BoteX
BoteX is an agent-agnostic execution harness that runs autonomous, guardrailed code-editing tasks on local files and exposes memory, diagnostics, and model-selection utilities over MCP.
Run coding tasks synchronously (
run_subagent): outline-first inspection, in-memory syntax validation, fuzzy patching, snapshot rollback, and verified completion (okonly when the contract passes on disk).Run tasks asynchronously (
start_task+get_task_status): detach work in the background, then poll lifecycle (QUEUED/RUNNING/DONE/FAILED/CANCELLED) and structured results (files touched, exec ran, attempts, cost).Inspect code cheaply (
get_outline): fetch symbol skeletons with line numbers instead of whole files to save tokens.Persist and retrieve context (
save_memory,read_memory,search_memory): local or global memory vault for decisions, handoffs, lessons.Get model recommendations (
recommend_models): live OpenRouter benchmark-based picks by cost/quality, with optional:freevariants.Fetch external web content (
fetch_url): SSRF-safe, size-limited public HTTP(S) retrieval with secret masking.Run diagnostics and maintenance (
check_health,get_stats,clean_snapshots): verify provider/key readiness, view token/cost reports, prune old snapshots.Enforce safety gates: capability modes (
readonly/edit/destructive/full), explicit opt-ins for destructive ops, command execution, and network access, HITL approvals, ZDR enforcement, secret masking, budget caps, andverify_commandcompletion gates.
Allows using NVIDIA as a model provider for autonomous code-execution tasks, with configurable profiles and model fallbacks.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@BoteXAdd email validation to auth/validators.py and cover it with tests"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
BoteX: Execution Harness for AI Coding Agents
Giving an LLM direct, unrestricted access to your repository usually ends the same way: it hallucinates line numbers, corrupts indentation, writes broken syntax, eats your token budget reading thousands of irrelevant lines, or gets stuck in an infinite fix-break loop.
BoteX is a guardrail harness designed specifically for autonomous code-editing agents. It sits between an MCP client (such as Devin, Antigravity, Claude Desktop, or Cursor) and your codebase, enforcing deterministic safeguards before any code ever touches your disk.
Why BoteX?
Instead of trusting the model to behave, BoteX wraps every action in safety gates:
Outline-first inspection: Agents inspect symbol skeletons (
get_outline) before asking for specific line ranges. This prevents dumping massive files into context and slashes token waste.Prompt Injection & Untrusted Data Isolation (OWASP LLM01: Prompt Injection): External content retrieved by tools (file contents, web pages, memory notes) is automatically wrapped in XML-like untrusted data boundary tags (
<untrusted_file_content>,<untrusted_web_content>,<untrusted_memory_content>). System prompt rules instruct the LLM to treat bounded content strictly as data, significantly reducing prompt injection risks.Sensitive Information Disclosure & Secret Guardrails (OWASP LLM02: Sensitive Information Disclosure): Prevents accidental leaks by blocking access to environment files (
.env*), SSH keys, credentials, and local configurations (botex.config.local.json). Automatically redacts API keys, Bearer tokens, private keys, and provider secrets in tool outputs and logs.Read-before-write gate: Models cannot patch a file they haven't inspected in the current session. No blind edits, no guessing.
Pre-write syntax validation: Code modifications are validated in memory (e.g.
ast.parsefor Python) before saving. If the patch breaks syntax, it gets rejected on the spot.Multi-tier fuzzy patching: Patches are whitespace- and newline-resilient (CRLF/LF agnostic with indentation detection), so minor formatting mismatches don't break execution.
Unbounded Consumption Protection (OWASP LLM06: Unbounded Consumption): Prevents "Denial of Wallet" and infinite loop resource exhaustion. BoteX evaluates USD spend dynamically mid-loop to enforce the budget cap instantly, and aborts with an automatic rollback if the agent falls into a mutation streak or stagnation loop.
Misinformation Protection (OWASP LLM07: Misinformation): Generated code undergoes rigorous in-memory AST and syntax validation (including
rufffor Python andbash -nfor shell scripts) to reject hallucinated or invalid code before touching disk. Post-writeverify_commandacts as a mandatory final test gate.Improper Output Handling (OWASP LLM10: Improper Output Handling): Strict Read-Before-Write gates ensure no blind writes occur, and every touched file is backed by a pre-mutation snapshot. If an agent hits an error, the automatic snapshot rollback reverts the workspace cleanly.
Hard budget & pricing caps: Pre-flight checks verify model pricing against live provider catalogs. If a task exceeds its budget or a model is overpriced, BoteX aborts before spending a cent.
Strict privacy & Zero Data Retention (ZDR): Enforces
provider.data_collection: denyon OpenRouter calls, blocks.env/secrets, masks API keys in logs, and prevents path traversal attacks. Free (:free) models that cannot guarantee ZDR are rejected locally. Opt out explicitly per run (allow_non_zdr) or via theopenrouter-freeprovider preset.Enhanced Permission Controls (OWASP LLM03: Excessive Agency): BoteX protects against Excessive Agency via a centralized Agency Middleware. Tools are strictly defined with Risk Levels (LOW, MEDIUM, HIGH) and required scopes. High-risk destructive actions automatically require explicit interactive operator approval (or pre-authorized task scopes in headless mode), limiting the potential damage of prompt injections or hallucinations.
Related MCP server: dsh-codex-bridge
Quickstart
1. Installation
Requires Python 3.10+:
pip install -r requirements.txt(Optional: install globally via pip install . to get the botex CLI command).
2. Add your API key
BoteX handles provider keys internally, so calling MCP clients don't need to pass credentials on every request. Create a .env file next to server.py:
OPENROUTER_API_KEY=sk-or-v1-...Key lookup order: OPENROUTER_API_KEY env var → local .env → custom paths.env_file → botex.config.local.json (gitignored).
3. Connect to your MCP client
You can run BoteX as a local stdio process or as a remote service over SSE.
Option A: Local Process (stdio)
Register BoteX using the included zero-install launchers (botex.cmd on Windows, botex.sh on Linux/macOS) or directly with Python:
{
"mcpServers": {
"botex": {
"command": "C:/path/to/harness/botex.cmd"
}
}
}Option B: Remote MCP via SSE (Cloud or VPS)
Start the gateway with botex cloud and connect via Server-Sent Events (SSE):
{
"mcpServers": {
"botex-cloud": {
"url": "http://127.0.0.1:8000/mcp/sse",
"headers": {
"Authorization": "Bearer <your_token>"
}
}
}
}How It Works
Every delegated task goes through an explicit contract-driven lifecycle:
Delegated Task
│
▼
[Pre-flight check] ──► Validate budget, model capabilities & price cap
│
▼
[Tool Loop] ──► Symbol outline ─► Target read ─► In-memory patch ─► Syntax check
│
├─► Success ──► Verify contract (file exists, syntax valid, verify_command passed) ─► DONE
│
└─► Failure ──► Rollback snapshots ─► Try next candidate (model_fallbacks) or abortA task returns ok: true only when its completion is verified on disk, not just because an LLM said "I'm done".
MCP Tools Reference
BoteX exposes a focused set of MCP tools:
Task Execution
run_subagent(task, ...): Runs a full coding task synchronously and blocks until finished. Returns both human-readable text and detailed structured metadata.start_task(task, ...): Launches a task asynchronously in the background and returns atask_id.get_task_status(task_id): Polls progress, logs, and results for a background task.
Two-Tier Memory Vault
save_memory(title, content, workspace_dir, kind, tags, memory_id, scope): Saves persistent notes, decisions, handoffs, or lessons. Scope can be"local"(<workspace_dir>/.botex/memory/) or"global"(~/.botex/memory/).read_memory(memory_id, workspace_dir, scope)/search_memory(workspace_dir, query, tag, kind, scope): Retrieves saved memory across local or global storage (scope="all"searches both).
Diagnostics & Utility
get_outline(path, workspace_dir): Returns a high-level symbol outline of a file without reading all lines.get_stats(period): Generates token usage and cost reports from the local analytics ledger.check_health(): Checks readiness of providers, models, keys, and budget limits.clean_snapshots(max_age_days, max_total_mb): Prunes old workspace backup snapshots.recommend_models(task_type, limit, include_free, provider, profile, tier): Queries/api/v1/modelswith authenticated headers, classifies models intohigh/standard/budgettiers, filters for tool-calling support (require_tools=true) and interactive endpoints (excluding:batch), and ranks models by task aptitude and token cost.include_free=trueadmits:freevariants.fetch_url(url, max_bytes): Safe, caller-side URL fetching with strict host and size filters.
Task Delegation & Parameters
Example payload for run_subagent:
{
"task": "Add email validation to auth/validators.py and cover it with unit tests",
"files": ["auth/validators.py"],
"workspace_dir": "./my-project",
"profile": "coding"
}Key Parameters
Parameter | Default | Description |
| (required) | Clear description of what needs to be implemented or fixed. |
|
| List of primary target files to nudge the agent toward. |
|
| Root directory the agent is restricted to. Empty = |
|
| API provider from |
|
| Explicit provider model ID; overrides |
|
| Model profile from |
|
| Provider API key per-request; highest priority (overrides env/.env/config). |
|
| Capability preset: |
|
| Specialized workflow persona ( |
|
| Max tool-loop iterations ( |
|
| Per-turn completion cap ( |
|
| Total wall-clock limit in seconds ( |
|
| Hard spend limit for this task ( |
|
| Explicit opt-in for |
|
| Explicit opt-in for |
|
| Explicit opt-in for web access via |
|
| Per-run host authorization for |
|
| Per-run URL authorization; a trailing |
|
| Per-run consent to relax the ZDR gate; required for |
|
| Enforce that this exact file must be written and non-empty for |
|
| Verification command (e.g. |
Recipes & System Prompts
BoteX builds the API System Prompt dynamically for each run. It fuses a hardcoded operational core (tool rules, syntax validation checks, output formats) with an optional Recipe (a markdown file).
This means that providing a --recipe <name> (or the "recipe": "<name>" JSON parameter) acts as an injection mechanism for your custom System Prompts, giving the agent specialized personas or specific constraints.
Recipes live in the botex/recipes/ directory.
Examples of custom System Prompts for Modding and Analysis
If you are using BoteX as an MCP Server to analyze game mods or reverse-engineer engine behavior, you can create custom recipes like botex/recipes/ue4.md or botex/recipes/lua_audit.md.
Unreal Engine 4 Modding (
--recipe ue4)You are an expert C++ and UE4 Blueprint reverse engineer. Your primary goal is to identify memory leaks in object instantiation and unsafe cast operations. Always prioritize stability over performance optimizations. Adhere strictly to Epic Games naming conventions.Security Audit (
--recipe lua_audit)You are a strict security auditor analyzing game mods. Review this Lua codebase for potential sandbox escapes, arbitrary file read/write vulnerabilities, and networking exploits. Do not attempt to fix logic bugs; focus only on security vulnerabilities.Code Refactoring & Optimization (
--recipe optimize)You are an optimization expert. The target codebase runs in a heavily restricted environment. Identify inefficient loops, excessive global variable usage, and unnecessary memory allocations. Suggest changes using only standard libraries.
When provided, BoteX automatically appends your recipe to the system instructions before starting the LLM loop.
Safety & Capability Modes
Permissions follow the principle of least privilege. Modes are presets over core capabilities:
Mode | Allowed Operations | Typical Use Case |
| Outline inspection, ranged file reads, memory search. | Architecture reviews, exploratory passes. |
| Read tools + | Standard feature work and bug fixing. |
| Edit tools + | Refactoring, renaming, file reorganizations. |
| Destructive tools + gated | Full autonomous loop (edit → test → fix). |
Network access (allow_net) is never enabled by default in any preset. It must be explicitly enabled per request or configured via net.allowed_hosts.
Command Execution (run_command) Safety
BoteX is not a full OS sandbox. When allow_exec is granted, processes run under the operator's account. However, BoteX guards execution with multiple layers:
Disabled by default: Requires
exec.enabled: truein configuration.Binary allowlist: Only pre-approved executables (
pytest,python,ruff,git, etc.) can be called.Deny rules: Blocks dangerous arguments (
python -c,git push,rm, shell piping, network downloads).Isolated environment: Executes directly (
shell=False), workspace set as cwd, secret environment variables stripped, and execution timeouts strictly enforced.
Human-in-the-Loop (HITL) Approvals
BoteX integrates an interactive approval manager for high-risk operations. Configure the policy in botex.config.json under approval.policy:
NONE: Auto-approves operations permitted by the capability mode.HIGH_RISK(default): Blocks destructive actions (delete_file,move_file) and shell execution (run_command) until an operator approves.MUTATIONS: Requires operator approval for any file modifications (create_file,apply_patch).ALL_RISKY: Intercepts all mutating tools and system execution commands.
In REPL mode, BoteX prompts for interactive confirmation. In Cloud Gateway mode, actions enter a pending approval queue and can be approved or rejected via REST API (POST /api/approvals/{id}/decide).
Model Fallbacks & OpenRouter Live Routing
If a model refuses a task, burns its token limit without output, or hits provider rate limits, BoteX falls back to alternative models defined in botex.config.json:
"model_fallbacks": {
"default": ["deepseek/deepseek-v3.2", "anthropic/claude-sonnet-4", "openai/gpt-5.4-mini"],
"coding": ["deepseek/deepseek-v3.2", "anthropic/claude-sonnet-4", "openai/gpt-5.4-mini"],
"auto-beta": ["qwen/qwen3-coder", "deepseek/deepseek-v3.2", "anthropic/claude-sonnet-4"],
"fast": ["google/gemini-2.5-flash-lite", "deepseek/deepseek-v3.2"]
}BoteX uses two complementary failover layers:
In-Payload OpenRouter Failovers (
extra_body.models): Before sending the first turn to OpenRouter, BoteX runs each fallback candidate through all five safety gates (Denylist,Decisions,ZDR,Price,Tools) and passes up to three validated slugs inextra_body["models"]. If the primary endpoint is overloaded on the initial request, OpenRouter switches to the next validated model on the wire without an extra client round-trip. Meta-routers (openrouter/auto,openrouter/pareto-code,openrouter/free) are excluded frommodels: [...], and once a run modifies any file (files_touched) or executes a command (exec_ran), BoteX stripsmodelsfrom subsequent turns so a different model never takes over a mutated workspace mid-task.Engine-Level Rollback & Retry: If an attempt fails mid-run, BoteX verifies that all partial file changes from the failed attempt were rolled back before starting the next candidate model. A fallback model never inherits a dirty workspace.
For OpenRouter runs, BoteX also sets extra_body.provider (data_collection: "deny" when ZDR is active, require_parameters: true when tools or response_format are present, allow_fallbacks: true, and sort: "throughput"), automatically stripping reasoning parameters for non-reasoning model slugs so require_parameters: true never triggers HTTP 404 rejections. On DONE, BoteX queries GET /api/v1/generation?id=... in parallel (with a short 404 retry) to record official billing (total_cost), queue latency (queue_time_ms), inference time (generation_time_ms), and prompt cache read/write tokens in .agent_analytics.json and .botex/memory/ task receipts.
Free Models (Non-ZDR Opt-in)
ZDR is on by default and :free slugs are rejected pre-flight with ZDR_VIOLATION. Operators without a paid subscription (or anyone who accepts that free endpoints may log/train on prompts) can opt in two ways; both leave an audit trail (zdr_enforced: false in the result and a stderr warning):
# Persistent: switch to the bundled free-tier provider preset
# (all profiles resolve to tool-capable :free models)
botex config provider openrouter-free # or BOTEX_PROVIDER=openrouter-free
# or relax ZDR on the current provider (keeps paid models, widens routing)
botex config zdr off # 'on' restores enforcement
# Per-run only, no config change:
botex run "task" --provider openrouter-free
botex run "task" --model qwen/qwen3.8-27b:free --allow-non-zdr{"task": "...", "provider": "openrouter-free"}
{"task": "...", "model": "qwen/qwen3.8-27b:free", "allow_non_zdr": true}:free variants also require the OpenRouter account-level free-model opt-in (privacy settings); without it requests surface as provider_policy_denied. Free models carry per-day rate limits. The model_fallbacks chains in the preset stay entirely on :free slugs.
Configuration
Settings are resolved hierarchically (lowest to highest priority):
botex.config.json: committed defaults (provider profiles, engine limits, security lists).botex.config.local.json: machine-local overrides (gitignored; place custom keys or limits here).BOTEX_*environment variables.
Config files are re-read automatically when they change (file mtime check on every access), so edits to botex.config.local.json - manual or via botex config ... - take effect on the next call, including in a running MCP server; no restart is needed. Environment variables are read from the server process environment, so changing them requires a restart.
Example botex.config.local.json:
{
"engine": {
"budget_limit_usd": 1.0,
"max_turns": 20,
"default_workspace": "C:/projects/my-project"
},
"pricing": {
"max_input_per_mtok": 3.0,
"max_output_per_mtok": 6.0
}
}Standalone CLI & REPL
BoteX can be run directly from your terminal without any MCP client:
Interactive REPL
botex repl -w ./my-project --profile codingPrompts for [y/N] confirmation whenever the agent wants to delete or move files.
The startup banner shows the resolved absolute workspace and where it came from (explicit, default_workspace or cwd), and warns when it is the BoteX repository itself. Inside the REPL, workspace (or cd) prints the current workspace, and workspace <DIR> / cd <DIR> switches the target project for the rest of the session (relative paths are resolved against the current workspace; the directory must exist).
Set a persistent default so that running botex without -w never targets the harness itself:
botex config workspace C:/projects/my-project # writes engine.default_workspace
botex config workspace none # clear it (falls back to cwd)Workspace resolution: explicit -w / workspace_dir > engine.default_workspace > current directory. BOTEX_DEFAULT_WORKSPACE overrides the config value.
Headless One-Shot Tasks
# Run a specific task
botex run "Add --verbose flag to cli.py" -w ./my-project --profile coding
# Fix a bug with a tight turn budget
botex run "Fix the failing auth test" --files tests/test_auth.py --max-turns 15
# Refactoring with destructive permissions
botex run "Clean up legacy modules" -w ./my-project --allow-destructiveConversational Chat Mode
Multi-turn discussion with token streaming, read-only tools, and automatic context pruning:
# Start interactive chat in the terminal
botex chat --model openrouter/auto
# With a custom system prompt and temperature
botex chat --system "Focus on security analysis" --temp 0.2In-chat commands: /clear (reset session), /history (review transcript), /help, /exit.
Cloud Gateway & Remote MCP (FastAPI)
Run BoteX as a background cloud daemon with SSE transport, WebSocket chat, and REST endpoints:
# Start cloud server on default port 8000
botex cloud --host 0.0.0.0 --port 8000Zero-Friction Local mode runs unauthenticated when BOTEX_ACCESS_TOKEN is unset. Set BOTEX_ACCESS_TOKEN in .env to enforce Bearer token verification on all protected endpoints.
Maintenance & Observability
botex health # Verify API keys, provider connectivity, and model pricing
botex wallet # Check OpenRouter balance, key limits, and daily query caps
botex config # Inspect or modify local configuration defaults
botex --stats # View weekly token consumption and spend per model
botex --stats --month # Monthly cost report
botex --history <task_id> # Inspect exact prompts, tool calls, and diffs for a run
botex --snapshots # Check disk usage of backup snapshots
botex --clean-snapshots # Prune old snapshot backups
botex models [--refresh] # List configured provider models (refresh catalog)
botex serve # Force MCP stdio server mode explicitlyProject Structure
server.py MCP server entry point & CLI dispatcher
botex.cmd / botex.sh Zero-install launchers (auto-detects python environment)
pyproject.toml Package configuration (exposes `botex` CLI command)
requirements.txt Runtime dependencies
botex.config.json Committed defaults (providers, engine limits, exec/net policy)
ROADMAP.md Deferred features & technical rationale
botex/
approval.py Human-in-the-loop approval manager, async actions, and rollback integration
chat.py Conversational chat sessions, token streaming, and read-only sandbox
server_cloud.py FastAPI cloud gateway, Remote MCP SSE, WebSocket chat, and REST API
catalog.py Dynamic model catalog, TTL caching, and live provider query
denylist.py Hierarchical model exclusions (globs and regex)
wallet.py Key credits, spend analytics, and daily query limits
engine.py Autonomous execution loop, context management & rollback triggers
file_tools.py Safe outline-first reading, file creation, moving & deletion
patch_engine.py Fuzzy patch matching, syntax validation & snapshot management
security.py Path traversal defenses, secret masking & gitignore filtering
exec_tools.py Policy-controlled command execution & argument filtering
capabilities.py Permission presets (readonly, edit, destructive, full)
config.py Layered config loader (defaults < local < env)
net_tools.py Net policy enforcement (read_url / fetch_url)
memory.py Two-tier memory vault (local .botex/memory/ and global ~/.botex/memory/)
analytics.py Cost/token ledger, budgeting & summary reporting
pricing.py Live model price guardrail & catalog checks
providers.py Provider adapters (OpenRouter, NVIDIA, etc.) & request normalizer
benchmarks.py Live model recommendations (recommend_models)
contracts.py Task completion verification & status taxonomy
recipes.py Recipe loading & system-prompt injection
i18n.py / ui.py CLI language & status rendering
recipes/ Specialized agent personas (planner, reviewer, tdd, etc.)
skills/botex/ Caller-side SKILL.md (delegation patterns)
tests/ Comprehensive test suite (unit, cloud gateway, chat, approvals)
docs/
TUTORIAL.md Architecture deep dive and technical walkthroughTesting
Run the full local test suite (no API key required):
python -m pytest tests/All unit, approval, chat, memory, and cloud gateway tests run hermetically in offline mode.
License & Trademark
BoteX is licensed under the Apache License 2.0. See LICENSE for details. Derivative works must retain attribution notices as specified in NOTICE.
The BoteX name and logo are trademarks of Jakub Grzesiak (jg-webtech.pl). You are free to fork and modify the code under Apache-2.0, but forks or derived distributions should not use the name "BoteX" or suggest official endorsement without prior written consent.
Available Tools
12 toolscheck_healthA
Checks BoteX environment readiness (provider keys, snapshot dir, disk).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It discloses what is actually checked—provider keys, snapshot directory, and disk—and the verb 'Checks' implies a non-mutating inspection. It does not explicitly state side-effect-free behavior, but nothing in the description suggests modification.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One short sentence communicates the verb, target, and specific scope without any filler. The parenthetical list of checks is compact and informative, making the description easy to scan and parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless health-check tool with an output schema, this description is complete: it names the exact environmental areas inspected and implies the tool's role. No additional context is needed for an agent to select or invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so there are no parameter semantics to clarify. The schema is empty and fully covers the input surface, so the description does not need to compensate for missing parameter documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Checks') and resource ('BoteX environment readiness'), then enumerates the exact components checked: provider keys, snapshot dir, and disk. This clearly distinguishes it from sibling tools that handle tasks, memory, URLs, or model recommendations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context: this tool is for verifying whether the BoteX environment is properly set up. It does not explicitly state when not to use it or compare it to alternatives, but its health-check role makes the intended use obvious enough.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
clean_snapshotsC
Purges old or excess backup snapshots from disk.
| Name | Required | Description | Default |
|---|---|---|---|
| max_age_days | No | ||
| max_total_mb | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It indicates this is a destructive operation ('purges') but doesn't disclose whether snapshots are permanently deleted, if there's any recovery mechanism, required permissions, or whether there are safeguards. It lacks details on the impact on the system (e.g., could it delete snapshots in use?).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence with no waste. It front-loads the verb and resource. It is appropriately sized for a simple tool, though it could be slightly more descriptive without losing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that this is a destructive maintenance tool with two parameters that control deletion criteria, and no annotations to clarify safety, the description lacks critical information about the deletion behavior, parameter interaction, and any safeguards. The output schema exists but is not shown; if it explains the outcome, that helps, but the description alone does not fully equip an agent to call this safely and correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. However, the description doesn't explain that max_age_days and max_total_mb are criteria for deletion. It only says 'old or excess' which loosely maps to age and size, but does not clarify how the parameters interact (e.g., are they both applied, or either/or?) or their units. The parameter names and defaults are self-explanatory, so a baseline of 3 is appropriate, but more explicit linkage would improve it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the action ('purges') and the resource ('backup snapshots'), and clarifies it removes 'old or excess' ones. However, it doesn't specify the exact criteria for what counts as 'old' or 'excess' beyond the parameters, and doesn't differentiate from any sibling tools (none appear directly related, but the description could be more precise about the scope).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to use this tool versus alternatives. It doesn't mention any prerequisites, conditions for invocation, or when to avoid using it. The agent is left to infer that it's for maintenance tasks, but there's no explicit context on when this should be called.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_urlA
Fetch one public http(s) text document for caller-side research.
This tool is intentionally separate from BoteX's internal read_url: the
orchestrating agent chooses the URL, so arbitrary public hosts do not have
to be configured in net.allowed_hosts. SSRF protections, redirect
revalidation, content-type checks, byte limits, and secret masking still
apply. In net.policy='allowlist', only configured hosts may be fetched.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | ||
| max_bytes | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden and does so well: it discloses SSRF protections, redirect revalidation, content-type checks, byte limits, secret masking, and the allowlist-mode restriction. This is unusually rich behavioral context for a no-annotation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the core purpose in the opening clause and keeps the security model tight across a few sentences. Every sentence adds distinct information, though the prose could be marginally denser.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and the security/policy model is well covered. The remaining gap is the undocumented max_bytes parameter, which leaves an agent guessing about truncation behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and there are two parameters, so the description must compensate. It adds some meaning to 'url' via 'public http(s) text document', but never explains max_bytes (default 0 presumably means unbounded) or its interaction with the byte limits it mentions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Fetch one public http(s) text document') plus the calling context ('caller-side research'). It explicitly distinguishes itself from BoteX's internal read_url, so an agent can tell the two apart without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explains why this tool exists (the orchestrating agent chooses the URL, avoiding allowlist configuration) and gives the selecting condition for the alternative (internal read_url). It also notes the net.policy='allowlist' restriction. It stops short of an explicit when-not/exclusion statement beyond that policy note.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_outlineA
Returns a lightweight file skeleton (classes, methods, functions, headers,
line numbers) without reading the whole file. Saves ~90% of tokens.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| workspace_dir | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden, and it does disclose the core behavioral trait: a lightweight, non-whole-file read that saves tokens and returns structural elements with line numbers. However, it says nothing about error behavior on unsupported file types, permissions, or size limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the action and return shape, then the value proposition. The parenthetical enumeration is compact and informative rather than padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and the tool is simple (one required parameter). The description covers purpose, contents, and the token-saving rationale; only parameter semantics and explicit usage routing are missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for both parameters, and the description never mentions 'path' or 'workspace_dir'. With zero coverage the description should compensate but adds no meaning for either parameter or their required/default status.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Returns a lightweight file skeleton') and enumerates the concrete contents (classes, methods, functions, headers, line numbers). No sibling tool overlaps with file outlining, so the agent can place it immediately without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The clause 'without reading the whole file. Saves ~90% of tokens' implies the intended use case (cheap structural reconnaissance before/ instead of a full read), but no alternative tool is named and no when-not condition is given. Usage is inferable rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_statsB
Returns an analytics summary of executed BoteX tasks (USD costs, token
usage, code-line balance).
Args:
period: 'week' (last 7 days) or 'month' (last 30 days).
| Name | Required | Description | Default |
|---|---|---|---|
| period | No | week |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It does disclose what data is covered (costs, tokens, code-line balance) and that it aggregates executed tasks rather than live state, which is genuinely useful. However, it says nothing about permissions, scope of the aggregation (all-time vs. per-user), or freshness, leaving gaps for an unannotated tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The core purpose is front-loaded in one sentence and the parameter note is short and scoped. The 'Args:' block is slightly boilerplate but carries no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-optional-parameter analytics read tool with an output schema present, the description covers the purpose, the metric set, and the parameter's allowed values and meaning. Return-value details are correctly left to the output schema; only aggregation scope and permissions are unaddressed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the parameter has no enum, so the description must compensate. It does: 'period' is defined as 'week' (last 7 days) or 'month' (last 30 days), supplying both allowed values and their exact semantics, plus the default implied by the schema. This materially exceeds what the schema conveys.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Returns an analytics summary of executed BoteX tasks') and enumerates the metrics returned (USD costs, token usage, code-line balance), which lets an agent distinguish it from get_task_status or check_health. It stops short of explicitly naming or contrasting with those siblings, so it is clear but not fully differentiated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance: no statement of when an agent should call get_stats rather than get_task_status or check_health, no prerequisites, and no exclusions. Usage can only be inferred from the fact that it summarizes completed tasks.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_task_statusA
Return status and result for a task started with start_task.
`status` is the task lifecycle (QUEUED | RUNNING | DONE | FAILED |
CANCELLED) — DONE here means "finished", not "succeeded"; check
`result_data.status` / `result_data.ok` for the engine outcome.
`result` is the pretty-text report; `result_data` is the structured
engine result (status, failure_kind, ok, files_touched, exec_ran,
rollback_verified, attempts[], cost_usd, ...).
| Name | Required | Description | Default |
|---|---|---|---|
| task_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it delivers real behavioral insight: it warns that lifecycle DONE means 'finished' not 'succeeded' and points to result_data.status/result_data.ok for the true outcome, plus enumerates the structured fields returned. It omits operational traits like auth requirements, rate limits, or whether calling on a still-running task is cheap, keeping it short of a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded one-line purpose followed by tightly scoped clarifying notes, each of which resolves a genuine ambiguity (lifecycle vs. engine status, pretty-text vs. structured result). No filler sentences.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so the description is not obligated to explain return values, yet its clarification of status vs. result_data.status prevents a real misread of the response. It is complete for invocation; only polling/lifecycle operational guidance is absent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
One parameter at 0% schema coverage, so the description must compensate; it implies task_id is the identifier from start_task but never states the expected format or provenance explicitly. That gives the agent enough to map the argument, but not full semantic detail, so a 3 is fair.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Return status and result for a task') and immediately anchors it to the sibling tool that produces the input ('started with start_task'), which cleanly separates it from start_task and the other siblings. An agent can tell exactly what this retrieves without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The prerequisite is explicit: this is for a task 'started with start_task', which gives the agent the correct entry condition. It stops short of stating when-not to use it (e.g., polling cadence, terminal-state behavior, or what to do instead of repeated calls), so it is clear context without full routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_memoryA
Reads the full content and metadata of a specific memory entry by ID from the workspace Memory Vault.
Args:
memory_id: The ID of the memory entry to retrieve (e.g. 'mem_a1b2c3d4').
workspace_dir: Workspace root directory. Empty = engine.default_workspace
from the config, else the server's current directory.
| Name | Required | Description | Default |
|---|---|---|---|
| memory_id | Yes | ||
| workspace_dir | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It conveys that this is a non-mutating retrieval of content plus metadata, but says nothing about failure behavior (e.g. unknown memory_id), permissions, or cross-workspace access. The output schema covers the return shape, so that omission is acceptable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded one-sentence purpose followed by per-argument documentation. Slightly verbose in the workspace_dir fallback chain, but every detail there is operationally useful rather than filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Two parameters, both documented, one required; an output schema exists so return values need not be explained. The main remaining gap is the absence of any guidance on error/nonexistent-ID behavior, which for a no-annotation read tool would be the last thing worth adding.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate - and it does. It documents both parameters, including an ID format example ('mem_a1b2c3d4') and the non-obvious fallback semantics of an empty workspace_dir (engine default from config, else server's current directory). That is meaningfully more than the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: reads the 'full content and metadata' of a memory entry, scoped 'by ID'. This implicitly distinguishes it from the sibling search_memory (query-based) and save_memory (write), though it never names those alternatives explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the 'by ID' framing - an agent infers this is the tool to call once it already holds a memory_id. However, there is no explicit statement of when to use this versus search_memory, and no prerequisites or conditions given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
recommend_modelsA
[EN] Fetches the most cost-effective and capable models from OpenRouter based on live benchmarks.
USE THIS TOOL BEFORE calling `run_subagent` if you are unsure which model ID to use or want to optimize for cost/quality.
include_free=True also admits ':free' variants (non-ZDR — prompts may be
logged/trained on); they require allow_non_zdr or the openrouter-free
provider to actually run.
[PL] Pobiera rekomendacje modeli z OpenRouter na podstawie benchmarków.
Użyj tego narzędzia ZANIM wywołasz `run_subagent`, jeśli nie znasz dokładnego ID modelu.
include_free=True dopuszcza warianty ':free' (non-ZDR — prompty mogą być
logowane/trenowane); do uruchomienia wymagają allow_non_zdr albo
providera openrouter-free.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| task_type | No | coding | |
| include_free | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and delivers a meaningful disclosure: include_free=True admits non-ZDR ':free' variants whose prompts may be logged/trained on, and these require allow_non_zdr or the openrouter-free provider. That is real side-effect/privacy context beyond a simple getter.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Content is front-loaded and each sentence earns its place within a language, but the full EN and PL duplication roughly doubles the payload for what is a short instruction set.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return values need not be described, and the critical behavioral caveat (non-ZDR free variants) is covered. The gaps are the undocumented limit and task_type semantics rather than missing high-risk information.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It explains include_free thoroughly (ZDR implications and the allow_non_zdr requirement) but leaves limit and task_type entirely undocumented, so only one of three parameters gains meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource (fetches model recommendations from OpenRouter) and the basis (live benchmarks, cost/quality). It clearly distinguishes itself from the sibling run_subagent by being the model-selection step that precedes it.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly tells the agent to call this BEFORE run_subagent when the model ID is unknown or cost/quality optimization is wanted. Strong when-to-use guidance, though it does not state when to skip it (e.g., when the model ID is already known).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
run_subagentA
Runs BoteX — an autonomous code execution engine (agent-agnostic harness).
BoteX performs multi-step tasks on local files inside workspace_dir.
TIP: If the user didn't specify a model, DO NOT guess. Use the `recommend_models` tool first to find the best model for this task!
Key engine features:
- Outline-First and Context Pruning: ~90% token savings.
- Pre-write Syntax Check: in-memory code validation before touching disk.
- Multi-tier Fuzzy Patching: tolerant of CRLF/LF and indentation drift.
- Hard Zero-Retention on OpenRouter (provider: data_collection=deny)
and DLP secret censoring.
- Automatic Snapshot Rollback on loops or critical failures.
Args:
task: Precise description of the coding or refactoring task.
files: Optional list of primary files affected by the task.
workspace_dir: Project directory path. Empty = engine.default_workspace
from the config, else the server's current directory.
model: Any model from the provider's catalog. Empty = model from config
(see 'profile' and botex.config.json).
profile: Model profile from botex.config.json (e.g. 'default', 'coding',
'auto-beta', 'fast'). When both 'model' and 'profile' are empty,
the capability mode picks the tier via engine.mode_profiles
(readonly -> 'fast', destructive/full -> 'coding'). Ignored when
'model' is given explicitly.
provider: API provider from the 'providers' section of botex.config.json
('openrouter', 'nvidia'). Empty = provider marked
'default: true' in the configuration.
mode: Capability preset: 'readonly' (read only — the contract is an
analysis report, DONE requires non-empty findings), 'edit'
(read + edit — default), 'destructive' (+delete/move),
'full' (+run_command). Empty = engine.default_mode from
config. Explicit allow_* flags may only WIDEN a preset —
they never narrow it (readonly can never gain file writes).
In headless mode this is pre-authorization — grant it
consciously.
max_turns: Maximum tool-loop steps (0 = config value).
max_tokens: Per-turn completion cap (0 = config value; reasoning
models need ~8000+ since thinking shares this budget).
max_duration_s: Total wall-clock limit in seconds (0 = config value,
0 disables only when config is also 0). Checked between turns.
budget_limit_usd: Daily spend limit in USD (negative = config value,
0 = no limit).
allow_destructive: Authorize destructive operations (delete_file/
move_file) for this task. Headless mode cannot confirm
mid-run — grant ONLY with the user's consent.
allow_exec: Authorize run_command for this task (also requires
exec.enabled=true in config). WARNING: this is NOT a sandbox —
commands run with operator privileges. Grant only for trusted
workspaces with the user's consent.
api_key: Optional provider API key passed per-request (highest
priority — overrides env/.env/config). Empty = resolved
internally by the harness.
output_path: Optional required output file (workspace-relative).
Sets the file_output contract: DONE is accepted only when
the file exists on disk, is non-empty, and passes the
syntax gate; a DONE response carrying the payload as text
is salvaged to disk. Requires a mutating mode.
allow_net: Explicitly authorizes the read-only public web tool for
this run. It is never enabled by a capability mode.
net_allowed_hosts: Optional per-run host authorization. In
net.policy='caller' these replace config defaults; in 'public'
they narrow public access; in 'allowlist' they must stay inside
net.allowed_hosts.
net_allowed_urls: Optional per-run URL authorization rules. A URL
ending in '/' authorizes that subtree; otherwise it authorizes
the exact URL including its query string.
verify_command: Optional allowlisted command that must pass before
DONE is accepted — it runs against the workspace as it
stands, including when the task made no writes (a passing
verifier validates a legitimate no-change result). Requires
exec.enabled=true in config and exec authorization.
recipe: Optional operational persona / workflow prompt (e.g. 'planner',
'code-explorer', 'reviewer', 'security-reviewer', 'build-resolver', 'tdd').
allow_non_zdr: Per-run consent to relax the Zero Data Retention
gate. Required for free (:free) models whose endpoints may
log or train on prompts — it also switches the wire
provider.data_collection flag to 'allow'. Grant only with
the operator's consent; the result carries
zdr_enforced=false. The openrouter-free provider preset is
the persistent config-level alternative.
Returns:
A pretty-text report in the text content (unchanged format for legacy
clients) plus the full engine result as structuredContent (status,
failure_kind, ok, files_touched, exec_ran, rollback_verified,
attempts[], cost_usd, ...). `ok` is true only when status == DONE —
i.e. the task contract was verified, not merely claimed by the model.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | ||
| task | Yes | ||
| files | No | ||
| model | No | ||
| recipe | No | ||
| api_key | No | ||
| profile | No | ||
| provider | No | ||
| allow_net | No | ||
| max_turns | No | ||
| allow_exec | No | ||
| max_tokens | No | ||
| output_path | No | ||
| allow_non_zdr | No | ||
| workspace_dir | No | ||
| max_duration_s | No | ||
| verify_command | No | ||
| budget_limit_usd | No | ||
| net_allowed_urls | No | ||
| allow_destructive | No | ||
| net_allowed_hosts | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | No | |
| steps | No | |
| status | No | |
| message | No | |
| summary | No | |
| task_id | No | |
| attempts | No | |
| cost_usd | No | |
| exec_ran | No | |
| duration_s | No | |
| lines_added | No | |
| failure_kind | No | |
| zdr_enforced | No | |
| fallback_from | No | |
| files_touched | No | |
| lines_removed | No | |
| rollback_verified | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the entire behavioral burden and does so richly: snapshot rollback on failure, pre-write syntax validation, ZDR/DLP guarantees, headless pre-authorization semantics, and the explicit warning that `allow_exec` is NOT a sandbox and runs with operator privileges. It also documents precedence (api_key > env > config) and reversibility, exactly the traits annotations would otherwise supply.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose is front-loaded, then a TIP, feature list, Args, and Returns — a logical order for a 21-parameter tool. The 'Key engine features' bullets lean slightly promotional (token-savings percentages) but still convey capability context, so the size is defensible though not maximally tight.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool this complex — 21 params, no annotations, no sibling differentiation elsewhere — the description covers invocation rationale, every argument, capability modes, safety gates, and the return contract (status/ok/failure_kind), so an agent has everything needed to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 21 parameters, so the description must fully compensate — and it documents every one with meaning, defaults, and interaction rules (e.g. model overrides profile, empty flags fall back to config, allow_* can only widen a preset). This is exemplary compensation for an undocumented schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: 'Runs BoteX — an autonomous code execution engine' that 'performs multi-step tasks on local files inside workspace_dir.' That is far more than a tautology. What keeps it from a 5 is the absence of explicit differentiation from the sibling 'start_task', which an agent might reasonably confuse with a multi-step code-execution tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides real conditional guidance: routes the agent to `recommend_models` rather than guessing a model, states that destructive ops require the user's consent, and that `allow_exec` is only for trusted workspaces. It does not, however, tell the agent when to prefer this tool over alternating siblings such as start_task, so it falls short of full when/when-not routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
save_memoryA
Saves a persistent context note, architectural decision, task handoff, or lesson
into the workspace Memory Vault (<workspace_dir>/.botex/memory/).
Masks secrets and provides directory isolation.
Args:
title: Short descriptive title of the memory entry.
content: Detailed markdown notes, architectural rationale, or handoff context.
workspace_dir: Workspace root directory. Empty = engine.default_workspace
from the config, else the server's current directory.
kind: Entry category ('context' | 'decision' | 'handoff' | 'lesson').
tags: Optional list of keyword tags for filtering and discovery.
memory_id: Optional custom identifier (alphanumeric/hyphen/underscore). Auto-generated if omitted.
| Name | Required | Description | Default |
|---|---|---|---|
| kind | No | context | |
| tags | No | ||
| title | Yes | ||
| content | Yes | ||
| memory_id | No | ||
| workspace_dir | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose non-obvious behaviors: automatic secret masking, directory isolation, and memory_id auto-generation when omitted. It does not say what happens on an ID/title collision (overwrite vs. error), nor anything about permissions or retention, which are important for a persistent write.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The lead sentence front-loads purpose and destination, followed by a tight Args list where each entry is one sentence. No filler, though the multi-line block format is slightly verbose relative to the information conveyed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return values need not be explained, and all input parameters are covered along with useful side-effect notes (secret masking, isolation). The remaining gap is usage routing against the read/search siblings and collision behavior, which keeps it short of complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, yet the description documents all six parameters with meaning beyond the bare types: it explains the kind categories, that tags are for filtering/discovery, that memory_id must be alphanumeric/hyphen/underscore and is auto-generated if omitted, and the fallback rules for workspace_dir. Strong compensation, though the markdown format of content could be stated more precisely.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a concrete verb and resource ('Saves a persistent context note... into the workspace Memory Vault') and names the exact storage path plus the four entry categories. It clearly occupies the write slot opposite the read_memory/search_memory siblings, though it never names those alternatives explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The kind values ('context' | 'decision' | 'handoff' | 'lesson') implicitly signal when each entry type applies, which gives partial usage guidance. However, there is no explicit statement of when to use save_memory versus search_memory/read_memory, no when-not conditions, and no prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_memoryA
Searches the workspace Memory Vault (<workspace_dir>/.botex/memory/)
by keyword query, tag, or entry kind (context, decision, handoff, lesson).
Args:
workspace_dir: Workspace root directory. Empty = engine.default_workspace
from the config, else the server's current directory.
query: Free-text search string matched against title, content, and tags.
tag: Filter by specific tag.
kind: Filter by entry kind ('context', 'decision', 'handoff', 'lesson').
| Name | Required | Description | Default |
|---|---|---|---|
| tag | No | ||
| kind | No | ||
| query | No | ||
| workspace_dir | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It usefully discloses the storage path and the fallback chain for an empty workspace_dir (config default workspace, else server CWD), but says nothing about how filters combine, result ordering/limits, or that the call is a non-mutating read.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the one-line purpose before the Args block, and each parameter line earns its place. The docstring-style 'Args:' formatting is functional rather than elegant, but nothing is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and all four parameters are covered. Still missing are the filter-combination semantics (AND vs OR) and any guidance on relating this tool to read_memory/save_memory, which leaves real gaps for a discovery tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description does the full job: it explains all four parameters, gives the empty-string default semantics for workspace_dir, and enumerates the valid kind values (context, decision, handoff, lesson) that the schema fails to express as an enum.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Searches the workspace Memory Vault') and names the three filter dimensions (query, tag, kind). It is clearly distinguishable in intent from save_memory and read_memory, though it never names those siblings explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by describing the filter modes, but there is no explicit when-to-use/when-not guidance and no routing against the obvious alternatives read_memory and save_memory. An agent must infer that this is the discovery tool and the other two are point read/write.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
start_taskA
Start a detached BoteX task and return its task_id immediately.
Runs the same engine as `run_subagent`, but returns instantly with a
`task_id` for polling via `get_task_status`. Concurrency is bounded by
engine.max_concurrent_tasks and the queue by engine.max_queued_tasks —
a full queue returns status TOO_MANY_QUEUED.
The capability/limits arguments are identical to `run_subagent` —
same contracts, same pre-authorization semantics:
- mode: capability preset — 'readonly' (read tools only; the contract
is an analysis report), 'edit' (read + write; default), 'destructive'
(+ delete/move), 'full' (+ run_command). Empty = engine.default_mode.
- allow_destructive / allow_exec / allow_net only ever WIDEN the
preset, never narrow it — a readonly task cannot gain file writes.
allow_exec additionally requires exec.enabled=true in the config.
None of these is a sandbox: grant them only with the user's consent.
- output_path makes the contract file_output: DONE requires the file
to exist, be non-empty, and pass the syntax gate (mutating mode).
- verify_command is an allowlisted command that must pass before DONE
is accepted — it runs even when the task made no writes. Requires
exec authorization.
- recipe: Optional operational persona / workflow prompt (e.g. 'planner',
'code-explorer', 'reviewer', 'security-reviewer', 'build-resolver', 'tdd').
- max_turns / max_tokens / max_duration_s / budget_limit_usd:
0 (negative for budget) = config value; a non-positive max_turns is
clamped to 1.
- net_allowed_hosts / net_allowed_urls narrow or replace the net
scope per run according to net.policy (see run_subagent).
- allow_non_zdr: per-run consent to relax Zero Data Retention — needed
for free (:free) models whose endpoints may log or train on prompts.
Same semantics as in run_subagent.
Returns:
{"task_id": str, "status": "QUEUED"} — poll with get_task_status.
The finished task's `result_data` carries the full engine result
(status, failure_kind, ok, files_touched, exec_ran,
rollback_verified, attempts[], cost_usd, ...).
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | ||
| task | Yes | ||
| files | No | ||
| model | No | ||
| recipe | No | ||
| api_key | No | ||
| profile | No | ||
| provider | No | ||
| allow_net | No | ||
| max_turns | No | ||
| allow_exec | No | ||
| max_tokens | No | ||
| output_path | No | ||
| allow_non_zdr | No | ||
| workspace_dir | No | ||
| max_duration_s | No | ||
| verify_command | No | ||
| budget_limit_usd | No | ||
| net_allowed_urls | No | ||
| allow_destructive | No | ||
| net_allowed_hosts | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and delivers: concurrency bounds (engine.max_concurrent_tasks), queue bound with the TOO_MANY_QUEUED failure status, the widening-only authorization semantics of allow_destructive/allow_exec/allow_net, the exec.enabled prerequisite, the DONE contract for output_path, and ZDR implications of allow_non_zdr. This is unusually rich disclosure of side effects and constraints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the one-line summary and the async/poll relationship, then groups the capability arguments. Given 21 parameters, the length is largely earned, though a few bullets defer to 'see run_subagent' and the return-value section is somewhat redundant with the existing output schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex 21-parameter mutation-capable tool with no annotations, the description covers startup behavior, queue semantics, authorization model, contract enforcement, and polling handoff. An agent has everything needed to invoke it correctly, and the output schema carries the detailed return shape.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 21 parameters, so the description must compensate, and it explains the semantically tricky ones in depth (mode presets, widening-only flags, output_path contract, verify_command, recipe personas, budget/turn defaults, net scope narrowing). It leaves several parameters unexplained (files, model, api_key, profile, provider, workspace_dir), so coverage is strong but not complete.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Start a detached BoteX task') plus the immediately observable outcome ('return its task_id immediately'). It explicitly contrasts itself with the sibling run_subagent by being the fire-and-poll variant, so an agent can distinguish them without opening schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Names the alternative (run_subagent), explains the defining difference (returns instantly vs. blocking), and points to the follow-up tool (get_task_status) for polling. It stops short of stating explicit selection conditions such as 'use this when the task is long-running or may exceed a request timeout,' so it is clear but not fully prescriptive.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
6 tool updates
v1.1.1- Changed
get_outline1 field changed- changed
Input schema / properties / workspace_dir / defaultPrevious value: -"."New value: +""
- Changed
read_memory1 field changed- changed
Input schema / properties / workspace_dir / defaultPrevious value: -"."New value: +""
- Changed
run_subagent1 field changed- changed
Input schema / properties / workspace_dir / defaultPrevious value: -"."New value: +""
- Changed
save_memory1 field changed- changed
Input schema / properties / workspace_dir / defaultPrevious value: -"."New value: +""
- Changed
search_memory1 field changed- changed
Input schema / properties / workspace_dir / defaultPrevious value: -"."New value: +""
- Changed
start_task1 field changed- changed
Input schema / properties / workspace_dir / defaultPrevious value: -"."New value: +""
3 tool updates
v1.0.1- Changed
recommend_models1 field changed- added
Input schema / properties / include_freeAdded value: +{ + "default": false, + "title": "Include Free", + "type": "boolean" +}
- Changed
run_subagent3 fields changed- added
Input schema / properties / allow_non_zdrAdded value: +{ + "default": false, + "title": "Allow Non Zdr", + "type": "boolean" +} - added
Output schema / $defs / SubagentAttemptResult / properties / zdr_enforcedAdded value: +{ + "title": "Zdr Enforced", + "type": "boolean" +} - added
Output schema / properties / zdr_enforcedAdded value: +{ + "title": "Zdr Enforced", + "type": "boolean" +}
- Changed
start_task1 field changed- added
Input schema / properties / allow_non_zdrAdded value: +{ + "default": false, + "title": "Allow Non Zdr", + "type": "boolean" +}
12 tool updates
v1.0.0- First observed
check_health - First observed
clean_snapshots - First observed
fetch_url - First observed
get_outline - First observed
get_stats - First observed
get_task_status - First observed
read_memory - First observed
recommend_models - First observed
run_subagent - First observed
save_memory - First observed
search_memory - First observed
start_task
TDQS
Scored across 12 tools
Most tools target clearly distinct resources or actions, but start_task and run_subagent both execute BoteX tasks with nearly identical arguments, so agents may hesitate over sync vs detached execution. The descriptions explicitly explain the async contract and task_id polling, so the overlap is recoverable rather than fatal.
All tools use snake_case with a predictable verb_noun or verb pattern (start_task, get_stats, check_health, save_memory). There are no mixed conventions or vague names, making the set easy to scan and remember.
At 12 tools, the server is well scoped for its apparent domain: task execution, task status/stats, diagnostics, model recommendation, URL fetch, outline extraction, and memory vault operations. Each tool appears to earn its place rather than padding the surface.
Core task execution is covered with run_subagent/start_task and get_task_status, but there is no cancel_task or list_tasks, which can strand detached tasks. The memory vault supports save/search/read but lacks delete/update/list-all, creating notable lifecycle gaps even if some workarounds exist.
Maintenance
Related MCP Connectors
A paid remote MCP for OpenAI Codex agent coordination MCP, built to return verdicts, receipts, usage
Control plane for autonomous software labor. Agents claim objectives over MCP with audit trail.
Hosted MCP server and Agent Skills for specs, engineering threads, and project memory.
Build and publish full-stack apps from your coding agent: models, rules, pages, auth, per-app MCP.
Related MCP Servers
- AlicenseNot gradedqualityAmaintenanceEnables MCP-capable coding assistants to delegate repository investigation, bounded implementation work, and noisy command runs (tests, builds, linters) to sandboxed OpenCode agents. Each role can use an independently selected model, and only concise results are returned to the parent agent, which keeps responsibility for architecture and high-risk operations.MIT
- AlicenseNot gradedqualityBmaintenanceEnables MCP clients like Codex and DSH to invoke DeepSeek subagents for inspect, plan, review, and implement tasks, with write protection, rollback, and status reporting.6 npmMIT
- AlicenseNot gradedqualityBmaintenanceEnables MCP clients to route coding tasks across local and cloud models with explicit budgets, repository planning and execution, and independent validation/repair checks.Apache 2.0
- AlicenseNot gradedqualityBmaintenanceEnables delegating tasks to agents you configure yourself through OpenAI-compatible Chat Completions backends, with automatic or explicit routing, synchronous calls, persistent asynchronous jobs, and multi-step reviewed workflows. It returns proposals and analyses only, leaving file changes, command execution, and approvals under the MCP client's control.333 npmMIT