Open Jev Bridge
This server provides 14 MCP tools for probabilistic, evidence-based judgment and context management, plus automatic host lifecycle hooks for Claude Code and Codex.
Verify completion claims (
system_one_verify): check claims against supplied evidence and get advisory probability verdicts.Screen external content (
system_one_screen): detect prompt injection, relevance, and substance in fetched text without executing it.Find and rank candidates (
system_one_find,system_one_rerank): select or reorder supplied candidates by relevance to a query, no embeddings required.Classify items (
system_one_classify): assign items to classes from a shared catalog, flagging ambiguous results for review.Decide among options (
system_one_decide): compare 2–6 candidates against requirements and priorities with escape hatches.Compare passages (
system_one_compare): compare two passages overall and by custom aspects.Extract verbatim substrings (
system_one_extract): run bounded regex candidates in a worker and select exact source text, never generating values.Review diffs (
system_one_review): score a proposed diff for correctness, spec match, test gaps, blast radius, and safety without executing tests.Gate patches/completions (
system_one_gate): combine diff review and claim verification in one bounded request.Raw System One query (
system_one_query): send validated arbitrary state/questions to the configured backend.Compact transcripts (
system_one_compact): perform verbatim tool-pair compaction of canonical messages, preserving prose/order and protected messages.Belay/Stop-hook judgment (
system_one_belay): detect unsupported completion claims in a transcript and return an advisory Stop decision.Status check (
system_one_status): probe the configured/v1/modelsendpoint and report bridge capabilities without exposing credentials.Automatic host integration: installs MCP, hooks, and skills for Claude Code and Codex; automates completion verification, task review, external-result screening, and compaction checkpoints.
Backend flexibility: works with hosted Jev, local Kev, Laya, Mapika Decider 35B, Shisa DE-1 (vLLM/llama.cpp), or any compatible System One HTTP service.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Open Jev BridgeCompact my context and run a completion check on the last task."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Open Jev Bridge — local MCP, Claude Code and Codex hooks
A provider-neutral Node.js MCP server and plugin repository combining verbatim compaction, evidence-sensitive completion checks, and ten purpose-built judgment tools. Connect it to hosted Jev, local Kev, local Laya and Mapika Decider 35B through included HTTP adapters, local Shisa DE-1 through vLLM or llama.cpp (GGUF), or another compatible System One service. The Node runtime has zero npm dependencies. All bridge environment variables use SYSTEM_ONE_, and all canonical MCP tools use system_one_.
The common tool interface uses typed noul, choice and score questions. Native System One providers receive POST /v1/systemone with {model, state, questions}. The shisa profile selects either vLLM or llama.cpp endpoints with SYSTEM_ONE_SHISA_BACKEND, validates the model-specific prompt and reads option logprobs—not generated answer text. No response_format: "system_one" field is invented. URL, model, optional bearer key, profile and explicit remote permission are configurable; a profile never downloads or starts a model. Default connection remains http://127.0.0.1:8009, model kev-latest, for an existing local Kev setup. There is no automatic cloud fallback or telemetry.
Inspired by fast-jev-compaction, jev-belay, and jev-mcp. This is an independent implementation covering their principal functions, not a vendored fork or a claim of identical interfaces for every upstream version. Source findings and identifiers are in UPSTREAM_REVIEW.md.
Important host distinction: both hosts receive local MCP tools and completion Stop checks. Stable command hooks create compaction checkpoints; they cannot directly replace live history. An additional opt-in Claude function-hook plugin implements true history replacement on a supporting runtime. Codex's documented PreCompact output does not provide that replacement operation. No rollout/transcript file is edited to fake it.
System One API compatibility
Open Jev Bridge is backend-agnostic. Any service implementing the System One HTTP contract can be used by configuring the endpoint parameters; Jev, Kev, and Laya are examples, not hard-coded dependencies. The bridge sends POST /v1/systemone with model, state, and typed questions, and expects typed answers for noul, choice, and score. Configure SYSTEM_ONE_URL, SYSTEM_ONE_MODEL, the optional SYSTEM_ONE_API_KEY, SYSTEM_ONE_ALLOW_REMOTE, and normally SYSTEM_ONE_PROVIDER=generic for an otherwise compatible implementation. Native-provider profiles add known contract checks. The shisa profile additionally supplies a model-specific transport adapter; a generic OpenAI chat server is not automatically a System One backend.
The backend may be local, on another machine, or hosted behind an authenticated HTTPS endpoint. A compatible API still needs to respect the requested question semantics and return valid probability distributions; doctor checks the transport/shape but does not certify model quality.
Related MCP server: Jupiter Controller MCP
Shisa GGUF on llama.cpp (template fix in 0.4.2)
The v0.4.0 Shisa adapter expected vLLM. For a locally running llama-server,
select its native protocol explicitly; changing the URL alone is insufficient.
The tokens: [] / shisa: missing tokenizer tokens failure is covered by a
regression test.
0.4.2 fixes served GGUF chat template differs from the documented Shisa scaffold.
The native adapter now renders Shisa's published scaffold itself and sends its
validated token IDs to /completion. It does not call /apply-template, adopt
an alternate GGUF chat format, or require changing --jinja. Keep the existing
server running; update the bridge and restart its host/MCP processes. No new
configuration variable or validation-bypass flag is needed.
export SYSTEM_ONE_PROVIDER=shisa
export SYSTEM_ONE_SHISA_BACKEND=llamacpp
export SYSTEM_ONE_URL=http://127.0.0.1:8012
export SYSTEM_ONE_MODEL=shisa-de-1
export SYSTEM_ONE_SHISA_MAX_PROMPT_TOKENS=8192
node bin/open-jev-bridge.mjs doctor
# Direct installations only; use the same checkout path as before:
node bin/open-jev-bridge.mjs install --host bothInstallation is replace-on-install for Open Jev Bridge-owned skill names (system-one-judgments, system-one-compaction, and system-one-belay). Stale, orphaned, or edited copies at those exact skill paths are overwritten by default so reinstalling is self-healing. Other skills, hooks, and unrelated host settings are left untouched. Existing skill directories are snapshotted during installation and restored if the install rolls back.
Keep your current GGUF server/GPU configuration; no additional model server is
needed. Restart client/MCP processes after updating. Native Claude function-plugin
users should refresh that plugin instead of enabling duplicate direct hooks, and
export the same settings in the launching shell. The ready-to-use function bundle
includes the new adapter. Existing vLLM setups keep SYSTEM_ONE_SHISA_BACKEND=vllm
(the default).
The native path uses /props, /tokenize with content, and /completion
with numeric prompt IDs and native probability output. Before inference it
checks that the five Shisa/Gemma control markers each have distinct single-token
encodings, occur in the expected order in the prompt, and delimit the exact answer
boundary. It also validates option-token prefix stability and the per-slot
context limit. It never reads sampled answer text. Missing-letter recovery is
implemented without pretending llama.cpp supports vLLM's prompt-logprob API.
doctor reports prompt_source: "documented-shisa-scaffold" and
control_tokens_validated: true after a successful native probe.
See LLAMACPP.md for wire formats, the recovery derivation, upgrade steps, serving example, targeted tests and live-validation boundaries.
Automatic operation in Claude Code and Codex
Lifecycle automation remains enabled by default in 0.4.2. After installation and native hook trust, routine completion checks, patch/completion review, matched external-content screening and compaction checkpoints run without the user requesting MCP calls. The agent also receives proactive tool-use instructions at session start, each prompt and after compaction.
Workflow | Automatic trigger | What happens |
Verify completed work |
| Examine observed edits, check start times and actual results; request meaningful follow-up on unsupported completion. |
Review the task after passing checks |
| Run the combined System One patch/completion gate automatically; final prose is a claim, not its own evidence. |
Verify delegated work |
| Check the child's evidence, not the parent's transcript. |
Verify task status changes | Claude | Block an unsupported transition using the documented exit-2 interface. |
Screen external results | Matched | Automatically screen complete bounded WebFetch/MCP fetch/search/read_resource results; report advisory warnings. |
Compact/recover context | Native auto/manual | Create a retained checkpoint and restore a historical excerpt automatically. Stable hooks do not replace live history. |
Replace live history at a usage threshold | Optional Claude function plugin | Automatically invoke |
The other judgment tools are selected by the agent when relevant; they are not all blindly called on every turn. Codex hosted web tools do not emit the same local tool hooks, so external screening is not universal. The main model must still treat unscreened material as untrusted. No plugin can guarantee every semantic tool-selection decision.
node bin/open-jev-bridge.mjs install --host both
node bin/open-jev-bridge.mjs doctor
node bin/open-jev-bridge.mjs automation-status --host both
# Restart the clients, then review/trust new and changed definitions in /hooks.automation-status inspects direct-install definitions and recent metadata-only hook observations; it does not claim native trust or a successful provider probe. The separate doctor checks the provider. No hook runs arbitrary project commands: a continuation asks the main agent to run meaningful checks through its normal approved tools. Native auto-compaction must remain enabled for the stable checkpoint hooks to fire automatically.
See AUTOMATION.md for the complete event matrix, safety boundaries, controls, upgrade behavior and automatic integration tests.
What it does
Component | Behavior |
Verbatim compaction | Scores retaining old tool calls/results, keeps required pairs, shortens or removes unneeded tool output, preserves prose/order and protected messages, validates every answer before returning a new history |
Completion Stop check | Detects observed edits followed by unsupported completion claims, discounts checks started before the latest edit, recognizes actual passing/failing runner output, requests real verification where warranted, and prevents repeat-block loops |
Ten judgment tools |
|
Additional tools |
|
Installation | One CLI command registers MCP through each host's own CLI, merges user hooks, installs skills, preserves unrelated settings and supports owned-entry uninstall/rollback |
Safeguards | Loopback default, opt-in remote/private proxy, byte/context limits, finite deadlines, cancellation, bounded queues, circuit breaker, typed answer validation, regex worker isolation and private checkpoint state |
These are probabilistic judgments, not proofs. system_one_review does not run tests. system_one_gate does not apply patches. Screening is advisory, not an instruction sanitizer. Stop allowing completion does not certify coverage or correctness. See SECURITY.md.
Quick start
1. Select a backend
Use one of the following examples. When switching providers, remove obsolete SYSTEM_ONE_API_KEY / SYSTEM_ONE_API_KEY_FILE environment values and any old apiKeyFile entry in your chosen JSON configuration. Otherwise an explicitly configured key will also be sent to your newly selected endpoint. Restart MCP/host processes after configuration changes.
Jev — hosted TypeSafe API with bearer authentication
TypeSafe documents the endpoint, authentication and jev-latest alias in its API reference and model reference. This example uses hosted Jev, not self-hosted Jev weights.
export SYSTEM_ONE_URL="https://api.typesafe.ai"
export SYSTEM_ONE_MODEL="jev-latest"
export SYSTEM_ONE_PROVIDER="jev"
export SYSTEM_ONE_ALLOW_REMOTE=1
# Bash: enter the key without displaying it or putting its value in shell history.
read -r -s -p "TypeSafe API key: " SYSTEM_ONE_API_KEY
printf '\n'
export SYSTEM_ONE_API_KEY
# An already exported key can instead be mapped explicitly:
# export SYSTEM_ONE_API_KEY="$TYPESAFE_API_KEY"
node bin/open-jev-bridge.mjs doctor
node bin/open-jev-bridge.mjs install --host both \
--url https://api.typesafe.ai --model jev-latest --provider jev --allow-remoteA key is an environment variable, not a PATH entry. The bridge does not implicitly read TYPESAFE_API_KEY. It sends Authorization: Bearer <key> when configured, including for /v1/models, and never places the key in a URL. Jev model-list entries use name; the bridge normalizes them to id while preserving the original metadata. Selecting Jev sends the supplied evidence, task or compaction state to TypeSafe; review your confidentiality requirements before enabling a hosted endpoint.
Some hosts filter subprocess environment variables. For a persistent direct installation, an alternative is a private key file: the installer stores its path, not its contents, and the Node runtime reads it when required.
install -d -m 700 "$HOME/.config/open-jev-bridge"
KEY_FILE="$HOME/.config/open-jev-bridge/api.key"
# This intentionally replaces this named key file with a private empty file first.
install -m 600 /dev/null "$KEY_FILE"
printf '%s' "$SYSTEM_ONE_API_KEY" > "$KEY_FILE"
node bin/open-jev-bridge.mjs install --host both \
--url https://api.typesafe.ai --model jev-latest --provider jev --allow-remote \
--api-key-file "$KEY_FILE"The key file must be absolute, regular, non-symlinked, at most 16 KiB, and owner-only on POSIX. A nonempty SYSTEM_ONE_API_KEY takes precedence over the file. Do not commit keys. The isolated Claude function-hook variant cannot read this file; use the environment method for that variant.
For environment-based Codex MCP credentials, its official MCP configuration documents env_vars. Add this line inside the existing [mcp_servers.open-jev-bridge] table when forwarding is needed; do not create a second copy of the table or store the key value in TOML:
env_vars = ["SYSTEM_ONE_URL", "SYSTEM_ONE_MODEL", "SYSTEM_ONE_PROVIDER", "SYSTEM_ONE_API_KEY", "SYSTEM_ONE_ALLOW_REMOTE"]Kev — existing local System One server
Follow the Kev serving instructions. Its Python/model environment is separate from this Node bridge:
# In a separate checkout/environment:
git clone https://github.com/jaredpalmer/kev.git
cd kev
uv sync --extra serve
uv run --extra serve python -m kev.serve --run jaredpalmer/kev-4b --port 8009In a second shell, from this bridge repository:
unset SYSTEM_ONE_API_KEY SYSTEM_ONE_API_KEY_FILE
export SYSTEM_ONE_URL="http://127.0.0.1:8009"
export SYSTEM_ONE_MODEL="kev-latest"
export SYSTEM_ONE_PROVIDER="kev"
export SYSTEM_ONE_ALLOW_REMOTE=0
node bin/open-jev-bridge.mjs doctor
node bin/open-jev-bridge.mjs install --host both \
--url http://127.0.0.1:8009 --model kev-latest --provider kevUpstream Kev binds to loopback without an API key. For an authenticated private reverse proxy, set SYSTEM_ONE_API_KEY and deliberately allow the non-loopback URL. Current inspected Kev emits four-decimal probabilities; this bridge also retains compatibility with older two-decimal responses. No Kev weights or serving dependencies are included.
Laya — local Python runtime with the included HTTP sidecar
The Laya model card and Python runtime expose laya.load(...).system_one(state, questions) / .predict(...). A Hugging Face model page is not an inference URL. This repository includes adapters/laya_server.py to expose the required HTTP contract.
# From this repository, in a dedicated Python 3.10+ environment:
python3 -m venv .venv
. .venv/bin/activate
python -m pip install laya
# Loads the actual checkpoint once; no fixture or fake backend is selected.
USE_TF=0 python -m adapters.laya_server \
--checkpoint convaiinnovations/laya --model laya --port 8010
# Alternative fixed checkpoints (choose one, not all on the same port):
# USE_TF=0 python -m adapters.laya_server --model laya --port 8010 --subfolder multilingual
# USE_TF=0 python -m adapters.laya_server --model laya --port 8010 --subfolder typed-decisionsIn a second shell, from the bridge root:
unset SYSTEM_ONE_API_KEY SYSTEM_ONE_API_KEY_FILE
export SYSTEM_ONE_URL="http://127.0.0.1:8010"
export SYSTEM_ONE_MODEL="laya" # Identifier defined by this adapter's --model option.
export SYSTEM_ONE_PROVIDER="laya"
export SYSTEM_ONE_ALLOW_REMOTE=0
node bin/open-jev-bridge.mjs doctor
node bin/open-jev-bridge.mjs install --host both \
--url http://127.0.0.1:8010 --model laya --provider layaTo authenticate the sidecar, export the same SYSTEM_ONE_API_KEY before starting both the sidecar and the bridge. It uses one preloaded checkpoint, rejects unknown model names, binds only to loopback, caps requests and active HTTP handlers, and returns 429 rather than queuing concurrent inference. Set maxConcurrent: 1 for this sidecar; an example is in examples/laya.config.json. For remote service, deploy a deliberately authenticated TLS proxy in front; the stdlib HTTP server is not a public production server.
Laya context is not interchangeable with a long-context model. The inspected checkpoint defaults are 512 tokens for the root English model and 1,024 for the other two checkpoints, with a separate question/options head budget. The upstream tokenizer can truncate inputs. This adapter instead performs a tokenizer-based check and rejects any request that would truncate state, instructions or options. Long transcripts, large class catalogs and long diffs can therefore fail explicitly. Hooks fail open or use built-in compaction; a 422 is not a successful judgment. There is no silent chunking, changed rubric, fabricated answer or automatic larger-model fallback. See PROVIDER_COMPATIBILITY.md.
Mapika Decider 35B — local eager CUDA server
The 35B checkpoint requires use_graphs=False. The included adapters/decider_server.py loads the actual Python model in eager mode, exposes /v1/systemone, and rejects state/expanded requests that exceed token budgets. Do not assume the upstream dense-model CUDA-graph server is suitable for this MoE. An existing working native /v1/systemone deployment is also accepted.
# From this repository in a dedicated Python 3.11+ CUDA environment:
python -m pip install 'git+https://github.com/Mapika/decider.git@b44b4c9880a67291206499b86aac89004850134a'
# --checkpoint also accepts a custom local directory downloaded with `hf download`.
CUDA_VISIBLE_DEVICES=0 python -m adapters.decider_server \
--checkpoint Mapika/decider-35b-a3b --model decider-35b-a3b --port 8011In a second terminal, from the bridge root:
unset SYSTEM_ONE_API_KEY SYSTEM_ONE_API_KEY_FILE
export SYSTEM_ONE_PROVIDER=decider
export SYSTEM_ONE_MODEL=decider-35b-a3b
export SYSTEM_ONE_URL=http://127.0.0.1:8011
export SYSTEM_ONE_ALLOW_REMOTE=0
node bin/open-jev-bridge.mjs doctor
node bin/open-jev-bridge.mjs install --host bothThe model card specifies roughly 65 GB of BF16 weights and an 80 GB-class GPU. The wrapper does not silently use CPU, shard across GPUs, or quantize the model. Native Choice supports 2–255 options and Score 2–10 levels. The profile handles four-decimal probabilities but two-decimal scores, and models[].name discovery. The wrapper's --model is the served alias; --checkpoint is the model location. Optional local authentication uses the same exported SYSTEM_ONE_API_KEY in both shells. examples/decider.config.json demonstrates serial client concurrency.
Shisa DE-1 — local vLLM with restricted-letter readout
The Shisa model card specifies a one-token option-probability readout, not a System One HTTP route. Start a vLLM build supporting this model and the tokenization/completion extensions described in LOCAL_MODELS.md:
# In a separate compatible vLLM/CUDA environment:
vllm serve shisa-ai/shisa-de-1 \
--served-model-name shisa-de-1 --host 127.0.0.1 --port 8012 \
--dtype bfloat16 --max-model-len 32768 --max-logprobs 30 \
--logprobs-mode raw_logprobs --generation-config vllm# From the bridge repository, in a second terminal:
unset SYSTEM_ONE_API_KEY SYSTEM_ONE_API_KEY_FILE
export SYSTEM_ONE_PROVIDER=shisa
export SYSTEM_ONE_SHISA_BACKEND=vllm
export SYSTEM_ONE_MODEL=shisa-de-1
export SYSTEM_ONE_URL=http://127.0.0.1:8012
export SYSTEM_ONE_ALLOW_REMOTE=0
node bin/open-jev-bridge.mjs doctor
node bin/open-jev-bridge.mjs install --host bothThe bridge checks the served chat template, verifies single-token letters and prefix-stable tokenization, then restricts first-token logprobs to the valid options. Missing letters are recovered by the documented forced-prompt logprob path; the sampled text is never used as an answer. Noul maps A=Yes; Choice maps back to original IDs; Score uses the bridge-defined expected zero-based level. The current readout supports at most 26 options/levels and rejects larger sets rather than silently dropping or reranking candidates incorrectly. Default readout temperature is 1; optional per-type temperatures and the exact HTTP payloads are documented below.
All fourteen tools and automatic hooks use this translation, including the already bundled Claude function-hook plugin. Stable-host compaction remains checkpoint-based; native Claude replacement still requires its supporting runtime. Model inference quality and confidence calibration are not made equivalent by an API adapter. Shisa's approximately 48.1 GiB of weights require additional runtime memory; local-path downloads and tensor-parallel considerations are in LOCAL_MODELS.md.
Other System One services
export SYSTEM_ONE_PROVIDER=generic
export SYSTEM_ONE_URL="http://127.0.0.1:8020"
export SYSTEM_ONE_MODEL="your-served-model-id"
# Set SYSTEM_ONE_API_KEY if required; remote URLs also need SYSTEM_ONE_ALLOW_REMOTE=1.
node bin/open-jev-bridge.mjs doctorgeneric, jev, kev, laya, decider and shisa are provider profiles, not backend launch commands. shisa selects the documented vLLM transport by default, or native llama.cpp with SYSTEM_ONE_SHISA_BACKEND=llamacpp. The profiles do not replace explicit URL/model settings. Nonsecret examples are in examples/{jev,kev,laya,decider,shisa}.config.json; select a file with an absolute OPEN_JEV_BRIDGE_CONFIG path or copy its settings into the normal user JSON. Exported settings override that file. No .env file is auto-loaded.
2. Check this repository
Unzip into a permanent directory. The Node runtime needs Node.js 22.16 or newer. The full offline test suite also needs Python 3.10+, but does not install Laya, Decider, vLLM, or download weights. The automatic installers target Linux/macOS or WSL. There are no npm dependencies to fetch and no compilation step is needed to run the checked-in source.
cd open-jev-bridge
node --version
npm run check
npm test
node bin/open-jev-bridge.mjs doctor # uses the selected configurationdoctor makes real /v1/models and mixed Noul/Choice/Score requests. It fails when the server or API contract is unavailable. A successful doctor probe is not a full model-quality or host-integration certification.
3. Install hooks, MCP and skills for both hosts
Have the actual claude and codex CLIs available on PATH, then run:
node bin/open-jev-bridge.mjs install --host both # or use the explicit backend command aboveTo install only one host, use --host claude or --host codex. Restart the hosts afterward. In Codex, open /hooks and review/trust the newly installed definitions. Installation intentionally does not bypass native trust or permission policy. A host without the documented hook capability must be upgraded or used with MCP alone.
The recommended direct mode installs the same runtime, skills and hook behavior as the stable plugin manifests, without depending on an undocumented Codex plugin-install CLI. It uses official claude mcp add / codex mcp add commands, not ad hoc TOML edits. Existing unowned open-jev-bridge MCP registrations or conflicting skill folders are refused rather than overwritten. A failed or inaccessible MCP lookup is not mistaken for an absent server. Reinstalling in the same checkout refreshes owned hooks and pristine skills; new definitions still require host trust. Move to a different path only after uninstalling from the old checkout.
Host | Direct hook location | Skill location |
Claude |
|
|
Codex |
|
|
Keep the repository and Node executable paths stable after installation. After moving the repository or replacing the Node installation, uninstall/reinstall so stored absolute launch paths remain correct. User settings are merged, not replaced; avoid concurrent manual edits to those files during installation.
Native plugin alternatives
The root includes .claude-plugin/plugin.json, .codex-plugin/plugin.json, the MCP definitions, hooks, skills and an optional reviewer agent. These are provided for native plugin distribution/marketplace workflows as well as the direct installer. Do not enable native and direct integrations simultaneously for one host.
Claude stable native plugin
node bin/open-jev-bridge.mjs uninstall --host claude # only when direct mode was installed
# Keep the selected backend's exported SYSTEM_ONE_* settings from Quick start.
node bin/open-jev-bridge.mjs native-claudeThe command adds this repository's local Claude marketplace and installs open-jev-bridge@open-jev-bridge-local through the real Claude CLI. It does not pretend that native installation succeeded when the CLI fails. Inspect the host's plugin/hook/MCP listings after restart. Use Claude's plugin manager to uninstall native installations; the bridge's uninstall command owns direct-mode entries only.
Claude true-compaction function variant — opt-in
The optional function variant is included ready to use in plugins/claude-functions/. It contains the pure isolated function module and the same MCP, event-tracking, task/subagent-verification and external-screening command hooks. npm run build only regenerates this checked-in bundle from the root sources. The upstream function-hook implementation references a supporting Claude runtime (upstream advertises 2.1.274+) and the feature flag below; do not assume availability on every Claude version.
# Disable/uninstall the stable native plugin or direct Claude integration first.
# Keep the selected backend's exported SYSTEM_ONE_* settings from Quick start.
# The ready-to-use plugin is already bundled; this command refreshes it from root sources before installation.
node bin/open-jev-bridge.mjs native-claude-functions
CLAUDE_CODE_ENABLE_FUNCTION_HOOKS=1 claudeYou can also inspect or distribute the ready plugin directly from plugins/claude-functions/; no separate build step is required. The function path handles session.compact and optionally triggers it from turn.complete at 60% reported context usage. By default it preserves the last six messages, keeps dependencies at probability ≥0.5, and requires at least 25% estimated character reduction before replacing history. Otherwise it calls the host's built-in compactor. Unchanged message handles are retained; edited messages are rebuilt without stale handles.
Use exported SYSTEM_ONE_URL, SYSTEM_ONE_MODEL, SYSTEM_ONE_PROVIDER, and, as needed, SYSTEM_ONE_API_KEY and SYSTEM_ONE_ALLOW_REMOTE for this variant. The isolated function runtime cannot read the Node bridge's user JSON file; the same exported environment also reaches the MCP server. Its network implementation is the host's $.http.fetch, so Node-only transport guarantees must not be assumed for that path. Native function loading, context replacement and authenticated host behavior were not executable in the build environment; run the native acceptance checklist in TESTING.md.
Codex native distribution
The .codex-plugin/plugin.json compatibility manifest identifies the bundled Codex hooks and MCP configuration; skills/ contains portable skill folders. Use the documented local marketplace/plugin workflow for the installed Codex version, or use the recommended install --host codex command for automatic direct registration. No invented codex plugin install command, forged trust record or unsupported PreCompact message replacement is used.
Using the tools and hooks
In a host conversation, requests such as these use the bundled skills and tools:
“Use the configured System One backend to verify these completion claims against the actual diff and test output. Flag unsupported claims.”
“Classify these candidates, and retain uncertain results for review rather than automatically accepting them.”
“Extract the primary reference code verbatim from this document using a bounded pattern.”
The host may namespace MCP tool names; use the tools it actually lists. The bridge never runs a test because a classifier recommends it: the host must perform the real verification and report its result.
For direct CLI use:
printf '%s\n' '{"claims":["The build passed"],"evidence":"Build finished with exit code 0."}' \
| node bin/open-jev-bridge.mjs call --name system_one_verify
printf '%s\n' '{"request":"Fix parser validation","diff":"-allow_invalid\n+reject_invalid","tests":"pytest: 12 passed","claims":["The parser tests passed"],"evidence":"pytest: 12 passed"}' \
| node bin/open-jev-bridge.mjs call --name system_one_gate
# Larger input can be supplied without shell quoting:
node bin/open-jev-bridge.mjs call --name system_one_verify --file verify-input.json
node bin/open-jev-bridge.mjs compact --file canonical-transcript.jsonCLI evidence is caller-supplied: a string claiming “12 passed” is not independently attested execution. The completion hooks prefer host tool-event observations and use supported transcripts as a fallback. Belay sends bounded/redacted task/final text, edit counts and recent check summaries. With default automatic patch review enabled, fresh passing checks then trigger a separate combined gate containing bounded observed edit inputs and actual check evidence. Hosted Jev therefore receives this selected content. No model call is needed for an unchanged explanation-only turn. Incomplete evidence and backend failures are not passing verification. Continuation guards, caps and evidence-based deduplication bound loops; new corrective evidence is rechecked.
Stable PreCompact hooks save a private canonical checkpoint. After built-in compaction, SessionStart receives a small historical excerpt and checkpoint path, not a replacement transcript. This can preserve access to earlier verbatim evidence, but is not a claim of directly reducing Codex's active context or eliminating its own compaction cost. Checkpoints contain visible text/tool data, not a serialization of images, private thinking or every host-internal block.
Configuration
Node runtime precedence: defaults → user JSON → environment → CLI overrides. Default JSON path is ~/.config/open-jev-bridge/config.json, honoring XDG_CONFIG_HOME or OPEN_JEV_BRIDGE_CONFIG. State defaults to ~/.local/state/open-jev-bridge, honoring XDG_STATE_HOME or OPEN_JEV_BRIDGE_DATA. The installer persists supplied non-secret options but never an API key inherited from the environment.
Setting | Default | How to change |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| unset |
|
| unset |
|
| false |
|
| 20,000 |
|
| 2 / 32 | JSON; request concurrency is bounded, not a promise of parallel model inference |
| 0 | JSON, at most 2 transient-HTTP retries within the same deadline |
| false |
|
| true |
|
| true |
|
| true |
|
| true |
|
| 60 |
|
| false |
|
| 0.7 | JSON |
| 3 / 60,000 | JSON |
| 6,000 / 7,600 | JSON; conservative UTF-8 byte estimates, not exact token counts |
| 6 / 0.5 | JSON for Node paths, or |
| 300 / 0.25 | JSON for Node paths, or compaction options |
| 16 MB / 4 MB | JSON |
| 3,600,000 | JSON; expired files are not restored, but remain on disk until deliberately removed |
All defaults/validators are in src/config.mjs. Bad values and unknown keys fail explicitly; hook entry points still fail open. For an intentional private LAN deployment:
node bin/open-jev-bridge.mjs install --host both \
--url https://system-one.internal.example:8009 --allow-remoteProtect remote deployments with TLS/access controls and a trusted proxy. Do not pass credentials in the URL. A supplied non-loopback URL is rejected without explicit opt-in. Standard Node transport refuses redirects. The default local setup never calls a Jev/TypeSafe service.
Test results and benchmark
696/696 Node tests and 67/67 Python adapter tests passed (763 total); zero failures or skips. Syntax/schema/plugin checks, the coverage run and the benchmark completed with zero exit codes: PASS. Recorded 2026-09-24T08:50:35.911Z, v22.16.0, linux/x64. Raw evidence is generated under reports/ by npm run validate; reports are deliberately excluded from the clean source ZIP. Live Jev/Kev/Laya/Decider/Shisa inference: NOT EXECUTED. Real native-host sessions: NOT EXECUTED.
The fixture API is a deterministic local HTTP server used to establish request/response wiring. It is not neural model inference, and these green tests do not prove the model's semantic accuracy. The native host CLIs are explicit doubles in installer/e2e tests. Real model and authenticated native-host acceptance remain separate, clearly labeled gates rather than skipped cases counted as passes.
Measured operation | Samples | p50 | p95 | Throughput |
direct_http_system_one | 100 | 0.755 ms | 1.404 ms | 1163.3/s |
stdio_mcp_to_http | 100 | 0.983 ms | 1.599 ms | 943.9/s |
compaction_pure_fixture | 100 | 0.280 ms | 0.462 ms | 3017.5/s |
verified_belay_fast_path_no_model | 1000 | 0.005 ms | 0.007 ms | 168373.2/s |
validate_255_rounded_options | 1000 | 0.016 ms | 0.024 ms | 54153.9/s |
stop_hook_process_verified_no_model | 10 | 55.460 ms | 57.970 ms | 17.9/s |
stop_hook_process_automatic_task_review | 10 | 88.928 ms | 95.641 ms | 11.1/s |
Environment: v22.16.0, linux/x64, AMD EPYC 9V74 80-Core Processor, 5 logical CPUs. Fixture compaction reduced serialized canonical characters by 96.63% (17,899 → 603); this deliberately synthetic result is not a real-model retention benchmark.
The stop_hook_process_automatic_task_review case measures the default Stop review path. The separate stop_hook_process_verified_no_model fast-path case explicitly disables automatic patch review. HTTP/MCP measurements include local transport overhead and a deterministic fixture response, not neural inference latency. The pure-compaction case uses fixed discard judgments over synthetic tool output: its reduction illustrates mechanics, not expected real-world token savings or preserved-recall quality. The Stop subprocess number includes Node startup and imports; the in-process fast path does not. No cross-provider speed or quality comparison is claimed. Sample counts, warmups, p50/p95/p99, throughput, environment and raw results are recorded in reports/benchmark.json.
Run the suite
npm run check
npm test
npm run test:unit
npm run test:integration
npm run test:automation # installed lifecycle commands, event evidence, native-function contract
npm run test:providers # all provider contracts + Python HTTP/MCP e2e
npm run test:adapter # Python adapter unit/security/HTTP suite
npm run test:e2e
npm run test:coverage
npm run benchmark
npm run validate # all offline checks + coverage + benchmarks, saved under reports/
npm run test:providers # all supported provider contracts and cross-process integrations
npm run benchmark:providers # Decider/Shisa adapter overhead only (synthetic responses)The suite tests strict schemas and rounded distributions; HTTP/API integrity and failure handling; every tool's policies; pairing/prose/handle preservation; fresh-check ordering; prompt-like/static output false positives; regex timeouts/cancellation; byte limits/queues/circuit recovery; MCP handshake/errors/Unicode/cancellation; both installer paths/idempotency/rollback/ownership; private state/checkpoint isolation; and a real subprocess pipeline through generated hook/MCP commands. Full coverage mapping and release gates are in TESTING.md.
For your actual model/server and installed CLIs:
# First select one complete backend configuration above.
npm run test:live # all tools + basic semantic and mixed-type probes; fails if unavailable
npm run benchmark:live # real deployment measurements, separate report
npm run test:hosts # actual CLI presence, Claude native manifest validation, direct MCP registrationstest:hosts is a readiness check, not an authenticated conversation test. Complete the native-session checklist before treating a host/version as accepted. No subagent was available during this build; direct source review and regression tests were used. An optional reviewer-agent prompt and AGENTS.md provide a repeatable review workflow for a host that supports subagents.
Repository map
bin/open-jev-bridge.mjs CLI, MCP launch and hook entry point
src/providers.mjs Provider limits, rounding profiles and model-list normalization
adapters/laya_server.py Optional Laya HTTP sidecar; refuses all input truncation
adapters/decider_server.py Optional Decider 35B eager CUDA sidecar; exact preflight limits
src/shisa.mjs Pure vLLM restricted-letter translation shared with Claude functions
src/shisa-llamacpp.mjs Native GGUF tokenizer/template/probability adapter
docs/LOCAL_MODELS.md Local downloads/serving, complete payload contracts and source audit
examples/ Jev / Kev / Laya nonsecret configuration files
src/client.mjs Configured HTTP transport, budgets, queue and breaker
src/schema.mjs Strict input and typed answer integrity
src/tools.mjs Ten task tools + four bridge tools
src/compact.mjs Pure immutable compaction engine
src/belay.mjs Current-turn execution evidence and completion policy
src/transcript.mjs Claude/Codex record adapters
src/hooks.mjs Automatic host lifecycle integration
src/automation.mjs Event evidence, proactive policy, task gate and screening
src/automation-status.mjs Offline hook-readiness and observation inspection
src/function-hook.mjs Optional isolated Claude function adapter
src/install.mjs Direct installation, ownership, rollback and uninstall
.claude-plugin/ Claude manifest and local marketplace
.codex-plugin/ Codex compatibility manifest
plugins/claude-functions/ Ready-to-use self-contained Claude function-hook plugin
hooks/ skills/ agents/ Host integrations and usage/review guidance
tests/ Offline unit, contract, integration and subprocess e2e
benchmarks/ Reproducible offline/live benchmark runner
scripts/ Build, check, live/host checks and report generation
docs/ API, source review, testing and native acceptanceplugins/claude-functions/ is checked in and ready to install. npm run build deterministically regenerates that self-contained variant from the root implementation when the root runtime changes. The clean release still excludes lockfiles, validation reports, checksums, caches, and unrelated generated build artifacts. npm run check validates the source tree. Do not edit files under plugins/claude-functions/ independently; regenerate them from the root sources.
Migration from the previous Kev-named release
This is an intentional namespace change, not a hidden alias layer. The previous KEV_* bridge environment variables are no longer read. Use SYSTEM_ONE_*; KEV_BRIDGE_CONFIG becomes OPEN_JEV_BRIDGE_CONFIG, and KEV_BRIDGE_DATA becomes OPEN_JEV_BRIDGE_DATA. MCP tools become system_one_*, with kev_system_one becoming system_one_query. The CLI is bin/open-jev-bridge.mjs and the MCP registration is open-jev-bridge.
Uninstall the old direct integration with its old checkout before installing this release, so two Stop hooks do not run:
node /absolute/path/to/kev-bridge/bin/kev-bridge.mjs uninstall --host both
# Then use this release's backend-specific install command.For old native plugins, disable/remove them through the host's plugin manager. Configuration and private checkpoints are not automatically migrated or deleted. Copy nonsecret JSON values to ~/.config/open-jev-bridge/config.json deliberately; retarget a key file rather than copying a key into source control. Only optional jev_* tool aliases remain, because they explicitly support the upstream tool names; they do not choose Jev or change any credentials.
Uninstall and troubleshooting
node bin/open-jev-bridge.mjs uninstall --host bothThis removes only owned direct-mode MCP entries and exact hook commands. It preserves other settings, user-modified/extended skill folders, configuration and checkpoints. Native installations are managed through the respective host plugin manager. Restore/remove private checkpoint files deliberately; no broad cleanup command deletes your history.
A connection error usually means the selected server is not running at the configured URL. An invalid-response error means the endpoint or answer does not meet the System One contract; a chat-completions URL is not interchangeable. A context-budget error requires a smaller complete evidence unit or a model-compatible budget, not deletion of inconvenient facts. Missing hooks can reflect an older host, disabled plugin, stale absolute path or unapproved Codex hook trust. No Stop block may be legitimate: no observed edits, an accepted automatic task review, explicit partial/blocked output, a guard, shadow mode or fail-open on unavailable/incomplete evidence.
A process killed while holding a state lock can leave a lock file. Confirm the owning process is no longer active before removing only that stale lock; the default behavior safely bypasses rather than guessing. See SECURITY.md for trust boundaries and known limits.
License
Original bridge code is MIT licensed. Upstream attribution and model-license separation are in NOTICE. No upstream source archive, model weight, third-party npm runtime or font file is bundled.
New-provider test coverage
tests/local-models.test.mjs checks endpoints, typed payloads, Decider hybrid rounding, Shisa prompt fidelity and restricted-softmax arithmetic, all fourteen tools, missing-letter fallbacks, malformed responses, budgets, authentication, cancellation and concurrency. tests/local-models-e2e.test.mjs executes CLI/MCP subprocesses and the actual installed hook commands for both hosts and both new providers: edit → Stop verification → real recorded check result → review gate → screening → compaction checkpoint → recovery. It also executes the bundled Claude function callback through both transports.
The Decider tests run the actual Python HTTP wrapper with a clearly named fake neural backend, and its Python tests verify eager loading, CUDA/BF16 checks, preflight row limits and private error handling. Shisa fixtures independently implement the required vLLM and llama.cpp wire shapes and deliberately synthetic tokenizers. They are not real vLLM/llama.cpp model or GPU inference measurements. Runtime code never imports fixture backends. See LOCAL_MODELS.md for the exact API/source audit and live acceptance procedure.
Measured adapter overhead only — synthetic HTTP/tokenizer/model fixtures, not GPU inference. Three typed questions per logical request; 20 measured samples after three warmups. Shisa deliberately exercises two missing-letter fallback reads.
Provider/transport | p50 | p95 | HTTP calls per logical request |
decider/http | 1.087 ms | 2.262 ms | 1 |
decider/mcp | 1.217 ms | 2.159 ms | 1 |
shisa/http | 17.101 ms | 19.284 ms | 22 |
shisa/mcp | 14.083 ms | 17.020 ms | 22 |
Environment: v22.16.0, linux, AMD EPYC 9V74 80-Core Processor. Reproduce with npm run benchmark:providers; raw samples are generated under reports/provider-benchmark.json. This compares adapter work on fixtures, not model inference speed or decision quality.
Available Tools
14 toolssystem_one_belayBRead-onlyIdempotent
Judge whether a supplied transcript makes unsupported completion claims. Returns an advisory Stop-hook decision; runs no commands.
| Name | Required | Description | Default |
|---|---|---|---|
| messages | Yes | ||
| final_message | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, covering the safety profile. The description adds valuable context: it returns an 'advisory Stop-hook decision' and explicitly says it 'runs no commands', which clarifies its non-execution nature. This goes beyond the annotations without contradicting them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no wasted words. It front-loads the purpose and includes the key behavioral note (advisory, runs no commands). It is concise and well-structured for a tool of this complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
While the purpose and non-execution behavior are clear, the description omits any detail about the input parameters (especially 'final_message') and the exact structure of the advisory decision. Since there is no output schema and no parameter descriptions in the schema, the description should explain what an agent needs to supply and what it will receive. It does not, making the tool incomplete for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 0%, so the description must compensate by explaining the parameters. It does not. The description only says 'supplied transcript', which vaguely maps to the 'messages' array but does not clarify the role of 'final_message'. An agent cannot infer the meaning or format of these parameters from the description, leaving a significant gap for a tool with only two parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Judge') and a specific resource ('supplied transcript') with a clear purpose ('makes unsupported completion claims'). It also notes the return is an 'advisory Stop-hook decision' and that it 'runs no commands', which helps set it apart from some sibling tools. However, it does not explicitly distinguish itself from the many system_one_* siblings, so it loses a point for lacking differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage (judging completion claims in a transcript) but provides no explicit when-to-use guidance or alternatives. Given the large sibling set (system_one_gate, system_one_review, system_one_verify, etc.), it does not state when this tool is preferred over others. The purpose is clear enough to infer a use case, but it does not actively guide the agent toward this tool vs. alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
system_one_classifyBRead-onlyIdempotent
Classify supplied items against a shared class catalog; ambiguous results require review.
| Name | Required | Description | Default |
|---|---|---|---|
| items | Yes | ||
| classes | Yes | ||
| purpose | No | ||
| auto_accept | No | ||
| minimum_margin | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, covering the safety profile. The description adds that ambiguous results require review, which is a useful behavioral cue beyond annotations. However, it does not elaborate on what 'review' entails or other potential side effects, so the added value is moderate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no redundant words. It states the core action and a key behavioral caveat efficiently, earning a top score for conciseness and structure.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 5 parameters, no output schema, and zero parameter descriptions in the schema, the description must carry substantial load. It leaves the purpose or intent of parameters like auto_accept and minimum_margin entirely unaddressed. An agent would not know how to set these values correctly, making the definition critically incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for all 5 parameters. The description only implicitly references 'items' and 'classes' (via 'supplied items' and 'class catalog'), but says nothing about purpose, auto_accept, or minimum_margin. These parameters remain entirely unexplained, so the description fails to compensate for the schema's lack of descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb and resource ('Classify supplied items against a shared class catalog'), and the name itself is unambiguous. It does not explicitly compare to sibling tools like system_one_decide or system_one_rerank, but the term 'classify' is self-explanatory and distinct enough.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'ambiguous results require review' implies a follow-up action but does not specify when to prefer this tool over siblings or mention any alternative tool names. It offers some contextual guidance but lacks explicit exclusions or routing logic, so an agent must infer usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
system_one_compactBRead-onlyIdempotent
Verbatim tool-pair compaction of supplied canonical messages; returns a new transcript and never modifies host files.
| Name | Required | Description | Default |
|---|---|---|---|
| goal | No | ||
| options | No | ||
| messages | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, and the description reinforces these with 'never modifies host files' and 'returns a new transcript'. It adds the behavioral details of verbatim processing and output creation beyond the structural annotations. No contradiction exists.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence with no redundant phrasing. It front-loads the primary action, states the return result, and explicitly addresses side effects in a compact way. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with a nested options object, seven undocumented parameters, and no output schema, the description is too thin to fully orient an agent. It omits what goal is for, how options affect behavior, and what the returned transcript contains beyond being 'new'. The complexity of the schema demands more explanatory context than a single sentence provides.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, but it only loosely references 'supplied canonical messages' without explaining goal, options, or the nested option semantics. The nested options object contains seven tunable parameters with meaningful constraints, none of which are addressed. This is a clear gap for a tool with undocumented parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb, 'compact', a resource, 'supplied canonical messages', and a clear outcome: 'returns a new transcript'. It is understandable and distinguishable from siblings by the 'compact' operation, though the phrase 'tool-pair compaction' is jargon-heavy and does not fully define what the compaction accomplishes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to use this tool versus any of the 13 siblings. It does not state preconditions, alternatives, or exclusions. The only contextual hint is 'supplied canonical messages', which implies a specific input source but is not actionable routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
system_one_compareBRead-onlyIdempotent
Compare two passages overall and by aspect. Agreement is not evidence that either passage is true.
| Name | Required | Description | Default |
|---|---|---|---|
| aspects | No | ||
| passage_a | Yes | ||
| passage_b | Yes | ||
| auto_accept | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover readOnlyHint, idempotentHint, and destructiveHint, so the description adds value with the caveat that agreement is not evidence of truth. This is a useful interpretive note. However, it does not disclose return format, pagination, or any other behavioral traits, leaving gaps despite the annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no fluff. The purpose is stated first, followed by a crucial caveat. This is maximally concise and well-structured for the information it conveys.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 4 parameters, no output schema, and 0% schema description coverage, the description is inadequate. It omits explanations for auto_accept, what aspects should be, the return value, and any prerequisites. The annotation safety profile helps, but the description leaves too much unexplained for an agent to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must explain parameters. It hints at passage_a, passage_b, and aspects ('two passages', 'by aspect'), but does not clarify the meaning of 'aspects' or explain auto_accept at all. The auto_accept parameter is entirely undocumented, leaving a significant gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool compares two passages, both overall and by aspect. The verb 'compare' and resource 'two passages' are specific, and the mention of 'by aspect' adds nuance. It distinguishes from siblings like extract or classify, though it could be more explicit about what comparison entails (similarity vs difference).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool versus the many siblings (system_one_belay, system_one_verify, etc.). There is no mention of prerequisites, context, or alternative tools. The agent must infer usage from the name alone, which is insufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
system_one_decideBRead-onlyIdempotent
Compare 2–6 candidates with explicit requirements and escape hatches. Advisory only; does not act on the decision.
| Name | Required | Description | Default |
|---|---|---|---|
| decision | Yes | ||
| evidence | Yes | ||
| candidates | Yes | ||
| priorities | No | ||
| auto_accept | No | ||
| requirements | No | ||
| escape_hatches | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false, so the safe, non-mutating nature is clear. The description adds that it is advisory only and does not act on the decision, which reinforces the annotations without contradicting them. However, it doesn't detail side effects (none expected) or response format, but annotations cover the safety profile.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no waste: it states the core purpose (compare candidates) and a critical caveat (advisory only). All key information is front-loaded and concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 7 parameters and no output schema, the description leaves out return format and details on how parameters like evidence and auto_accept are used. However, it's a decision-support tool with clear advisory role, and the schema provides structural limits (2–6 candidates, max requirements). Some gap exists in explaining the decision process, but it's sufficient for a competent agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must add meaning to parameters. The description mentions 'candidates', 'explicit requirements', and 'escape hatches', which aligns with parameters like candidates, requirements, and escape_hatches, but doesn't explain other parameters like evidence, priorities, or auto_accept. It provides minimal compensation for the lack of schema descriptions, so a baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states it compares 2–6 candidates with explicit requirements and escape hatches, which is specific and conveys the resource (candidates) and action (compare/decide). It also notes it's advisory only, which distinguishes it from tools that act. However, it doesn't explicitly name sibling tools it differs from, but the advisory-only qualifier helps differentiate from gate/verify.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when comparing candidates and making a decision, but does not explicitly state when to use this vs alternatives like system_one_compare or system_one_review, nor when not to use it (e.g., for acting on decisions). It also doesn't describe prerequisites like providing evidence or candidates beyond the schema.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
system_one_extractBRead-onlyIdempotent
Find bounded regex candidates in a worker, then select a verbatim source substring. Never generates extracted values.
| Name | Required | Description | Default |
|---|---|---|---|
| fields | Yes | ||
| document | Yes | ||
| auto_accept | No | ||
| minimum_margin | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover safety (readOnlyHint, destructiveHint), so the description's job is to add behavioral context. It adds the important constraint 'Never generates extracted values,' clarifying that it only returns verbatim matches. This adds value beyond the annotations, though it doesn't cover all edge cases like no-match behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise at two sentences, with the primary action front-loaded. Every word serves a purpose, and there is no redundant fluff. It efficiently conveys the core behavior in minimal space.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (4 parameters, no output schema, no parameter descriptions), the description is far from complete. It does not explain what the tool returns, how parameters are used, or what 'bounded' means in this context. An agent would have many open questions when attempting to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate by explaining parameters. It fails to do so—no mention of 'document', 'fields', 'auto_accept', or 'minimum_margin'. The mention of 'regex' hints at the pattern field, but this is insufficient for an agent to understand how to fill the inputs correctly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: it finds bounded regex candidates and selects verbatim substrings. It uses specific verbs and a clear resource, distinguishing it from generic operations. However, it does not explicitly differentiate from sibling tools, so a perfect score is not warranted.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies a use case for extraction from documents via regex, but it provides no explicit guidance on when to use this tool versus the many sibling tools. There are no when-not conditions or named alternatives, leaving usage partly inferred.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
system_one_findARead-onlyIdempotent
Find which supplied candidates answer a query without embeddings; return ranked candidates and an existence judgment.
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | ||
| top_k | No | ||
| candidates | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare the operation read-only, idempotent, and non-destructive. The description adds meaningful behavioral context beyond those annotations: it reveals an implementation trait ('without embeddings') and what the caller should expect back ('ranked candidates and an existence judgment'). It does not cover failure modes or edge cases, but the annotation safety profile lowers the bar.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no filler, front-loading the core verb 'Find' and the key scoping phrase 'supplied candidates.' Every part adds useful information: the operation, the non-embedding constraint, the ranking behavior, and the existence judgment.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description at least names the two expected outputs, which is helpful. Still, it does not define what 'existence judgment' means, how 'ranked candidates' are ordered, or how top_k interacts with results. The description is adequate for basic routing but not fully complete for a tool with no output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries the full burden of explaining parameters. It implicitly covers 'query' and 'candidates' but says nothing about the optional 'top_k' parameter or the purpose of candidate 'id' and 'text' fields. With three parameters and zero schema descriptions, this is a meaningful gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description identifies a specific verb-resource pair: 'Find which supplied candidates answer a query' and adds a distinctive output, 'ranked candidates and an existence judgment.' It also mentions 'without embeddings,' which helps separate it from embedding-based sibling tools. However, it does not explicitly name or contrast any sibling like system_one_rerank, so differentiation is implied rather than explicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'without embeddings' implies a use case where embeddings are unavailable or undesired, giving some contextual guidance. But the description does not state when to prefer this tool over siblings such as system_one_rerank or system_one_compare, nor does it mention exclusions. Usage is implied rather than clearly routed.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
system_one_gateBRead-onlyIdempotent
Review a diff and verify completion claims together in one bounded System One request. Does not execute tests.
| Name | Required | Description | Default |
|---|---|---|---|
| diff | Yes | ||
| tests | No | ||
| claims | Yes | ||
| context | No | ||
| request | Yes | ||
| evidence | Yes | ||
| review_at | No | ||
| auto_accept | No | ||
| composite_floor | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover read-only, idempotent, and non-destructive behavior, so the safety profile is clear. The description adds behavioral context beyond annotations: the operation is bounded and it intentionally does not execute tests. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, each earning its place: the first states the combined purpose Discipline, the second prevents a common misuse. Some jargon like 'System One' and 'bounded' is unexplained, but overall it is compact and front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 9 parameters, nested object evidence, no output schema, and 0% parameter documentation, this description is under-specified. An agent cannot infer how evidence should be structured, what thresholds like auto_accept or composite_floor do, or what response to expect.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must carry parameter meaning, but it only adds semantics for diff and claims, and indirectly tests. The critical params request, evidence, review_at, auto_accept, composite_floor, and context remain entirely unexplained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb-resource pairing: 'Review a diff and verify completion claims' in one request Dropping. It distinguishes itself from a test-runner by explicitly saying it does not execute tests. However, it does not differentiate clearly from system_one_review or system_one_verify beyond the 'together' phrasing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use it ('together in one bounded System One request') and states an exclusion ('Does not execute tests'). It does not name alternatives or provide explicit when-to-use/when-not-to-use guidance relative to the sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
system_one_queryDRead-onlyIdempotent
Validated raw System One request; state is arbitrary JSON. This is not an OpenAI chat-completions endpoint.
| Name | Required | Description | Default |
|---|---|---|---|
| model | No | ||
| state | Yes | ||
| questions | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds no meaningful behavioral context beyond the annotations; 'Validated raw System One request' is unclear and does not disclose any side effects, return format, or error behavior. It does not contradict annotations, but it also does not enrich them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely short, but this is under-specification rather than conciseness. It fails to convey essential information in the limited space, so the brevity is not a strength.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With three parameters, no output schema, and zero schema coverage, the description is wholly inadequate. An agent has no idea what the tool does, how to format the request, or what to expect in response. This is a complex query tool that requires substantial documentation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must explain the parameters, but it says nothing about 'state', 'questions', or 'model'. The schema only lists them as required/optional with basic types, but no semantic meaning is provided. The agent cannot infer what values to pass or how they affect the request.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description says 'Validated raw System One request' but does not state what the tool actually does with the state and questions. It is not a tautology, but it is vague and does not clearly identify the operation or distinguish it from the many sibling tools. The negative clarification about OpenAI chat-completions does not define the tool's purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus its siblings. The only hint is a negative statement ('not an OpenAI chat-completions endpoint'), which does not help an agent decide when to call this tool. No context, prerequisites, or alternative routing is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
system_one_rerankARead-onlyIdempotent
Independently score relevance of each supplied candidate, then sort; candidate order breaks ties.
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | ||
| top_k | No | ||
| candidates | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses a behavioral nuance beyond annotations: scoring is independent per candidate, and tie-breaking uses original candidate order. This adds value beyond the readOnly and idempotent hints. However, it does not mention output format or any side effects (e.g., whether scores are returned), which could be useful but is not critical given the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that immediately states the core action and a key behavioral rule. Every word earns its place; there is no filler or redundant phrasing.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with three parameters, no output schema, and zero parameter descriptions, the description leaves out essential context. It does not explain the return value (sorted list? scores? both?), the meaning or effect of top_k, or any constraints on candidate structure beyond what the schema shows. An agent cannot fully predict the tool's behavior from this description alone.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It implies the roles of query and candidates through 'score relevance' and 'each supplied candidate,' but it does not explicitly explain them, nor does it mention the optional top_k parameter at all. The agent gets no information about what top_k controls or how to use it, making parameter semantics incomplete.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action: independently score each candidate's relevance, then sort, with tie-breaking by original order. This clearly distinguishes it from sibling tools like system_one_compare (comparison) or system_one_extract (extraction), giving an agent an unambiguous sense of what the tool does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives, nor does it mention any prerequisites or exclusions. It only states what the tool does, leaving the agent to infer the appropriate context from the name alone. There is no explicit when/when-not guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
system_one_reviewARead-onlyIdempotent
Score a proposed diff for correctness, spec match, test gap, blast radius and safety. Does not execute tests or apply patches.
| Name | Required | Description | Default |
|---|---|---|---|
| diff | Yes | ||
| tests | No | ||
| context | No | ||
| request | Yes | ||
| review_at | No | ||
| auto_accept | No | ||
| composite_floor | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and idempotentHint=true, covering the non-mutating and idempotent nature. The description adds specificity by stating it does not execute tests or apply patches, which is a more detailed behavioral constraint than the generic read-only hint. It also aligns with the annotations without contradiction, reinforcing the safety profile.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: two sentences with zero filler. The primary purpose is front-loaded in the first sentence, and the second sentence adds a critical exclusion (does not execute tests or apply patches) that clarifies scope. Every word earns its place, making it easy to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite being concise, the description is incomplete for a tool with 7 parameters, no output schema, and no parameter explanations. It lists review criteria but does not explain how they are scored, what the output format is, or how optional parameters like review_at, auto_accept, and composite_floor influence behavior. An agent would lack sufficient context to invoke the tool correctly beyond the simplest case.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, meaning none of the 7 parameters are described in the schema itself. The description mentions 'diff' implicitly by saying 'proposed diff', but it does not explain the meaning, purpose, or constraints of any parameter (request, tests, context, review_at, auto_accept, composite_floor). The description fails to compensate for the lack of schema documentation, leaving agents guessing about parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's action: 'Score a proposed diff' and specifies the criteria (correctness, spec match, test gap, blast radius, safety). It also explicitly notes what it does not do ('Does not execute tests or apply patches'), which helps distinguish it from potential execution-oriented tools. The verb+resource is specific and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a hint about when to use this tool by stating it does not execute tests or apply patches, implying it is for static review only. However, it does not name specific sibling tools or provide explicit guidance on when to choose this over alternatives like system_one_verify or system_one_gate. The usage context is only implied, not fully articulated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
system_one_screenBRead-onlyIdempotent
Screen supplied external text for prompt injection, relevance and substance. Never executes or fetches the text.
| Name | Required | Description | Default |
|---|---|---|---|
| text | Yes | ||
| purpose | No | ||
| block_at | No | ||
| review_at | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish readOnlyHint and idempotentHint, and the description adds a valuable safety boundary: 'Never executes or fetches the text.' This tells the agent the tool analyzes the supplied text without making network calls or running content, which is behavior beyond what the annotations alone state.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences deliver the core purpose and a critical negative guarantee with no filler. The key verb and object appear first, making the definition easy to process quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has four parametersasia and no output schema, and the description leaves purpose, block_at, and review_at undefined while also not explaining the result format of the screening. The definition is enough to call the tool with just text, but not enough for an agent to use the optional controls or interpret the response confidently.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, but it only references 'text' and leaves purpose, block_at, and review_at entirely unexplained. It adds the useful idea that text is external/unsafe, but an agent cannot determine how the optional parameters affect screening behavior.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'Screen' against 'supplied external text' and names the screening criteria: prompt injection, relevance, and substance. This clearly states the tool's function, though it does not explicitly distinguish it from sibling tools such as system_one_review, system_one_verify, or system_one_classify.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies a use case ('screen supplied external text') but gives no guidance on when to prefer this tool over the many siblings, nor any conditions or exclusions. An agent is left to infer when system_one_screen should be called rather than system_one_review, system_one_gate, or system_one_verify.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
system_one_statusARead-onlyIdempotent
Check the configured System One /v1/models endpoint and report bridge capabilities; exposes no API credentials.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, covering the safety profile. The description adds the security note that it exposes no API credentials, which is useful but doesn't explain what 'bridge capabilities' means or any potential side effects. The description does not contradict annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that is direct and to the point, with no unnecessary words. The action and key details are front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description is the only source for return information. It says 'report bridge capabilities' but does not specify the structure or content of the report. For a status tool this may be sufficient, but more explicit details about what capabilities are reported would improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the description does not need to explain parameter semantics. The schema coverage is 100% (empty schema), and the baseline for zero parameters is 4. The description adds no parameter-related information but is not required to.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action: check the configured /v1/models endpoint and report bridge capabilities. This is a specific verb+resource combination that distinguishes it from sibling tools by naming the endpoint and purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use for checking system status but does not explicitly state when to use it vs alternatives or provide exclusions. Given the many sibling tools, explicit guidance would be helpful, but the name and description make the use case fairly obvious.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
system_one_verifyARead-onlyIdempotent
Verify claims against supplied evidence; probability-based advisory verdicts, not proof.
| Name | Required | Description | Default |
|---|---|---|---|
| claims | Yes | ||
| evidence | Yes | ||
| auto_accept | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and non-destructive behavior. The description adds valuable behavioral context: outputs are probability-based advisory verdicts, not proof, which informs how an agent should interpret results. No contradiction with the annotations exists.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one tight sentence with no filler. It front-loads the core operation and follows with the essential advisory caveat, so every phrase earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, 0% schema description coverage, and three parameters, the description is not complete enough. It fails to describe what a verdict actually looks like, how confidence is expressed, and how auto_accept affects behavior, leaving an agent to guess at call semantics.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for missing parameter documentation. It clarifies that claims are checked against evidence, but it does not explain the auto_accept threshold, the accepted evidence formats, or constraints on claims. This leaves a key parameter semantically unexplained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: 'Verify claims against supplied evidence,' and adds the clarifying caveat that verdicts are 'probability-based advisory' rather than proof. This distinguishes it from sibling tools like classify or decide by making clear it judges claims against provided evidence rather than producing categorical outcomes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool: when a caller has discrete claims and supplied evidence to check. However, it does not explicitly state when to use this over siblings such as system_one_review, system_one_compare, or system_one_decide, and it gives no exclusions or alternative conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
14 tool updates
v0.3.0- First observed
system_one_belay - First observed
system_one_classify - First observed
system_one_compact - First observed
system_one_compare - First observed
system_one_decide - First observed
system_one_extract - First observed
system_one_find - First observed
system_one_gate - First observed
system_one_query - First observed
system_one_rerank - First observed
system_one_review - First observed
system_one_screen - First observed
system_one_status - First observed
system_one_verify
TDQS
Scored across 14 tools
Each tool has a clearly distinct purpose: from checking claims (belay) to ranking candidates (rerank) to validating queries (query). While some overlap in concept (compare vs decide vs verify), the descriptions clearly delineate their specific roles and inputs, leaving no ambiguity about which tool to use.
All tools follow the consistent pattern 'system_one_' + a verb in lowercase snake_case (e.g., system_one_belay, system_one_compare). The prefix groups them coherently, and the verb accurately reflects each action, making the naming predictable and easy to navigate.
With 14 tools, the server is well-scoped for a specialized verification and analysis system. Each tool addresses a distinct aspect of the domain (e.g., extraction, classification, reranking, review), and none feel redundant or extraneous. The count fits comfortably within the ideal range.
The tool surface covers a comprehensive set of operations for a safety-focused analysis server: status checking, raw queries, extraction, comparison, verification, classification, ranking, screening, review, and gate decisions. There are no obvious missing lifecycle operations, and the domain is not one that requires CRUD-style updates or deletions.
Maintenance
Related MCP Connectors
Build and supervise fleets of agents from Claude Code, Codex or Cursor. Connects over OAuth.
A paid remote MCP for OpenAI Codex context compressor, built to return verdicts, receipts, usage log
A paid remote MCP for OpenAI Codex agent coordination MCP, built to return verdicts, receipts, usage
- Cavuno MCPOAuthcom.cavuno
Connect Claude, Cursor, Codex, and other MCP clients to manage your Cavuno job board.
Related MCP Servers
- FlicenseBqualityNot gradedmaintenanceBridges Claude Code to a Cloud Orchestrator API, providing access to multi-AI consensus, web search, code execution sandboxes, long-term memory, knowledge graphs, deployment management, and 20+ integrated AI and developer tools.28-
- AlicenseNot gradedqualityCmaintenanceConnects Claude Code to local Jupyter kernels for code execution, kernel management, and notebook execution, with security gating and output capture.PolyForm Noncommercial 1.0.0
- AlicenseAqualityAmaintenanceBridges Claude Code and OpenAI Codex through MCP, allowing cross-harness querying, code review, explanation, and implementation delegation.65 npm1MIT
- AlicenseAqualityBmaintenanceBridges MCP clients such as Claude Code and Cursor to independent Codex app-server sessions, letting them start, poll, steer, review, compact, cancel, and answer prompts for asynchronous Codex tasks over local stdio or a remote authenticated WebSocket. Runs read-only by default, with workspace-write sandboxing only when a user explicitly enables it, and reports job status, model listing, and progress back to the client.101MIT