline-first reading, file creation, moving & deletion
  patch_engine.py      Fuzzy patch matching, syntax validation & snapshot management
  security.py          Path traversal defenses, secret masking & gitignore filtering
  exec_tools.py        Policy-controlled command execution & argument filtering
  capabilities.py      Permission presets (readonly, edit, destructive, full)
  config.py            Layered config loader (defaults < local < env)
  net_tools.py         Net policy enforcement (read_url / fetch_url)
  memory.py            Two-tier memory vault (local .botex/memory/ and global ~/.botex/memory/)
  analytics.py         Cost/token ledger, budgeting & summary reporting
  pricing.py           Live model price guardrail & catalog checks
  providers.py         Provider adapters (OpenRouter, NVIDIA, etc.) & request normalizer
  benchmarks.py        Live model recommendations (recommend_models)
  contracts.py         Task completion verification & status taxonomy
  recipes.py           Recipe loading & system-prompt injection
  i18n.py / ui.py      CLI language & status rendering
  recipes/             Specialized agent personas (planner, reviewer, tdd, etc.)
skills/botex/          Caller-side SKILL.md (delegation patterns)
tests/                 Comprehensive test suite (unit, cloud gateway, chat, approvals)
docs/
  TUTORIAL.md          Architecture deep dive and technical walkthrough

Testing

Run the full local test suite (no API key required):

python -m pytest tests/

All unit, approval, chat, memory, and cloud gateway tests run hermetically in offline mode.


License & Trademark

BoteX is licensed under the Apache License 2.0. See LICENSE for details. Derivative works must retain attribution notices as specified in NOTICE.

The BoteX name and logo are trademarks of Jakub Grzesiak (jg-webtech.pl). You are free to fork and modify the code under Apache-2.0, but forks or derived distributions should not use the name "BoteX" or suggest official endorsement without prior written consent.

Available Tools

12 tools
check_healthA

Checks BoteX environment readiness (provider keys, snapshot dir, disk).

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden. It discloses what is actually checked—provider keys, snapshot directory, and disk—and the verb 'Checks' implies a non-mutating inspection. It does not explicitly state side-effect-free behavior, but nothing in the description suggests modification.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One short sentence communicates the verb, target, and specific scope without any filler. The parenthetical list of checks is compact and informative, making the description easy to scan and parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a parameterless health-check tool with an output schema, this description is complete: it names the exact environmental areas inspected and implies the tool's role. No additional context is needed for an agent to select or invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so there are no parameter semantics to clarify. The schema is empty and fully covers the input surface, so the description does not need to compensate for missing parameter documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Checks') and resource ('BoteX environment readiness'), then enumerates the exact components checked: provider keys, snapshot dir, and disk. This clearly distinguishes it from sibling tools that handle tasks, memory, URLs, or model recommendations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context: this tool is for verifying whether the BoteX environment is properly set up. It does not explicitly state when not to use it or compare it to alternatives, but its health-check role makes the intended use obvious enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

clean_snapshotsC

Purges old or excess backup snapshots from disk.

ParametersJSON Schema
NameRequiredDescriptionDefault
max_age_daysNo
max_total_mbNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

C2.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It indicates this is a destructive operation ('purges') but doesn't disclose whether snapshots are permanently deleted, if there's any recovery mechanism, required permissions, or whether there are safeguards. It lacks details on the impact on the system (e.g., could it delete snapshots in use?).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence with no waste. It front-loads the verb and resource. It is appropriately sized for a simple tool, though it could be slightly more descriptive without losing conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that this is a destructive maintenance tool with two parameters that control deletion criteria, and no annotations to clarify safety, the description lacks critical information about the deletion behavior, parameter interaction, and any safeguards. The output schema exists but is not shown; if it explains the outcome, that helps, but the description alone does not fully equip an agent to call this safely and correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. However, the description doesn't explain that max_age_days and max_total_mb are criteria for deletion. It only says 'old or excess' which loosely maps to age and size, but does not clarify how the parameters interact (e.g., are they both applied, or either/or?) or their units. The parameter names and defaults are self-explanatory, so a baseline of 3 is appropriate, but more explicit linkage would improve it.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states the action ('purges') and the resource ('backup snapshots'), and clarifies it removes 'old or excess' ones. However, it doesn't specify the exact criteria for what counts as 'old' or 'excess' beyond the parameters, and doesn't differentiate from any sibling tools (none appear directly related, but the description could be more precise about the scope).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no guidance on when to use this tool versus alternatives. It doesn't mention any prerequisites, conditions for invocation, or when to avoid using it. The agent is left to infer that it's for maintenance tasks, but there's no explicit context on when this should be called.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_urlA
Fetch one public http(s) text document for caller-side research.

This tool is intentionally separate from BoteX's internal read_url: the
orchestrating agent chooses the URL, so arbitrary public hosts do not have
to be configured in net.allowed_hosts. SSRF protections, redirect
revalidation, content-type checks, byte limits, and secret masking still
apply. In net.policy='allowlist', only configured hosts may be fetched.
ParametersJSON Schema
NameRequiredDescriptionDefault
urlYes
max_bytesNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.1/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden and does so well: it discloses SSRF protections, redirect revalidation, content-type checks, byte limits, secret masking, and the allowlist-mode restriction. This is unusually rich behavioral context for a no-annotation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the core purpose in the opening clause and keeps the security model tight across a few sentences. Every sentence adds distinct information, though the prose could be marginally denser.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and the security/policy model is well covered. The remaining gap is the undocumented max_bytes parameter, which leaves an agent guessing about truncation behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and there are two parameters, so the description must compensate. It adds some meaning to 'url' via 'public http(s) text document', but never explains max_bytes (default 0 presumably means unbounded) or its interaction with the byte limits it mentions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Fetch one public http(s) text document') plus the calling context ('caller-side research'). It explicitly distinguishes itself from BoteX's internal read_url, so an agent can tell the two apart without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explains why this tool exists (the orchestrating agent chooses the URL, avoiding allowlist configuration) and gives the selecting condition for the alternative (internal read_url). It also notes the net.policy='allowlist' restriction. It stops short of an explicit when-not/exclusion statement beyond that policy note.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_outlineA
Returns a lightweight file skeleton (classes, methods, functions, headers,
line numbers) without reading the whole file. Saves ~90% of tokens.
ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes
workspace_dirNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden, and it does disclose the core behavioral trait: a lightweight, non-whole-file read that saves tokens and returns structural elements with line numbers. However, it says nothing about error behavior on unsupported file types, permissions, or size limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the action and return shape, then the value proposition. The parenthetical enumeration is compact and informative rather than padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and the tool is simple (one required parameter). The description covers purpose, contents, and the token-saving rationale; only parameter semantics and explicit usage routing are missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% for both parameters, and the description never mentions 'path' or 'workspace_dir'. With zero coverage the description should compensate but adds no meaning for either parameter or their required/default status.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Returns a lightweight file skeleton') and enumerates the concrete contents (classes, methods, functions, headers, line numbers). No sibling tool overlaps with file outlining, so the agent can place it immediately without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The clause 'without reading the whole file. Saves ~90% of tokens' implies the intended use case (cheap structural reconnaissance before/ instead of a full read), but no alternative tool is named and no when-not condition is given. Usage is inferable rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_statsB
Returns an analytics summary of executed BoteX tasks (USD costs, token
usage, code-line balance).
Args:
    period: 'week' (last 7 days) or 'month' (last 30 days).
ParametersJSON Schema
NameRequiredDescriptionDefault
periodNoweek

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It does disclose what data is covered (costs, tokens, code-line balance) and that it aggregates executed tasks rather than live state, which is genuinely useful. However, it says nothing about permissions, scope of the aggregation (all-time vs. per-user), or freshness, leaving gaps for an unannotated tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core purpose is front-loaded in one sentence and the parameter note is short and scoped. The 'Args:' block is slightly boilerplate but carries no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-optional-parameter analytics read tool with an output schema present, the description covers the purpose, the metric set, and the parameter's allowed values and meaning. Return-value details are correctly left to the output schema; only aggregation scope and permissions are unaddressed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the parameter has no enum, so the description must compensate. It does: 'period' is defined as 'week' (last 7 days) or 'month' (last 30 days), supplying both allowed values and their exact semantics, plus the default implied by the schema. This materially exceeds what the schema conveys.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Returns an analytics summary of executed BoteX tasks') and enumerates the metrics returned (USD costs, token usage, code-line balance), which lets an agent distinguish it from get_task_status or check_health. It stops short of explicitly naming or contrasting with those siblings, so it is clear but not fully differentiated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance: no statement of when an agent should call get_stats rather than get_task_status or check_health, no prerequisites, and no exclusions. Usage can only be inferred from the fact that it summarizes completed tasks.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_task_statusA

Return status and result for a task started with start_task.

`status` is the task lifecycle (QUEUED | RUNNING | DONE | FAILED |
CANCELLED) — DONE here means "finished", not "succeeded"; check
`result_data.status` / `result_data.ok` for the engine outcome.
`result` is the pretty-text report; `result_data` is the structured
engine result (status, failure_kind, ok, files_touched, exec_ran,
rollback_verified, attempts[], cost_usd, ...).
ParametersJSON Schema
NameRequiredDescriptionDefault
task_idYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it delivers real behavioral insight: it warns that lifecycle DONE means 'finished' not 'succeeded' and points to result_data.status/result_data.ok for the true outcome, plus enumerates the structured fields returned. It omits operational traits like auth requirements, rate limits, or whether calling on a still-running task is cheap, keeping it short of a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded one-line purpose followed by tightly scoped clarifying notes, each of which resolves a genuine ambiguity (lifecycle vs. engine status, pretty-text vs. structured result). No filler sentences.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so the description is not obligated to explain return values, yet its clarification of status vs. result_data.status prevents a real misread of the response. It is complete for invocation; only polling/lifecycle operational guidance is absent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

One parameter at 0% schema coverage, so the description must compensate; it implies task_id is the identifier from start_task but never states the expected format or provenance explicitly. That gives the agent enough to map the argument, but not full semantic detail, so a 3 is fair.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Return status and result for a task') and immediately anchors it to the sibling tool that produces the input ('started with start_task'), which cleanly separates it from start_task and the other siblings. An agent can tell exactly what this retrieves without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The prerequisite is explicit: this is for a task 'started with start_task', which gives the agent the correct entry condition. It stops short of stating when-not to use it (e.g., polling cadence, terminal-state behavior, or what to do instead of repeated calls), so it is clear context without full routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

read_memoryA
Reads the full content and metadata of a specific memory entry by ID from the workspace Memory Vault.

Args:
    memory_id: The ID of the memory entry to retrieve (e.g. 'mem_a1b2c3d4').
    workspace_dir: Workspace root directory. Empty = engine.default_workspace
           from the config, else the server's current directory.
ParametersJSON Schema
NameRequiredDescriptionDefault
memory_idYes
workspace_dirNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It conveys that this is a non-mutating retrieval of content plus metadata, but says nothing about failure behavior (e.g. unknown memory_id), permissions, or cross-workspace access. The output schema covers the return shape, so that omission is acceptable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded one-sentence purpose followed by per-argument documentation. Slightly verbose in the workspace_dir fallback chain, but every detail there is operationally useful rather than filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Two parameters, both documented, one required; an output schema exists so return values need not be explained. The main remaining gap is the absence of any guidance on error/nonexistent-ID behavior, which for a no-annotation read tool would be the last thing worth adding.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate - and it does. It documents both parameters, including an ID format example ('mem_a1b2c3d4') and the non-obvious fallback semantics of an empty workspace_dir (engine default from config, else server's current directory). That is meaningfully more than the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: reads the 'full content and metadata' of a memory entry, scoped 'by ID'. This implicitly distinguishes it from the sibling search_memory (query-based) and save_memory (write), though it never names those alternatives explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the 'by ID' framing - an agent infers this is the tool to call once it already holds a memory_id. However, there is no explicit statement of when to use this versus search_memory, and no prerequisites or conditions given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

recommend_modelsA
[EN] Fetches the most cost-effective and capable models from OpenRouter based on live benchmarks.
USE THIS TOOL BEFORE calling `run_subagent` if you are unsure which model ID to use or want to optimize for cost/quality.
include_free=True also admits ':free' variants (non-ZDR — prompts may be
logged/trained on); they require allow_non_zdr or the openrouter-free
provider to actually run.

[PL] Pobiera rekomendacje modeli z OpenRouter na podstawie benchmarków.
Użyj tego narzędzia ZANIM wywołasz `run_subagent`, jeśli nie znasz dokładnego ID modelu.
include_free=True dopuszcza warianty ':free' (non-ZDR — prompty mogą być
logowane/trenowane); do uruchomienia wymagają allow_non_zdr albo
providera openrouter-free.
ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
task_typeNocoding
include_freeNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and delivers a meaningful disclosure: include_free=True admits non-ZDR ':free' variants whose prompts may be logged/trained on, and these require allow_non_zdr or the openrouter-free provider. That is real side-effect/privacy context beyond a simple getter.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Content is front-loaded and each sentence earns its place within a language, but the full EN and PL duplication roughly doubles the payload for what is a short instruction set.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists so return values need not be described, and the critical behavioral caveat (non-ZDR free variants) is covered. The gaps are the undocumented limit and task_type semantics rather than missing high-risk information.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It explains include_free thoroughly (ZDR implications and the allow_non_zdr requirement) but leaves limit and task_type entirely undocumented, so only one of three parameters gains meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource (fetches model recommendations from OpenRouter) and the basis (live benchmarks, cost/quality). It clearly distinguishes itself from the sibling run_subagent by being the model-selection step that precedes it.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly tells the agent to call this BEFORE run_subagent when the model ID is unknown or cost/quality optimization is wanted. Strong when-to-use guidance, though it does not state when to skip it (e.g., when the model ID is already known).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

run_subagentA
Runs BoteX — an autonomous code execution engine (agent-agnostic harness).
BoteX performs multi-step tasks on local files inside workspace_dir.

TIP: If the user didn't specify a model, DO NOT guess. Use the `recommend_models` tool first to find the best model for this task!

Key engine features:
- Outline-First and Context Pruning: ~90% token savings.
- Pre-write Syntax Check: in-memory code validation before touching disk.
- Multi-tier Fuzzy Patching: tolerant of CRLF/LF and indentation drift.
- Hard Zero-Retention on OpenRouter (provider: data_collection=deny)
  and DLP secret censoring.
- Automatic Snapshot Rollback on loops or critical failures.

Args:
    task: Precise description of the coding or refactoring task.
    files: Optional list of primary files affected by the task.
    workspace_dir: Project directory path. Empty = engine.default_workspace
           from the config, else the server's current directory.
    model: Any model from the provider's catalog. Empty = model from config
           (see 'profile' and botex.config.json).
    profile: Model profile from botex.config.json (e.g. 'default', 'coding',
           'auto-beta', 'fast'). When both 'model' and 'profile' are empty,
           the capability mode picks the tier via engine.mode_profiles
           (readonly -> 'fast', destructive/full -> 'coding'). Ignored when
           'model' is given explicitly.
    provider: API provider from the 'providers' section of botex.config.json
           ('openrouter', 'nvidia'). Empty = provider marked
           'default: true' in the configuration.
    mode: Capability preset: 'readonly' (read only — the contract is an
           analysis report, DONE requires non-empty findings), 'edit'
           (read + edit — default), 'destructive' (+delete/move),
           'full' (+run_command). Empty = engine.default_mode from
           config. Explicit allow_* flags may only WIDEN a preset —
           they never narrow it (readonly can never gain file writes).
           In headless mode this is pre-authorization — grant it
           consciously.
    max_turns: Maximum tool-loop steps (0 = config value).
    max_tokens: Per-turn completion cap (0 = config value; reasoning
           models need ~8000+ since thinking shares this budget).
    max_duration_s: Total wall-clock limit in seconds (0 = config value,
           0 disables only when config is also 0). Checked between turns.
    budget_limit_usd: Daily spend limit in USD (negative = config value,
           0 = no limit).
    allow_destructive: Authorize destructive operations (delete_file/
           move_file) for this task. Headless mode cannot confirm
           mid-run — grant ONLY with the user's consent.
    allow_exec: Authorize run_command for this task (also requires
           exec.enabled=true in config). WARNING: this is NOT a sandbox —
           commands run with operator privileges. Grant only for trusted
           workspaces with the user's consent.
    api_key: Optional provider API key passed per-request (highest
           priority — overrides env/.env/config). Empty = resolved
           internally by the harness.
    output_path: Optional required output file (workspace-relative).
           Sets the file_output contract: DONE is accepted only when
           the file exists on disk, is non-empty, and passes the
           syntax gate; a DONE response carrying the payload as text
           is salvaged to disk. Requires a mutating mode.
    allow_net: Explicitly authorizes the read-only public web tool for
           this run. It is never enabled by a capability mode.
    net_allowed_hosts: Optional per-run host authorization. In
           net.policy='caller' these replace config defaults; in 'public'
           they narrow public access; in 'allowlist' they must stay inside
           net.allowed_hosts.
    net_allowed_urls: Optional per-run URL authorization rules. A URL
           ending in '/' authorizes that subtree; otherwise it authorizes
           the exact URL including its query string.
    verify_command: Optional allowlisted command that must pass before
           DONE is accepted — it runs against the workspace as it
           stands, including when the task made no writes (a passing
           verifier validates a legitimate no-change result). Requires
           exec.enabled=true in config and exec authorization.
    recipe: Optional operational persona / workflow prompt (e.g. 'planner',
           'code-explorer', 'reviewer', 'security-reviewer', 'build-resolver', 'tdd').
    allow_non_zdr: Per-run consent to relax the Zero Data Retention
           gate. Required for free (:free) models whose endpoints may
           log or train on prompts — it also switches the wire
           provider.data_collection flag to 'allow'. Grant only with
           the operator's consent; the result carries
           zdr_enforced=false. The openrouter-free provider preset is
           the persistent config-level alternative.

Returns:
    A pretty-text report in the text content (unchanged format for legacy
    clients) plus the full engine result as structuredContent (status,
    failure_kind, ok, files_touched, exec_ran, rollback_verified,
    attempts[], cost_usd, ...). `ok` is true only when status == DONE —
    i.e. the task contract was verified, not merely claimed by the model.
ParametersJSON Schema
NameRequiredDescriptionDefault
modeNo
taskYes
filesNo
modelNo
recipeNo
api_keyNo
profileNo
providerNo
allow_netNo
max_turnsNo
allow_execNo
max_tokensNo
output_pathNo
allow_non_zdrNo
workspace_dirNo
max_duration_sNo
verify_commandNo
budget_limit_usdNo
net_allowed_urlsNo
allow_destructiveNo
net_allowed_hostsNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
okNo
stepsNo
statusNo
messageNo
summaryNo
task_idNo
attemptsNo
cost_usdNo
exec_ranNo
duration_sNo
lines_addedNo
failure_kindNo
zdr_enforcedNo
fallback_fromNo
files_touchedNo
lines_removedNo
rollback_verifiedNo

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the entire behavioral burden and does so richly: snapshot rollback on failure, pre-write syntax validation, ZDR/DLP guarantees, headless pre-authorization semantics, and the explicit warning that `allow_exec` is NOT a sandbox and runs with operator privileges. It also documents precedence (api_key > env > config) and reversibility, exactly the traits annotations would otherwise supply.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose is front-loaded, then a TIP, feature list, Args, and Returns — a logical order for a 21-parameter tool. The 'Key engine features' bullets lean slightly promotional (token-savings percentages) but still convey capability context, so the size is defensible though not maximally tight.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool this complex — 21 params, no annotations, no sibling differentiation elsewhere — the description covers invocation rationale, every argument, capability modes, safety gates, and the return contract (status/ok/failure_kind), so an agent has everything needed to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across 21 parameters, so the description must fully compensate — and it documents every one with meaning, defaults, and interaction rules (e.g. model overrides profile, empty flags fall back to config, allow_* can only widen a preset). This is exemplary compensation for an undocumented schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'Runs BoteX — an autonomous code execution engine' that 'performs multi-step tasks on local files inside workspace_dir.' That is far more than a tautology. What keeps it from a 5 is the absence of explicit differentiation from the sibling 'start_task', which an agent might reasonably confuse with a multi-step code-execution tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides real conditional guidance: routes the agent to `recommend_models` rather than guessing a model, states that destructive ops require the user's consent, and that `allow_exec` is only for trusted workspaces. It does not, however, tell the agent when to prefer this tool over alternating siblings such as start_task, so it falls short of full when/when-not routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

save_memoryA
Saves a persistent context note, architectural decision, task handoff, or lesson
into the workspace Memory Vault (<workspace_dir>/.botex/memory/).
Masks secrets and provides directory isolation.

Args:
    title: Short descriptive title of the memory entry.
    content: Detailed markdown notes, architectural rationale, or handoff context.
    workspace_dir: Workspace root directory. Empty = engine.default_workspace
           from the config, else the server's current directory.
    kind: Entry category ('context' | 'decision' | 'handoff' | 'lesson').
    tags: Optional list of keyword tags for filtering and discovery.
    memory_id: Optional custom identifier (alphanumeric/hyphen/underscore). Auto-generated if omitted.
ParametersJSON Schema
NameRequiredDescriptionDefault
kindNocontext
tagsNo
titleYes
contentYes
memory_idNo
workspace_dirNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it does disclose non-obvious behaviors: automatic secret masking, directory isolation, and memory_id auto-generation when omitted. It does not say what happens on an ID/title collision (overwrite vs. error), nor anything about permissions or retention, which are important for a persistent write.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The lead sentence front-loads purpose and destination, followed by a tight Args list where each entry is one sentence. No filler, though the multi-line block format is slightly verbose relative to the information conveyed.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists so return values need not be explained, and all input parameters are covered along with useful side-effect notes (secret masking, isolation). The remaining gap is usage routing against the read/search siblings and collision behavior, which keeps it short of complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, yet the description documents all six parameters with meaning beyond the bare types: it explains the kind categories, that tags are for filtering/discovery, that memory_id must be alphanumeric/hyphen/underscore and is auto-generated if omitted, and the fallback rules for workspace_dir. Strong compensation, though the markdown format of content could be stated more precisely.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a concrete verb and resource ('Saves a persistent context note... into the workspace Memory Vault') and names the exact storage path plus the four entry categories. It clearly occupies the write slot opposite the read_memory/search_memory siblings, though it never names those alternatives explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The kind values ('context' | 'decision' | 'handoff' | 'lesson') implicitly signal when each entry type applies, which gives partial usage guidance. However, there is no explicit statement of when to use save_memory versus search_memory/read_memory, no when-not conditions, and no prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_memoryA
Searches the workspace Memory Vault (<workspace_dir>/.botex/memory/)
by keyword query, tag, or entry kind (context, decision, handoff, lesson).

Args:
    workspace_dir: Workspace root directory. Empty = engine.default_workspace
           from the config, else the server's current directory.
    query: Free-text search string matched against title, content, and tags.
    tag: Filter by specific tag.
    kind: Filter by entry kind ('context', 'decision', 'handoff', 'lesson').
ParametersJSON Schema
NameRequiredDescriptionDefault
tagNo
kindNo
queryNo
workspace_dirNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It usefully discloses the storage path and the fallback chain for an empty workspace_dir (config default workspace, else server CWD), but says nothing about how filters combine, result ordering/limits, or that the call is a non-mutating read.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the one-line purpose before the Args block, and each parameter line earns its place. The docstring-style 'Args:' formatting is functional rather than elegant, but nothing is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and all four parameters are covered. Still missing are the filter-combination semantics (AND vs OR) and any guidance on relating this tool to read_memory/save_memory, which leaves real gaps for a discovery tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description does the full job: it explains all four parameters, gives the empty-string default semantics for workspace_dir, and enumerates the valid kind values (context, decision, handoff, lesson) that the schema fails to express as an enum.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Searches the workspace Memory Vault') and names the three filter dimensions (query, tag, kind). It is clearly distinguishable in intent from save_memory and read_memory, though it never names those siblings explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by describing the filter modes, but there is no explicit when-to-use/when-not guidance and no routing against the obvious alternatives read_memory and save_memory. An agent must infer that this is the discovery tool and the other two are point read/write.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

start_taskA

Start a detached BoteX task and return its task_id immediately.

Runs the same engine as `run_subagent`, but returns instantly with a
`task_id` for polling via `get_task_status`. Concurrency is bounded by
engine.max_concurrent_tasks and the queue by engine.max_queued_tasks —
a full queue returns status TOO_MANY_QUEUED.

The capability/limits arguments are identical to `run_subagent` —
same contracts, same pre-authorization semantics:

- mode: capability preset — 'readonly' (read tools only; the contract
  is an analysis report), 'edit' (read + write; default), 'destructive'
  (+ delete/move), 'full' (+ run_command). Empty = engine.default_mode.
- allow_destructive / allow_exec / allow_net only ever WIDEN the
  preset, never narrow it — a readonly task cannot gain file writes.
  allow_exec additionally requires exec.enabled=true in the config.
  None of these is a sandbox: grant them only with the user's consent.
- output_path makes the contract file_output: DONE requires the file
  to exist, be non-empty, and pass the syntax gate (mutating mode).
- verify_command is an allowlisted command that must pass before DONE
  is accepted — it runs even when the task made no writes. Requires
  exec authorization.
- recipe: Optional operational persona / workflow prompt (e.g. 'planner',
  'code-explorer', 'reviewer', 'security-reviewer', 'build-resolver', 'tdd').
- max_turns / max_tokens / max_duration_s / budget_limit_usd:
  0 (negative for budget) = config value; a non-positive max_turns is
  clamped to 1.
- net_allowed_hosts / net_allowed_urls narrow or replace the net
  scope per run according to net.policy (see run_subagent).
- allow_non_zdr: per-run consent to relax Zero Data Retention — needed
  for free (:free) models whose endpoints may log or train on prompts.
  Same semantics as in run_subagent.

Returns:
    {"task_id": str, "status": "QUEUED"} — poll with get_task_status.
    The finished task's `result_data` carries the full engine result
    (status, failure_kind, ok, files_touched, exec_ran,
    rollback_verified, attempts[], cost_usd, ...).
ParametersJSON Schema
NameRequiredDescriptionDefault
modeNo
taskYes
filesNo
modelNo
recipeNo
api_keyNo
profileNo
providerNo
allow_netNo
max_turnsNo
allow_execNo
max_tokensNo
output_pathNo
allow_non_zdrNo
workspace_dirNo
max_duration_sNo
verify_commandNo
budget_limit_usdNo
net_allowed_urlsNo
allow_destructiveNo
net_allowed_hostsNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and delivers: concurrency bounds (engine.max_concurrent_tasks), queue bound with the TOO_MANY_QUEUED failure status, the widening-only authorization semantics of allow_destructive/allow_exec/allow_net, the exec.enabled prerequisite, the DONE contract for output_path, and ZDR implications of allow_non_zdr. This is unusually rich disclosure of side effects and constraints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the one-line summary and the async/poll relationship, then groups the capability arguments. Given 21 parameters, the length is largely earned, though a few bullets defer to 'see run_subagent' and the return-value section is somewhat redundant with the existing output schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex 21-parameter mutation-capable tool with no annotations, the description covers startup behavior, queue semantics, authorization model, contract enforcement, and polling handoff. An agent has everything needed to invoke it correctly, and the output schema carries the detailed return shape.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across 21 parameters, so the description must compensate, and it explains the semantically tricky ones in depth (mode presets, widening-only flags, output_path contract, verify_command, recipe personas, budget/turn defaults, net scope narrowing). It leaves several parameters unexplained (files, model, api_key, profile, provider, workspace_dir), so coverage is strong but not complete.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Start a detached BoteX task') plus the immediately observable outcome ('return its task_id immediately'). It explicitly contrasts itself with the sibling run_subagent by being the fire-and-poll variant, so an agent can distinguish them without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Names the alternative (run_subagent), explains the defining difference (returns instantly vs. blocking), and points to the follow-up tool (get_task_status) for polling. It stops short of stating explicit selection conditions such as 'use this when the task is long-running or may exceed a request timeout,' so it is clear but not fully prescriptive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 6 tool updatesv1.1.1
    • Changedget_outline1 field changed
      • changedInput schema / properties / workspace_dir / default
        Previous value: -"."New value: +""
    • Changedread_memory1 field changed
      • changedInput schema / properties / workspace_dir / default
        Previous value: -"."New value: +""
    • Changedrun_subagent1 field changed
      • changedInput schema / properties / workspace_dir / default
        Previous value: -"."New value: +""
    • Changedsave_memory1 field changed
      • changedInput schema / properties / workspace_dir / default
        Previous value: -"."New value: +""
    • Changedsearch_memory1 field changed
      • changedInput schema / properties / workspace_dir / default
        Previous value: -"."New value: +""
    • Changedstart_task1 field changed
      • changedInput schema / properties / workspace_dir / default
        Previous value: -"."New value: +""
  2. 3 tool updatesv1.0.1
    • Changedrecommend_models1 field changed
      • addedInput schema / properties / include_free
        Added value: +{
        +  "default": false,
        +  "title": "Include Free",
        +  "type": "boolean"
        +}
    • Changedrun_subagent3 fields changed
      • addedInput schema / properties / allow_non_zdr
        Added value: +{
        +  "default": false,
        +  "title": "Allow Non Zdr",
        +  "type": "boolean"
        +}
      • addedOutput schema / $defs / SubagentAttemptResult / properties / zdr_enforced
        Added value: +{
        +  "title": "Zdr Enforced",
        +  "type": "boolean"
        +}
      • addedOutput schema / properties / zdr_enforced
        Added value: +{
        +  "title": "Zdr Enforced",
        +  "type": "boolean"
        +}
    • Changedstart_task1 field changed
      • addedInput schema / properties / allow_non_zdr
        Added value: +{
        +  "default": false,
        +  "title": "Allow Non Zdr",
        +  "type": "boolean"
        +}
  3. 12 tool updatesv1.0.0
    • First observedcheck_health
    • First observedclean_snapshots
    • First observedfetch_url
    • First observedget_outline
    • First observedget_stats
    • First observedget_task_status
    • First observedread_memory
    • First observedrecommend_models
    • First observedrun_subagent
    • First observedsave_memory
    • First observedsearch_memory
    • First observedstart_task

TDQS

A3.7/5.0

Scored across 12 tools

Disambiguation4/5

Most tools target clearly distinct resources or actions, but start_task and run_subagent both execute BoteX tasks with nearly identical arguments, so agents may hesitate over sync vs detached execution. The descriptions explicitly explain the async contract and task_id polling, so the overlap is recoverable rather than fatal.

Naming Consistency5/5

All tools use snake_case with a predictable verb_noun or verb pattern (start_task, get_stats, check_health, save_memory). There are no mixed conventions or vague names, making the set easy to scan and remember.

Tool Count5/5

At 12 tools, the server is well scoped for its apparent domain: task execution, task status/stats, diagnostics, model recommendation, URL fetch, outline extraction, and memory vault operations. Each tool appears to earn its place rather than padding the surface.

Completeness3/5

Core task execution is covered with run_subagent/start_task and get_task_status, but there is no cancel_task or list_tasks, which can strand detached tasks. The memory vault supports save/search/read but lacks delete/update/list-all, creating notable lifecycle gaps even if some workarounds exist.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    A
    maintenance
    Enables MCP-capable coding assistants to delegate repository investigation, bounded implementation work, and noisy command runs (tests, builds, linters) to sandboxed OpenCode agents. Each role can use an independently selected model, and only concise results are returned to the parent agent, which keeps responsibility for architecture and high-risk operations.
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables MCP clients like Codex and DSH to invoke DeepSeek subagents for inspect, plan, review, and implement tasks, with write protection, rollback, and status reporting.
    6 npm
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables delegating tasks to agents you configure yourself through OpenAI-compatible Chat Completions backends, with automatic or explicit routing, synchronous calls, persistent asynchronous jobs, and multi-step reviewed workflows. It returns proposals and analyses only, leaving file changes, command execution, and approvals under the MCP client's control.
    333 npm
    MIT