workspace-metabolism
workspace-metabolism's MCP server (wm mcp) gives AI agents 8 zero-dependency, policy-driven tools to audit, govern, clean, and undo workspace clutter left by coding agents.
wm_audit — Read-only workspace audit as JSON: every policy-covered path, its grade (G1–G4), cleanup state, and anomalies; optional duplicate scan (
dupes). Safe even with no policy file.wm_health — Compute a 0–100 workspace health score with a component breakdown (coverage, compliance, cleanliness) for CI gates or session-end reporting; requires a policy file.
wm_explain — Return the "nutrition label" for one path: its grade, why it is graded that way, and what cleanup would do to it.
wm_verify — Verify the hash-chained journal and run manifests for tampering, returning pass/fail per check before you trust prior history.
wm_clean — Plan (dry-run by default) or execute a policy-driven cleanup; moves items to a recycle area with per-file SHA-256 hashes. G3 execution requires
approve+approver; can link to adecision_id.wm_govern — Check whether an AI action (read/write/execute/delete/network) is allowed by policy without performing it; unknown actions denied by default; decision is journaled.
wm_init — Scaffold
metabolism.jsonby scanning the workspace and grading directories G1–G4 with safe defaults; refuses to overwrite unlessforceis set.wm_rollback — Restore a prior cleanup run from the recycle area after SHA-256 integrity checks; dry-run by default, skipped items reported with reasons.
Agents can thus self-manage the full lifecycle — check → govern → recycle → verify → rollback — while the policy file still decides everything and nothing is ever deleted by pattern.
Allows policy-driven, journaled in-place trimming of heavy JSON fields in SQLite databases, with dry-run by default and rollback support.
workspace-metabolism
MCP server and CLI for governing files left by AI coding agents: policy-driven audit, reversible cleanup, rollback, and hash-chained verification. Python 3.11+, zero dependencies, Windows / Linux / macOS.

▶️ Watch the 60-second animated demo: docs/demo-terminal.html
The problem
AI coding agents (Claude Code, Codex, DeepSeek Harness, …) share one thing — your workspace — and they leave a trail of scratch files, caches and staged directories behind. Nobody owns the cleanup: deleting by hand is irreversible, scheduled scripts have no audit trail, and the next agent run works in the garbage the last one left.
workspace-metabolism is the policy layer for that: one metabolism.json
decides what every path is worth (G1 never touch → G4 auto), nothing is ever
deleted by pattern — items move to a recycle area with per-file SHA-256 hashes
and rollback restores them exactly — and every action lands in a
hash-chained journal that verify can audit.
Try it in 30 seconds:
pip install workspace-metabolism
wm doctor --residue # what agent byproducts your policy doesn't govern yet
wm doctor --residue --apply-policy # adopt the suggestions as policy entries (creates the file if missing)
wm audit # read-only checkup with health scoreDistribution status (v0.6.0): GitHub release and installable wheel; PyPI v0.5.1. The new features require the GitHub wheel/source; PyPI publication is separate. See v0.6.0 release notes for installation. See the Glama tool-definition assessment for interface quality; it does not establish production reliability or lower supervision. Honest: no large production deployments yet, and the policy schema may shift before v1.0. Early adopters are welcome to break it on weird directory structures.
Honest boundaries — what this is not:
Not a sandbox.
wm gateis a governance/audit layer for cooperative agents; a compromised or malicious agent can bypass it and call the target server directly. OS-level sandboxing is a different layer.Not a heuristic classifier. It never decides "this file is garbage" on its own — only the policy you approved decides.
doctoronly suggests entries; nothing is governed until you adopt them.Does not fix agent bugs. It governs the byproducts agents leave; it does not stop agents from producing them.
Local audit, not a notary. The hash-chained journal detects tampering with the tool's own records; it is not a distributed or court-grade ledger.
This repo has two linked ideas:
Agentic Metabolic Engineering is the method: how to think about workspace lifecycle.
AI governance as code is the implementation: how
wmapplies that method with policy files and commands.
Related MCP server: CodexPro Runtime
中文快速上手(30 秒)
v0.6.0 新增:先认领再写入、清理避让未完成认领、精确绑定 SQLite 路径及不建库的只读 检查。复用现有任务和数据入口,不另建 AI 调度系统。见接入指南、 认领使用说明和数据库检查。
AI 编程(Claude Code / Codex / Aider 等)会在工作区留下大量草稿、缓存和 废弃文件,越堆越多,下一轮 AI 还得在垃圾堆里干活。这个工具用一份策略文件 管理文件的整个生命周期:检查(只读)→ 回收(可回滚)→ 验证(防篡改记录) → 清理。
pip install workspace-metabolism # 安装(零依赖)
python examples/demo.py # 30 秒演示:盲删 vs 回收+回滚
wm init # 生成策略文件 metabolism.json
wm audit # 只读体检,给文件贴营养标签
wm clean --grades G4 --yes # 回收过期项(默认 dry-run,确认后加 --yes)
wm rollback <run_id> # 删错了?一键原样找回
wm govern write --path src/main.py # 写文件前先问策略:允许吗?(AI 执行点拦截)
wm slim --db data/app.db --yes # 数据库也会膨胀:策略驱动的库内瘦身(v0.3)默认只读、绝不直接删文件;每步操作都有防篡改记录;Windows / Mac / Linux 通用。 项目处于早期,认领和受控编辑仍为实验能力;策略格式在 v1.0 前可能调整。完整英文文档见下文。
Why this exists
Most disk tools either show you space (ncdu, duf) or delete things
(rmlint). workspace-metabolism is different: a policy file defines what
every path is worth (grades G1–G4), and the tool only ever does what the policy
allows — nothing more. It is the policy layer for multi-agent workspaces:
Claude Code, Codex, Aider, OpenClaw and every other agent share one thing —
your workspace — and the policy governs the byproducts all of them leave
behind, regardless of which tool created them. It fixes no vendor and judges
no file; see What this is not before you judge it.
G1 never touch / G2 keep / G3 approve + reference check / G4 auto
Deletion is never direct: items move to a recycle area, then
rollbackrestores them after a per-file SHA-256 integrity checkEvery action lands in a hash-chained journal;
verifydetects any editRead-only
auditreports candidates, unregistered paths, disk alerts, growth trend and possible duplicates — plus residue on memory-backed mounts (tmpfs/ramfs: it costs RAM, not just disk)Optional protected window (e.g. trading hours, business hours) during which marked entries are never touched
Scheduled runs are supported out of the box on Windows (Task Scheduler) and Linux/macOS (cron) via templates in
examples/
Why not just a scheduled cleanup?
A scheduled task — or asking Codex to "clean up old files" on a timer — gets
you at some point, files get removed. workspace-metabolism gets you:
rules that live in the repo (
metabolism.json), versioned and reviewablecleanup that never deletes directly: recycle area, per-file SHA-256, exact
rollbacka hash-chained journal that detects tampering
the same behavior on every machine and every run, no AI judgment involved
Scheduling and metabolism are complementary, not rivals: this repo ships cron,
Windows Task Scheduler and CI templates that run wm itself. The scheduler
answers when; the policy answers what, how, and how to undo it.
What this is not
Four objections come up so often they deserve their own page (docs/positioning.md). The short version:
Not a fix for vendor bugs — Claude Code's
/tmpleak, OpenClaw's staged-dir residue: those belong upstream. We govern the workspace, which is the one thing every agent shares.Not a heuristic classifier — no guessing, no AI judgment. Only the policy file you wrote decides anything;
wm explain <path>shows the rule.Not a rival to agent self-cleanup — agents should clean up after themselves;
wm mcp+ session-end hooks make that safe and audited.Not a blind-delete script — nothing is ever deleted by pattern: items move to a recycle area with per-file hashes, and
rollbackrestores them.purgeis the only real delete, and only inside the recycle area.
See it in action
This repo ships a reproducible benchmark: two identical workspaces run 30
simulated agent loops; one ends every loop with wm clean, the other never
cleans. The result — 2 active files vs 242 — is a number you can reproduce
yourself:
python examples/metabolism_benchmark.pyA recorded run (2026-08-16, wm 0.2.0) is in docs/publish/benchmark-run-20260816.json (raw log: docs/publish/benchmark-run-20260816.txt).
Case study: a 20.7 GB database that stalled a research engine
wm slim was born from a production incident, and the dogfooding round
produced the most honest review the tool has had. Read
docs/case-studies/research-engine-db-rot.md:
three failure modes (dead work units, database rot, silently-dead jobs), the
fixes, and what we found when we used wm slim to verify them — a policy
stripping the wrong field, two path-matching bugs, a CLI flag-order pitfall
that failed the first scheduled run, and the first successful run reclaiming
10.15 GB (21.7 GB → 11.3 GB) before uncovering a third real problem: the
dead-position exclusion rule forgot itself once "clean" epochs diluted its
learning window. Real usage is the final test.
🧬 Philosophy
workspace-metabolism treats your AI-generated workspace as a finite system:
audit → clean → verify → rollback, with recyclable cleanup and a hash-chained
audit trail. Cleanup is the means; metabolism is the frame. The one-liner:
loops keep the agent running; metabolism keeps the workspace usable. We
call this framing Agentic Metabolic Engineering — managing the byproducts
of agent-driven software workspaces. Full write-up:
docs/philosophy.md · the story ·
competitive analysis ·
academic anchors.
Quick start
# install from PyPI
pip install workspace-metabolism
# or run without installing anything:
# PYTHONPATH=src python -m workspace_metabolism --help
# try it on a throwaway workspace (builds demo files; shows the usual
# blind-delete fix vs the wm way: recycle + rollback + journal)
python examples/demo.pyPoint the tool at your own workspace:
cd /path/to/workspace
wm init # scaffold metabolism.json (like `git init`)
wm doctor # check readiness before the first audit or cleanup
wm audit # first checkup (read-only)
wm health # workspace health score (0-100)
wm explain logs # why a path is graded the way it is
wm clean --grades G4 --yes # recycle expired G4 items (dry-run without --yes)
wm rollback <run_id>wm init scans your workspace and registers common directories (source and
docs as G2 keep, logs/tmp/cache as G4 auto, archive/staging as G3 approve).
Edit metabolism.json and commit it like any source file. The tool
auto-discovers metabolism.json (or .wm.json) in the workspace root, so
--registry is optional. Nothing is cleaned unless it is registered in the
policy file. Advanced users can start from
examples/registry.example.json.
Commands
Command | What it does |
| Read-only health check; writes a report and a journal entry (also flags sensitive files and git-tracked content) |
| Move expired items to the recycle area (dry-run by default) |
| Same, but requires |
| Restore one cleanup run after an integrity check |
| Delete expired recycle batches (the only real delete) |
| Check the journal hash chain and run manifests |
| Overview of workspace, recycle area and pending candidates |
| Scaffold a |
| Show what the policy says about a path (the nutrition label) |
| Workspace health score (0-100), with |
| Read-only readiness check (workspace, policy, state, locks); |
| Check whether an AI action is allowed by policy and record the decision |
| MCP governance proxy: every tool call of the wrapped server is checked against the policy first |
| Policy-driven in-place trimming of heavy JSON fields in a SQLite database (journaled; dry-run by default) |
| MCP stdio server so agents can run micro-metabolism themselves |
Global flags:
Flag | Meaning |
| Workspace to govern (default: current directory) |
| Journal / recycle / runs / reports (default: system cache directory, outside the workspace) |
| Policy JSON (optional; auto-discovers |
| Weekday window; entries marked |
The default state directory lives outside the workspace on purpose — a
git add . in your project can never sweep the audit journal into version
control.
wm doctor is a read-only preflight check. It reports whether the workspace
and state directory are writable, whether the policy exists and is valid, and
whether another wm operation currently holds the state lock. The lock
serializes audits, cleanup, rollback and purge so concurrent scheduled or
agent-triggered runs cannot interleave journal and recycle operations.
AI governance as code
The optional ai_governance section is the concrete implementation of this
repository's AI governance layer. It uses the same policy file to check AI
actions before they happen. Unknown actions are denied by default; write
actions can require a preview, while execute, delete and network actions can
require a named approver. wm govern only makes and records a decision; it
does not perform the action for the caller.
wm govern write --path src/main.py
wm govern write --path src/main.py --preview
wm govern execute --path scripts/release.ps1 --approve-by "name"
wm govern network --approve-by "name" --jsonwm gate turns decisions into enforcement. It wraps any MCP stdio server
and checks every tools/call against the policy before forwarding it;
denied calls never reach the target and every decision lands in the journal:
wm gate --target "python -m my_mcp_server"Map tool names to actions with tool_patterns (glob), e.g.
"fs_write*": "write", "shell*": "execute". Unmatched tools default to the
execute action. For tools whose calls carry a preview mode, pass
"preview": true in the call arguments to satisfy requires_preview.
Every decision includes the policy hash and is written to the same
hash-chained journal; govern returns a decision_id that clean /
rollback / slim accept via --decision-id, so the journal shows the full
intent → decision → execution chain. The approver value is an auditable
declaration, not an authentication mechanism.
Honest boundary:
wm gateis a governance and audit layer, not a sandbox. A compromised or malicious agent can bypass the proxy and talk to the target directly. Gate governs the cooperative agent; OS-level sandboxing governs the hostile one.
First run, guided: wm doctor --residue scans for the byproducts agents
usually leave behind (.cursor, .claude, node_modules/.cache,
__pycache__, logs …) that your policy does not govern yet. Every hit shows
the exact policy entry that would govern it; --apply-policy adopts the
suggestions into metabolism.json (creating it if needed). Nothing is ever
deleted — the suggestions become policy, and the policy still decides
everything afterwards:
wm doctor --residue # what is ungoverned, and the suggested entries
wm doctor --residue --apply-policy # adopt them as policy entries, then auditPolicy file
{
"version": 1,
"defaults": {
"recycle_retention_days": 30,
"max_item_mb": 2560,
"disk_alert_free_gb": 20,
"disk_alert_free_pct": 15,
"dupe_scan_dirs": ["tmp", "cache"]
},
"never_clean": [".git", "README.md", "src"],
"entries": [
{"path": "logs", "grade": "G4", "cleanup": "auto", "retention_days": 30},
{"path": "archive", "grade": "G3", "cleanup": "approve", "retention_days": 60},
{"path": "**/__pycache__", "grade": "G4", "cleanup": "auto", "retention_days": 30}
]
}Field | Meaning |
| Path or glob ( |
| G1 never / G2 keep / G3 approve / G4 auto |
|
|
| Idle days before the item becomes a candidate (required unless |
| Optional: |
| Optional: skip while a |
| Optional: display marker for data with a remote source of truth |
| Optional free-form label for your own classification |
| Optional: who is accountable for this rule |
| Optional: why this rule exists |
| Optional: when this rule should be revisited |
The policy format is versioned and validated against schema/metabolism.schema.json, so editors and agents can check your file before the tool does.
Health score
wm health combines the audit summary into one number from 0 to 100: 25
points for journal auditability, 25 for governance (unregistered paths, disk
alerts), 35 for rot burden (expired candidates), and 15 for recycle
readiness. Grades: A (90+), B (75+), C (60+), D (below).
wm health --json
wm health --badge # shields.io endpoint JSON for a README badgeThe badge above is generated from docs/health.json. A CI template that fails when the score drops below a threshold is in examples/ci-audit.yml.
Agents
wm mcp runs a zero-dependency MCP stdio server. Agents can init a policy,
audit, explain, verify, and dry-run clean plans themselves; clean only
executes when the caller explicitly passes execute=true, rollback restores
a previous run from the recycle area (SHA-256 verified), and the policy file
still decides everything. The end-of-loop ritual is automated in
examples/micro_metabolism.py — wire it into a
session-end hook so every loop ends with a checkup.
DeepSeek Harness (DSH)
DSH is an agent harness where everything is a plugin (Cordis). Its official
third-party tool channel is MCP, and wm mcp already speaks it — one
cordis.yml row exposes all eight wm tools to the DSH agent (audit, health,
explain, verify, wm_govern pre-action policy checks, clean, init, rollback):
- insert:
- id: workspace-metabolism
name: '@deepseek-ai/dsh-mcp-client'
config:
serverName: wm
transport: stdio
command: wm
args: [mcp]
cwd: !!js process.cwd()Full walkthrough (project cordis.yml vs --patch overlay, pinned
--root/--state-dir, safety notes):
docs/dsh-integration.md. A policy tuned for
DSH-style workspaces (.agents/notes, scratch plugins, generated artifacts):
examples/registry.dsh.example.json.
The optional Metabolic Maintenance skill plugin adds consequence-aware maintenance rules and downstream recovery verification to DSH's skill catalog. It loads instructions on demand and can pair with the MCP tools above. Download the plugin.
Safety model
cleanis dry-run unless--yesis given.G4 needs
--yes; G3 needs--approveand--approver(audit trail).Sensitive files are never auto-cleaned:
auditflags secrets/keys/credentials (.env*,*.pem,*.key,*token*,*secret*,*credential*,id_rsa, …) in a dedicated report section, the policy validator refuses to register a sensitive path as G4 auto-clean, andcleanskips any candidate that contains sensitive files.Git-aware classification: in a git repo, tracked files count as controlled by git (effectively G2) — they are excluded from the audit's unregistered list, and
cleanskips candidates that contain git-tracked files. Non-git workspaces fall back to pure policy matching. (Git is optional;wmnever depends on it.)Items move to the recycle area with per-file SHA-256 hashes;
rollbackverifies them before restoring and refuses to overwrite an existing path.purgeis the only command that truly deletes, and only inside the recycle area after retention.The journal is a hash chain;
verifydetects any tampering.
Scheduled runs
Templates with {{PLACEHOLDERS}} are in examples/:
Windows —
register_schedule.template.ps1: daily read-only audit (20:30), weekly G4 clean (Saturday 10:00), monthly purge (1st, 10:30).Linux/macOS —
register_cron.template.sh: same schedule via cron.
Replace {{WM_CMD}}, {{ROOT}}, {{REGISTRY}}, {{STATE_DIR}} (and
{{USER}} in cron) with your values. The scripts deliberately do not
auto-detect your environment — your paths, your call.
Development
python -m pip install -e . pytest
python -m pytestCI runs the full test suite on Ubuntu, Windows and macOS with Python 3.11 and 3.12. Issues are handled on weekends; pull requests are welcome.
Project family
Sister organization: Holdout — a toolchain against self-deception in quantitative research:
falsification-ledger— pre-registration and falsification ledgerfactor-qc— fail-closed backtest quality gatepit-adjuster— PIT back-adjustment with drift detectionlookahead-free— verifiable look-ahead-freedom checksashare-data-immunity— data immunity for A-share daily barslesson-book— tuition memory for traders
If workspace-metabolism keeps the workspace alive, Holdout keeps
the research honest.
License
MIT
Maintenance evidence (0.5.1)
wm --state-dir /path/to/state evidence prints a bounded, read-only JSON
summary of journal.jsonl. Optionally add --observation check.json to read
an existing check containing timezone-aware checked_at and boolean ok.
No policy is required. Each input is limited to 8 MiB; no files are written.
Exit 0 means a nonempty internally consistent journal and, when requested, a readable valid check. It does not mean the system is healthy. Missing, empty, damaged, unsupported or oversized evidence returns exit 1. Time association does not establish matching scope, freshness, causality or business recovery. Human supervision, Token cost and net savings remain unknown. See case collection guide.
Safe recent-row retention (0.5.2)
slim can now match a real database relationship instead of assuming the
ordering timestamp is embedded in every JSON payload:
"db_slim": {
"table": "work_units",
"blob_column": "payload_json",
"strip_keys": ["regenerable_detail"],
"protected_keys": ["consumer_evidence", "failure_reason"],
"keep_recent": {
"table": "epochs", "column": "created_at", "n": 3,
"key_column": "epoch_id", "row_column": "epoch_id"
},
"vacuum_min_gb": 1.0
}column sorts the reference table; key_column joins to the work table's
row_column. Reference keys must be unique and non-null. For a row that would
change, a missing relationship stops the whole plan before any update. The
report's rows_kept_recent counts otherwise-modifiable rows protected by age.
Policies that omit the two new columns retain legacy JSON matching, but missing
or unknown references now stop instead of silently stripping the row. Migrate
such policies before scheduled use. Protected keys are top-level JSON keys;
conflicting CLI strip requests are rejected. This is not recursive field matching.
Execution holds the wm state lock and a SQLite write transaction across planning and updates. Preview opens the database read-only but still writes the existing wm journal. External writers must still observe the application's maintenance window; these locks do not validate consumer correctness or coordinate other systems. Backup/restore and post-maintenance consumer checks remain required.
Available Tools
9 toolswm_auditA
Run a read-only workspace audit and return the complete report as JSON: every path the policy covers, its grade (G1-G4), its cleanup state, and any anomalies. Use this at the start of a session to see what the metabolism policy says about the workspace, or before planning any cleanup. Sensitive files are summarized by default — dependency trees collapsed into counted directory groups, workspace-owned files listed individually — so a 'nothing is due' answer stays small; pass detail='full' for every entry. Never moves or modifies any files; if no policy file exists it reports that instead of failing.
| Name | Required | Description | Default |
|---|---|---|---|
| dupes | No | When true, additionally scan for possible duplicate files (slower). | |
| detail | No | summary (default) returns sensitive files as counts plus one group per dependency tree and lists workspace-owned files individually; full returns every sensitive entry, as earlier versions did. Nothing is dropped in either mode — the full list is always written to the audit report file (report_path). | summary |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure, and it delivers: it states the operation is read-only, explains the summary vs. full detail behavior, notes that sensitive files are summarized by default, clarifies that nothing is dropped in either mode, and specifies the failure behavior when no policy file exists. This is rich behavioral context beyond what any schema could convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense but every sentence earns its place: purpose, output format, usage timing, summary behavior, detail parameter semantics, and safety guarantee. It is front-loaded with the core purpose and ends with the most important safety and failure behaviors. No filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only audit tool with 2 optional parameters and no output schema, the description is complete. It covers what the tool returns, when to use it, how the parameters affect behavior, what happens in edge cases (no policy file), and the safety profile. An agent has everything needed to invoke it correctly without opening the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds value by explaining the practical effect of the detail parameter ('a 'nothing is due' answer stays small') and by clarifying that the full list is always written to report_path regardless of mode. It also explains the dupes parameter's cost ('slower'). This goes beyond the schema's descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Run a read-only workspace audit') and resource ('the metabolism policy'), and clearly distinguishes itself from siblings by emphasizing it returns a report and never modifies files. It also names the exact output (JSON report with paths, grades G1-G4, cleanup state, anomalies), which makes the tool's purpose unmistakable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says when to use it: 'at the start of a session' and 'before planning any cleanup.' It also contrasts with the sibling wm_clean by stating it never moves or modifies files, which helps an agent choose between audit and cleanup tools. This is explicit when-to-use guidance with an implicit alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
wm_cleanA
Plan or execute a policy-driven cleanup. By default it is a dry-run: returns the exact plan (what would be moved to the recycle area, with per-file SHA-256 hashes) and changes nothing. Pass execute=true to apply the plan: items are moved to a recycle area, never deleted by pattern, and every action lands in the hash-chained journal so rollback is possible. Use it when the workspace has accumulated policy-expired byproducts. Do NOT set execute=true without first running a dry-run and confirming the plan; G3 execution additionally requires approve=true and an approver.
| Name | Required | Description | Default |
|---|---|---|---|
| grades | No | Comma-separated grades to clean, e.g. 'G4' or 'G3,G4'. Defaults to G4, the most aggressive auto-cleanable grade. | G4 |
| approve | No | Human approval gate; required together with 'approver' for G3-grade execution. | |
| execute | No | When false (default) this is a dry-run and nothing changes; set true to actually move files to the recycle area. | |
| approver | No | Name of the person or system approving G3 execution; required when grades include G3 and is recorded in the audit journal. | |
| decision_id | No | Link this run to a prior wm_govern decision_id so the journal shows intent -> decision -> execution. Optional. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and fully discloses behavioral traits: dry-run default changes nothing, execution moves items to a recycle area rather than deleting by pattern, actions are hash-chained in a journal allowing rollback, and G3 execution requires approval. This is unusually transparent for a cleanup/mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four dense sentences, each earning its place: the main action, the default behavior and output, the safety properties, and the usage condition with warnings. It is front-loaded with the purpose and avoids filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having no annotations and no output schema, the description covers what happens, what changes, what execution does, when it should be used, and the approval prerequisites. An agent has enough context to select and safely invoke the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Since the schema covers all 5 parameters with descriptions, the baseline is 3. The description adds extra meaning by tying execute, approve, and approver to the G3 approval workflow and journal/rollback guarantees, and by clarifying that execute=false is a dry-run. It does not duplicate schema details unnecessarily.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a specific verb and resource: 'Plan or execute a policy-driven cleanup' and immediately defines the dry-run vs execute modes. This makes it distinguishable from the sibling wm_audit/wm_rollback/wm_govern tools, which concern history, rollback, and governance decisions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
States a clear trigger condition ('workspace has accumulated policy-expired byproducts') and gives explicit safety instructions: do not set execute=true without first running a dry-run, and G3 requires approve=true and an approver. It does not explicitly name sibling tools that should be used instead, but the use case is scoped well enough to route an agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
wm_db_checkA
Check the exact SQLite resource registered by resource_id in the policy. Read-only: returns table names, never creates databases or tables, repairs, deletes, searches for substitutes, or accepts SQL. Missing/empty databases and missing required tables fail. Success checks path/schema only, not data freshness or identity.
| Name | Required | Description | Default |
|---|---|---|---|
| resource_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations this description carries the full burden and does so: read-only semantics, the return shape (table names), explicit non-actions, failure semantics for missing/empty databases and missing required tables, and an explicit scope ceiling ('checks path/schema only, not data freshness or identity'). That last clause is exactly the kind of limitation an agent needs and cannot get from structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded identity statement followed by tightly packed scope, non-action, failure, and limitation clauses. No sentence is filler; each one carries distinct constraints.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema and no annotations, yet the description covers return contents, failure modes, mutation guarantees, and the boundary of what success means. Nothing an agent needs to call this correctly is absent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It does add meaning by explaining that resource_id refers to a resource registered in the policy rather than an arbitrary file path, but it gives no format, example, or lookup behavior for the identifier. Minimal compensation over a single undocumented string parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (check) and resource (the exact SQLite resource registered by resource_id in the policy), and enumerates what the tool will NOT do, which cleanly separates it from siblings like wm_health, wm_verify, wm_audit, and wm_repair-style tools. An agent can pick this out without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The negative list ('never creates databases or tables, repairs, deletes, searches for substitutes, or accepts SQL') gives clear boundary conditions that imply when this tool is the right choice, and the failure conditions tell the agent when it will error. It stops short of naming a concrete alternative sibling for the excluded operations, so it's clear context rather than full when/when-not routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
wm_explainA
Return the 'nutrition label' for one path: the grade the policy assigns (G1-G4), why it is graded that way, and what cleanup would do to it. Use this when you or the user ask why a specific file or directory is (or is not) cleanup-worthy. Read-only; fails with a clear message if the path is outside the workspace or the policy is missing.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Path to explain, relative to the workspace root (e.g. 'logs' or 'src/util.py'). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations present, the description carries the full behavioral burden, and it does so thoroughly. It explicitly labels the operation 'Read-only' and discloses the two error cases: paths outside the workspace and missing policy. It also describes the shape of the output (grade, reasoning, cleanup effect), giving the agent a solid expectation of what will come back.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences with no filler. The core function is front-loaded in the first sentence, the usage condition is second, and the read-only plus failure messages are third. Every sentence adds essential information and the description remains compact.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter, read-only explain tool with no output schema and no annotations, this description is fully sufficient. It covers what the tool does, what it returns, when to use it, that it is safe (read-only), and the failure modes. An agent has everything needed to decide when to call it and what to expect.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already provides a complete description of the single 'path' parameter, including its relative-to-workspace-root format and examples ('logs' or 'src/util.py'). The description adds no further parameter-level detail, but none is needed; per the calibration rule, baseline 3 is appropriate when schema coverage is 100%.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Return the nutrition label for one path', and goes on to enumerate exactly what the output contains (G1-G4 grade, rationale, cleanup effect). This clearly distinguishes it from the sibling tools: wm_clean acts on paths, wm_audit and wm_health operate at a broader level, whereas wm_explain is specifically about interrogating a single path. There is no ambiguity about what the tool does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The second sentence explicitly states when to use it: 'Use this when you or the user ask why a specific file or directory is (or is not) cleanup-worthy.' This gives clear context for invoking it. It does not explicitly name a sibling as an alternative, but the provided sibling list and this conditional are enough to route an agent correctly without excluding anything.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
wm_governA
Check whether an AI action is allowed by the workspace policy without performing it. Unknown actions are denied by default. Write actions can require a preview, and sensitive actions can require a named human approver. The decision is recorded in the hash-chained journal.
| Name | Required | Description | Default |
|---|---|---|---|
| paths | No | ||
| action | Yes | Action to check: read, write, execute, delete or network. | |
| preview | No | ||
| approver | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It does well by stating that the action is not performed, that unknown actions are denied by default, that write actions can require a preview, that sensitive actions can require an approver, and that the decision is recorded in a hash-chained journal. This provides meaningful behavioral context beyond the name and schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded. The first sentence states the core purpose immediately, and the following two sentences add essential behavior without fluff or repetition of schema field names.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description explains governance semantics well but leaves important gaps for a tool with no output schema: it does not describe the shape of the result, what happens when preview or approver are actually needed, or how 'paths' factors into the decision. These missing details reduce an agent's ability to invoke the tool and interpret its response correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 25%, so the description needs to compensate. It adds meaning to 'preview' and 'approver' implicitly through the write-action and sensitive-action sentences, but it never explains the 'paths' parameter, which is a notable gap. The 'action' parameter is covered by the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Check whether an AI action is allowed by the workspace policy'. It also clarifies that the tool does not perform the action, which clearly differentiates it from execution-type tools and from siblings like wm_audit, wm_explain, and wm_verify.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives context for when to use the tool: before an AI action, to check policy compliance. It also explains default behavior for unknown actions and special cases for write and sensitive actions. However, it does not explicitly state when NOT to use it or point to an alternative sibling tool for a given scenario.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
wm_healthA
Compute the workspace health score (0-100) and return it with the per-component breakdown (coverage, compliance, cleanliness) as JSON. Use this to quantify in one number how well the workspace follows its policy, e.g. for CI gates or session-end reporting. Read-only; requires a policy file — if none exists it returns an error telling you to run 'wm init'.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states the tool is read-only, requires a policy file, and returns an error instructing the user to run 'wm init' if the file is missing. This is strong, specific behavioral transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tightly written sentences communicate the computation, return format, use cases, read-only nature, prerequisite, and error behavior. Every sentence adds value, and the core purpose is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple with no parameters, and the description covers both the return value and failure mode. Even without an output schema, the description tells an agent exactly what to expect and what conditions are required for successful invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and the schema reflects that with complete coverage, so there are no parameter semantics to clarify. The description adds useful output-field context by naming the breakdown components (coverage, compliance, cleanliness), which goes beyond the empty schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('Compute the workspace health score') with a concrete output format ('0-100' score with per-component breakdown for coverage, compliance, and cleanliness). This clearly differentiates it from sibling tools like wm_verify or wm_audit by focusing on a single aggregate health metric.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit usage context: 'Use this to quantify in one number how well the workspace follows its policy, e.g. for CI gates or session-end reporting.' It gives clear scenarios for when to use the tool, though it does not explicitly mention when not to use it or name alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
wm_initA
Scaffold the metabolism.json policy file for this workspace (like git init): scans the workspace and generates a policy that grades every directory G1-G4 with safe defaults — source, docs, tests, secrets, dotfiles and version control are never auto-cleaned. Use this once, when no policy file exists, before the first audit or clean; after it succeeds, wm_audit and wm_clean can operate. Fails without writing anything if a policy already exists and force is not set.
| Name | Required | Description | Default |
|---|---|---|---|
| force | No | Overwrite an existing policy file instead of failing. Only set this when you explicitly want to regenerate the whole policy from scratch — a hand-tuned policy with custom entries will be replaced. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full behavioral burden and does so well. It discloses the scanning behavior, the safe-default grading policy, the never-auto-cleaned categories, the fail-without-writing behavior when a policy exists, and the destructive implication of force overwriting a hand-tuned policy.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two focused sentences with no filler. The primary action is front-loaded, the scaffold analogy aids understanding, and edge cases around existing policies are compressed into one clear condition at the end.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with one optional boolean parameter and no output schema, the description is complete: it explains the purpose, the generated artifact, the safety profile, prerequisites, failure behavior, and when to set force. No critical information for correct invocation is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The lone parameter force is fully described in the input schema (100% coverage), including its default and effect. The description adds context about force replacing a hand-tuned policy, but since the schema already documents the semantics, additional value is marginal and the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific action ('Scaffold the metabolism.json policy file') with an apt git init analogy, and names the resource (metabolism.json) plus the exact behavior (scan workspace, generate G1-G4 grades). It also differentiates itself from siblings like wm_audit and wm_clean by identifying init as the prerequisite step.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit usage guidance is provided: 'Use this once, when no policy file exists, before the first audit or clean.' It also states the failure mode when a policy already exists and clarifies when force should be used, leaving no ambiguity about the tool's place in the workflow.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
wm_rollbackA
Restore the items of a previous wm_clean run from the recycle area back to their original locations. Every item is verified against its recorded SHA-256 hashes first; items that fail the integrity check, are missing, or would overwrite an existing file are skipped with a reason. Use this to undo a cleanup you just executed, passing the run id printed by wm_clean. Dry-run by default; set execute=true to actually restore. Fails with a clear message if the run id is unknown.
| Name | Required | Description | Default |
|---|---|---|---|
| run_id | Yes | The cleanup run id to restore, as printed by wm_clean, e.g. 'clean-20260831-153000-123456'. | |
| execute | No | When false (default) this is a dry-run preview and nothing changes; set true to actually restore the files. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full behavioral burden and succeeds: it discloses integrity verification against SHA-256, skip conditions (integrity failure, missing items, overwrites) with reasons, dry-run behavior, and the failure message for an unknown run id. This goes beyond what a minimal description would include.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four sentences, each dense with relevant information and no filler. The purpose is front-loaded, followed by behavior, usage, and execution mode. Nothing can be removed without losing value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given only 2 parameters, 100% schema coverage, and no output schema, the description covers what an agent needs to call the tool correctly: what it does, how to select the run, the dry-run safety default, the execute flag, potential skip reasons, and an error case. No critical gap is apparent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds operational meaning beyond the schema by explaining that the run id is the one 'printed by wm_clean' and that execute=true 'actually restore[s]' rather than previewing. This contextual linkage is useful, though the schema already documents the parameters well.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific action and object: 'Restore the items of a previous wm_clean run from the recycle area back to their original locations.' It clearly distinguishes this rollback operation from siblings like wm_clean, wm_audit, and wm_verify by naming wm_clean explicitly and explaining that this undoes a cleanup.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit when-to-use guidance: 'Use this to undo a cleanup you just executed, passing the run id printed by wm_clean.' It also explains the execution model ('Dry-run by default; set execute=true to actually restore'), which tells the agent how to invoke it correctly and when to set the flag.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
wm_verifyA
Verify the integrity of the audit trail: check that the hash-chained journal has not been tampered with and that run manifests are consistent, returning pass/fail per check with details as JSON. Use this before trusting any previous clean/rollback history, or after suspecting manual edits to the journal. Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations available, the description carries the full transparency burden. It explicitly states 'Read-only', describes the verification checks performed, and discloses the return format (JSON with pass/fail details). It omits error-handling or performance caveats, but for a zero-parameter read-only tool the disclosure is adequate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the core purpose, followed by usage guidance and a read-only note. Every clause adds essential information with no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool's complexity is very low (no params, no output schema), and the description covers what it does, what it returns, and when to use it. An agent has enough information to invoke and interpret the result correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and the schema coverage is 100%, so there is nothing for the description to add. The no-parameter nature is implicitly clear, and the baseline for tools with no parameters is 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's action ('Verify the integrity of the audit trail') and the specific resources it checks (hash-chained journal, run manifests). It also describes the output as pass/fail JSON, which further distinguishes it from sibling tools like wm_health or wm_audit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly gives two concrete situations to use the tool: before trusting previous clean/rollback history or after suspecting manual edits to the journal. It does not name alternatives or exclusion cases, but the provided context is sufficient for most agent decision-making.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
1 tool update
v0.6.1- Changed
wm_audit1 field changed- added
Input schema / properties / detailAdded value: +{ + "default": "summary", + "description": "summary (default) returns sensitive files as counts plus one group per dependency tree and lists workspace-owned files individually; full returns every sensitive entry, as earlier versions did. Nothing is dropped in either mode — the full list is always written to the audit report file (report_path).", + "enum": [ + "summary", + "full" + ], + "type": "string" +}
1 tool update
v0.6.0- Added
wm_db_check
2 tool updates
v0.2.4- Changed
wm_clean1 field changed- added
Input schema / properties / decision_idAdded value: +{ + "description": "Link this run to a prior wm_govern decision_id so the journal shows intent -> decision -> execution. Optional.", + "type": "string" +}
- Added
wm_govern
2 tool updates
v0.2.2- Added
wm_init - Added
wm_rollback
5 tool updates
v0.1.0- First observed
wm_audit - First observed
wm_clean - First observed
wm_explain - First observed
wm_health - First observed
wm_verify
TDQS
Scored across 9 tools
Each tool targets a distinct operation: db_check inspects the registered SQLite resource, health/audit/explain provide different report granularities, clean/rollback execute and undo changes, govern checks policy decisions, init scaffolds, and verify checks journal integrity. The read-only reporting tools overlap in spirit, but their outputs and use cases are clearly separated.
All tools share the wm_ prefix and lowercase snake_case, which is predictable and consistent. Most are verb-first (clean, explain, govern, init, verify), but health, audit, and db_check are noun-led or object-verb, so the pattern is not uniformly verb_noun.
Nine tools is well within the ideal range and each maps to a distinct phase of the metabolism-policy workflow: init, inspect, act, undo, verify, and govern. No tool feels redundant or like padding.
The core lifecycle is covered: policy creation, audit/health reporting, path explanation, cleanup planning/execution, rollback, governance checks, and journal verification. The main gap is the lack of a tool to update or evolve the policy itself, but that can be worked around by editing the policy file and re-auditing.
Maintenance
Related MCP Connectors
Control plane for autonomous software labor. Agents claim objectives over MCP with audit trail.
- mcpOAuthio.artifacta
Artifact store for AI agents. Hosted OAuth at mcp.artifacta.io/mcp; local stdio via npm/PyPI.
Machine-economy newswire and paid changes-since for agents. MCP is challenge-handoff, not a wallet.
System-of-record notebook for AI coding agents: pages, datastores, tasks, skills over MCP.
Related MCP Servers
- AlicenseAqualityBmaintenanceDefault-deny action registry, append-only spend ledger, and human sign-off audit trail (MCP tools).6MIT
- AlicenseBqualityBmaintenanceA local, evidence-driven MCP runtime and control plane for open-source maintainers that provides workspace-bounded tools including controlled file operations, command execution, validation primitives, durable execution records, and human review workflows via stdio and Streamable HTTP transports.33MIT
- FlicenseAqualityBmaintenanceA local-first MCP server that handles daily work tasks through your AI assistant: converts meeting notes into todos, manages todo lifecycle, tracks work hours, generates daily/weekly reports, organizes files via move-only operations, and diagnoses dev environments, all guarded by a human-maintained preview/apply safety model.25-
- AlicenseAqualityBmaintenanceLocal MCP server for AI agents and vibe coding safety: deterministic risk checks (payments, auth, database, secrets, infrastructure), sessions, checkpoints, policy inspection, and fix prompts. Runs over stdio against a local git repository; no language model judges risk.81Apache 2.0