Skip to main content
Glama

Kontrol Freek — AI Assumption Firewall for MCP Agents

PyPI Python License: MIT MCP

Kontrol Freek is an open-source Model Context Protocol (MCP) server that acts as an AI safety guardrail for autonomous agents. It intercepts AI assumptions before they cause irreversible mistakes, verifies every decision against a persistent project log, detects contradictions, scores risk, and routes human approval requests through Telegram, Slack, or native MCP elicitation — all without blocking your workflow.

Gate every AI assumption. Keep humans in the loop. Prevent agentic mistakes before they happen.


Why Kontrol Freek?

AI agents and coding assistants make implicit assumptions constantly — about architecture choices, file locations, API designs, and deployment targets. Without a structured checkpoint, these assumptions silently accumulate into hard-to-reverse technical debt or outright mistakes.

Kontrol Freek solves the human-in-the-loop problem for MCP agents: it sits between your AI agent and every risky decision, comparing new assumptions against your project's history, flagging contradictions, and routing approval requests to you — wherever you are.

Kontrol Freek adds a decision firewall between your AI agent and every risky action:

AI: "I'll use PostgreSQL for this project"   ← assumption
         ↓
check_assumption("Use PostgreSQL", risk="medium", category="architecture")
         ↓
Kontrol Freek: query past decisions → detect contradictions → score risk
         ↓
├─ Low risk + past approval match  → ✅ Auto-approve, continue
├─ Medium risk / new decision      → 🔍 Notify human (Telegram / Slack / elicit)
└─ Contradiction or critical risk  → ⛔ Block + require explicit approval

Related MCP server: @vaibot/mcp-server

Key Features

Feature

Description

Assumption interception

Catches AI guesses before they execute

SQLite decision log

Persists every decision per project

Semantic similarity

Finds related past decisions using TF-IDF or sentence-transformers

Contradiction detection

Blocks decisions that conflict with approved history

Risk scoring

Adaptive policy engine — auto-approve low risk, gate high risk

Time-based decay

Old decisions lose weight; prevents stale approvals

Telegram polling

Background loop processes /kf approve/reject/answer commands

Multi-channel routing

ctx.elicit() → Telegram → Slack → Web dashboard

HMAC-SHA256 audit trail

Cryptographically signed, hash-chained decision log

Per-project isolation

Each project gets its own DB, audit log, and config

MCP native

Works with any MCP-compatible client


How It Compares

Feature

clarify-mcp

CONTINUITY

mcp-human-loop

VantaGate

Kontrol Freek

ctx.elicit() support

SQLite decision log

Risk scoring

Semantic similarity

Contradiction detection

Cryptographic audit trail

Time-based decision decay

Telegram interactive approval

Per-project isolation

Adaptive policy engine

Basic

Static

Adaptive


Installation

pip install kontrol-freek-mcp

One-command setup (macOS / Linux / Windows)

git clone https://github.com/berkbayri/kontrol-freek-mcp.git
cd kontrol-freek-mcp
python install.py

The installer:

  1. Installs the Python package

  2. Generates a .env with a random HMAC secret

  3. Registers a system service (auto-start on boot, crash recovery)

  4. Registers the MCP server with compatible clients automatically

Manual install

pip install -e ".[full]"   # Full: Telegram + Web + sentence-transformers embeddings
pip install -e ".[lite]"   # Lite: Telegram + Web (no embeddings)
pip install -e .           # Minimal: stdio only

Configuration

MCP client config

Add to your MCP client's server configuration (mcpServers block):

{
  "mcpServers": {
    "kontrol-freek": {
      "command": "kontrol-freek",
      "env": {
        "KF_HMAC_SECRET": "your-secret",
        "KF_TELEGRAM_TOKEN": "your-bot-token",
        "KF_TELEGRAM_CHAT_ID": "your-chat-id"
      }
    }
  }
}

Or using python -m if installed without the entry point:

{
  "mcpServers": {
    "kontrol-freek": {
      "command": "python",
      "args": ["-m", "kontrol_freek_mcp"],
      "env": {
        "KF_HMAC_SECRET": "your-secret"
      }
    }
  }
}

Per-project config (.kontrol-freek.json)

Place this file in your project root to override global credentials and set a project name:

{
  "project_name": "my-app",
  "telegram_token": "bot-token-override",
  "telegram_chat_id": "chat-id-override",
  "slack_webhook": ""
}

Per-project config is detected automatically — no restart required when the file changes.

HTTP server mode (remote / multi-user)

kontrol-freek --transport streamable-http --port 8765
{
  "mcpServers": {
    "kontrol-freek": {
      "transport": "streamable-http",
      "url": "http://localhost:8765/mcp"
    }
  }
}

Telegram Setup

  1. Message @BotFather/newbot → copy the token

  2. Start a DM with your bot or add it to a group

  3. Get your chat ID: https://api.telegram.org/bot<TOKEN>/getUpdates

  4. Set credentials in .env or .kontrol-freek.json

Telegram commands

/kf approve <id>              Approve a pending assumption
/kf reject <id> [reason]      Reject with an optional reason
/kf answer <id> <answer>      Answer a direct question

Kontrol Freek runs a background long-poll loop — no webhook setup needed. Commands are processed in real time while the MCP server is running.


MCP Tools Reference

Always pass project_root as your current working directory so decisions are isolated per project.

Tool

When to use

check_assumption

At every decision point — architecture, file paths, API choices, etc.

confirm_decision

To record a finalized decision; set is_irreversible=True for destructive actions

ask_human

When genuinely uncertain — prompts human via Telegram/Slack/elicitation

query_decisions

At the start of a task — load prior context before making new decisions

revoke_decision

When a past decision is no longer valid — prevents it from influencing future auto-approvals

get_firewall_stats

View approval rates, total decisions, and activity by category

healthcheck

Verify DB, audit chain, and notification channel health

setup_project

Initialize per-project config on first use

check_assumption response statuses

Status

Meaning

Agent should…

auto_approved

Low risk, matches prior approved decision

Proceed

pending_review

Human review recommended (architecture / security / deployment)

Proceed with caution — call confirm_decision() when task is done

blocked

Contradiction detected or critical risk

Stop — do not proceed without explicit human approval

human_approved

Human approved via Telegram/Slack

Proceed

human_rejected

Human rejected

Stop and reconsider


How It Works

Decision flow

AI calls check_assumption(assumption, risk_level, category, project_root)
    │
    ├── Query SQLite for similar past decisions
    ├── Compute semantic similarity score (TF-IDF or sentence-transformers)
    ├── Run contradiction analysis
    ├── Policy engine → auto_approve / review / block
    │
    ├── auto_approve    → log, return status: "auto_approved"
    ├── pending_review  → log, return status: "pending_review" (non-blocking)
    │                     optionally notify Telegram/Slack in background
    └── block           → log, return status: "blocked"
                          if Telegram/Slack configured → notify + wait (3 min max)
                          │
                          ├── Telegram bot    (/kf approve/reject <id>)
                          └── Slack webhook   (text instructions)

Policy rules

Condition

Verdict

critical risk

⛔ Block — always requires human approval

Contradiction with approved decision

⛔ Block

Category: security, architecture, deployment

🔍 Human review

Low risk + ≥78% similarity + prior approval

✅ Auto-approve

high risk

🔍 Human review

Default

🔍 Human review

Time-based decision decay

Older decisions carry less weight in similarity matching, preventing stale approvals from auto-approving new assumptions:

Age

Weight

0 days

1.00

30 days

0.72

90 days

0.37

180 days

0.14

Cryptographic audit trail

Every action is written to an HMAC-SHA256 signed, hash-chained JSONL file:

{
  "action": "human_approve",
  "text": "Use PostgreSQL",
  "detail": "Approved via Telegram",
  "decision_id": 42,
  "ts": "2025-01-15T14:30:00Z",
  "prev": "a1b2c3...",
  "hash": "d4e5f6..."
}

Verify audit chain integrity:

from kontrol_freek_mcp.audit import AuditTrail
trail = AuditTrail("~/.kontrol-freek/projects/my-app/audit.jsonl", "your-secret")
valid, count = trail.verify_chain()
print(f"Chain valid: {valid} — {count} entries")

Auto-Start & Crash Recovery

python install.py configures an OS-native service:

Platform

Mechanism

Details

macOS

LaunchAgent

~/Library/LaunchAgents/com.kontrol-freek.mcp.plist — starts at login, KeepAlive restarts on crash

Linux

systemd user service

~/.config/systemd/user/kontrol-freek.serviceRestart=on-failure, persists across logouts via loginctl enable-linger

Windows

Task Scheduler

schtasks — triggers at logon

The wrapper script includes exponential backoff (5s → 10s → 20s → ..., max 10 restarts).

python install.py --status     # Health check
python install.py --uninstall  # Clean removal

Project Structure

kontrol-freek-mcp/
├── src/kontrol_freek_mcp/
│   ├── server.py        # MCP server — 7 tools, 2 resources, 1 prompt
│   ├── db.py            # SQLite decision database
│   ├── policy.py        # Adaptive policy engine (risk scoring, decay)
│   ├── similarity.py    # Semantic similarity (TF-IDF + sentence-transformers)
│   ├── notifier.py      # Multi-channel routing + Telegram polling loop
│   ├── audit.py         # HMAC-SHA256 hash-chain audit trail
│   └── web.py           # FastAPI approval dashboard
├── tests/
├── install.py           # One-command installer
├── pyproject.toml
├── .env.example
└── README.md

License

MIT — free to use, modify, and distribute.

Available Tools

8 tools
ask_humanB

Ask the human a direct question and wait for their response. Call this whenever uncertain. Always pass project_root as the current working directory.

ParametersJSON Schema
NameRequiredDescriptionDefault
contextNo
optionsNo
urgencyNonormal
questionYes
project_rootNo.

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden of behavioral disclosure. It does disclose that the tool asks a question and blocks until the human responds, which is important interactive behavior. However, it does not explain what happens with options or urgency, whether the call pauses execution, or what the human's response means beyond being returned.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no filler. The purpose, trigger condition, and an important parameter instruction are all front-loaded. Every sentence earns its place, and the description is easy to parse quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the essential flow and project_root, but with five parameters, no schema descriptions, and no annotations, it leaves context, options, and urgency undefined. The output schema existing helps with return values, but parameter semantics remain materially incomplete for effective agent use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for the undocumented parameters. It adds meaning for project_root ('Always pass project_root as the current working directory') and implicitly for question, but context, options, and urgency are entirely unexplained. The compensation is partial at best.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb ('Ask'), the resource ('the human'), and the behavior ('wait for their response'), making the tool's core function obvious. It does not explicitly contrast with sibling tools like confirm_decision or check_assumption, but the 'direct question' framing distinguishes it from assumption-checking and confirmation workflows.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit guidance: 'Call this whenever uncertain.' This is a clear condition for use, though it does not specify when not to use the tool or name alternatives such as confirm_decision or check_assumption. That keeps it at a 4 rather than a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

check_assumptionA

Verify an assumption against past decisions. Checks for contradictions, scores risk, and requests human approval when needed.

ALWAYS pass project_root as the current working directory so decisions are stored per-project and not mixed across projects.

The AI MUST call this at every decision point:

  • When guessing instead of using confirmed info

  • When choosing between multiple valid options

  • When the choice might contradict a previous decision

  • Before any hard-to-reverse step

ParametersJSON Schema
NameRequiredDescriptionDefault
contextNo
categoryNogeneral
assumptionYes
risk_levelNomedium
alternativesNo
project_rootNo.

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It discloses that the tool checks contradictions, scores risk, requests human approval, and stores per-project decisions. Still, it does not explain what happens after approval, whether the tool can block execution, or what side effects it has beyond requesting approval.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is reasonably concise and well-structured: a summary sentence, a critical parameter directive, then bulleted usage triggers. The 'MUST call at every decision point' framing is slightly repetitive with the following bullets, but overall it earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The usage context is strong: the description clearly says when to invoke the tool and stresses per-project storage via project_root. However, with no annotations and 0% schema coverage, the missing parameter semantics and ambiguity around the approval/contradiction flow leave the agent under-informed for a 6-parameter tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for six parameters. It only explicitly explains project_root and implies assumption; context, category, risk_level, and alternatives receive no semantic guidance. This is a significant gap for an agent deciding how to populate those fields.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Verify an assumption against past decisions.' It clearly distinguishes the tool from siblings by adding behavioral details—checks for contradictions, scores risk, and requests human approval—which separates it from query_decisions and ask_human.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit trigger conditions with 'The AI MUST call this at every decision point' and a bulleted list of when to use it. It also gives a mandatory project_root instruction. However, it does not name sibling alternatives or provide when-not-to-use guidance, so it falls short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

confirm_decisionA

Record a finalized decision. Irreversible decisions always require human approval. Always pass project_root as the current working directory.

ParametersJSON Schema
NameRequiredDescriptionDefault
categoryNogeneral
decisionYes
rationaleYes
project_rootNo.
is_irreversibleNo
alternatives_consideredNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses an important behavioral constraint—irreversible decisions require human approval—and the project_root requirement. It does not explain what happens when approval is missing, whether the record is persisted, or what the response is, so transparency is partial.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no filler: the first states the primary purpose, and the second packs two critical usage constraints. The structure front-loads the main action and keeps necessary operational details compact.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given six parameters and no annotations or output schema, the description covers the most decision-relevant behaviors but leaves gaps. It does not describe the approval workflow, the persistence or result of recording, or how this tool relates to ask_human and revoke_decision, so an agent still has to infer part of the invocation context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds meaning to project_root ('current working directory') and is_irreversible ('requires human approval'), which the bare schema does not convey. However, it does not clarify category, alternatives_considered, or the required decision and rationale fields beyond their names.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action ('Record') and a specific object ('a finalized decision'), making the tool's core purpose clear. It is distinguishable from siblings like query_decisions and revoke_decision, though it does not explicitly name them or contrast with them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides useful situational guidance: irreversible decisions require human approval, and project_root must be passed as the current working directory. However, it does not explicitly state when to choose this tool over query_decisions, revoke_decision, or ask_human, leaving the selection partly implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_firewall_statsA

Return firewall statistics for the current project. Always pass project_root as the current working directory.

ParametersJSON Schema
NameRequiredDescriptionDefault
project_rootNo.

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

There are no annotations, so the description carries the behavioral burden. 'Return' implies a read-only operation and the project_root instruction adds procedural context, but it does not disclose potential side effects, permission requirements, or whether statistics are cumulative or reset.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no filler. The core purpose is front-loaded and the critical invocation instruction is concise and actionable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-optional-parameter tool with an output schema, the description covers the essential invocation detail and return purpose. It does not discuss when to call it or edge cases, but the low complexity and output schema reduce that need.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must clarify the parameter. It explains that project_root should be set to the current working directory, which adds meaning beyond the raw schema and default value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Return') and resource ('firewall statistics') with a clear scope ('current project'). It is unambiguous and naturally distinguishes from unrelated siblings like check_assumption and healthcheck.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides explicit invocation guidance: 'Always pass project_root as the current working directory.' It does not name alternatives or exclusions, but no sibling tool performs a comparable function, so the guidance is sufficient.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

healthcheckA

Full health check — DB, audit chain, channels. Always pass project_root as the current working directory.

ParametersJSON Schema
NameRequiredDescriptionDefault
project_rootNo.

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

As no annotations are provided, the description carries the behavioral disclosure burden. It discloses the scope (DB, audit chain, channels) and the working-directory prerequisite, which are useful. But it does not explicitly state side effects, whether it is read-only, or what happens on failure, leaving some behavioral ambiguity.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences accomplish everything: the first defines the tool's scope, the second gives the key parameter requirement. There is no filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter health check with an output schema, the description covers the essential invocation details and scope. It could be more complete by noting any environmental prerequisites beyond CWD, but nothing critical is missing for basic use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage and only one optional parameter, the description compensates by explaining how to set project_root: 'Always pass project_root as the current working directory.' This adds concrete meaning beyond the schema's bare string type and default.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description states 'Full health check — DB, audit chain, channels,' naming a clear action and the specific resources it covers. This distinguishes it from sibling tools like get_firewall_stats, which target a narrower metric. The scope is concise and immediately understandable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The 'Full health check' phrasing implies it is the comprehensive diagnostic choice, and the instruction to 'always pass project_root as the current working directory' gives call-time guidance. However, it does not explicitly state when to choose this tool over alternatives such as get_firewall_stats.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

query_decisionsA

Search past decisions for context and consistency. Always pass project_root as the current working directory.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
statusNo
keywordNo
categoryNo
project_rootNo.

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. 'Search' reasonably implies a read-only lookup, and the project_root guidance adds an important operational requirement. However, it does not explicitly disclose side-effect freedom, result behavior, or any caveats about how searches are performed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, both purposeful and front-loaded. The primary action and purpose come first, followed by the critical project_root instruction. No fluff or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the tool's purpose and the most important call requirement, and an output schema exists, so return-value documentation is not required. However, with no parameter explanations and no guidance about alternatives like ask_human or check_assumption, the definition has meaningful gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It only clarifies project_root; the meanings of limit, status, keyword, and category are left entirely to inference from their names and defaults. This is a clear gap for a tool with five parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Search past decisions'. It also gives the intent ('for context and consistency'), which clearly distinguishes this read-oriented tool from mutation siblings like confirm_decision and revoke_decision.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'for context and consistency' provides clear context for when to use the tool. It also gives a concrete per-call instruction about project_root. It does not explicitly name alternatives or state when not to use it, so it stops short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

revoke_decisionA

Revoke or supersede a previously approved decision.

Use this when a past decision was wrong, circumstances changed, or it conflicts with new requirements. The decision is marked 'revoked' in the log so future similarity checks ignore it.

Always pass project_root as the current working directory.

ParametersJSON Schema
NameRequiredDescriptionDefault
reasonYes
decision_idYes
project_rootNo.

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It usefully reveals a non-obvious consequence: 'the decision is marked revoked in the log so future similarity checks ignore it.' However, it does not disclose whether revocation is reversible, whether it affects dependent decisions, or what permissions are required, leaving notable gaps for a mutating tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is four short sentences, front-loads the purpose, and includes the core trigger conditions and side effect without any filler. Every sentence contributes meaning, and the project_root instruction is placed at the end as an actionable note.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description gives the essential purpose, usage trigger, key side effect, and a parameter instruction, which is enough to attempt a call. However, parameter semantics are incomplete, and the absence of annotations combined with no mention of reversibility or edge cases makes it only partially complete. The output schema presumably covers return values, so that gap is excused.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for the lack of parameter documentation. It clarifies project_root with 'Always pass project_root as the current working directory', but gives no explanation of decision_id or reason beyond their names. This leaves two of three parameters only implicitly defined.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action ('Revoke or supersede') on a specific resource ('a previously approved decision'), making the tool's core purpose immediately clear. It also differentiates from sibling tools like confirm_decision and query_decisions by focusing on undoing or overriding an existing decision rather than creating or reading one.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use the tool: 'when a past decision was wrong, circumstances changed, or it conflicts with new requirements.' It does not mention when not to use it or name alternative tools, so it stops short of a 5, but the context is clear enough for an agent to select it in most situations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

setup_projectA

Initialize Kontrol Freek for the current project.

Checks if .kontrol-freek.json exists in the project root. If not, analyzes project files to infer a configuration, then asks the human for confirmation before writing the file.

Always pass project_root as the current working directory. Call this at the start of every session in a new project.

ParametersJSON Schema
NameRequiredDescriptionDefault
project_rootNo.

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the behavioral disclosure burden and does it well: it reveals the existence check, the inference step, the human confirmation requirement, and the file-writing side effect. It could add more detail about what happens when the config already exists or what occurs if confirmation is denied, but the key safety-relevant behavior is disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well-structured: main purpose first, then the conditional workflow, then binding usage and parameter instructions. Every sentence contributes actionable information with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with one optional parameter, no annotations, and an output schema available, the description covers the essential usage context: when to call it, what it checks, how it behaves interactively, and how to set its parameter. Nothing critical is missing for an agent to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% and the only parameter, project_root, has no description in the schema. The description compensates by instructing the agent to always pass the current working directory as project_root, which adds real semantic guidance beyond the bare parameter name and default.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Initialize') and resource ('Kontrol Freek for the current project'), and elaborates the flow: check for existing config, infer from project files, confirm with human, write file. This clearly distinguishes setup_project from its sibling tools, none of which perform project initialization.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit timing guidance ('Call this at the start of every session in a new project') and parameter guidance ('Always pass project_root as the current working directory'). It implies the conditional behavior when a config already exists, but does not explicitly state 'do not call if already initialized' or name alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 8 tool updatesv1.2.1
    • First observedask_human
    • First observedcheck_assumption
    • First observedconfirm_decision
    • First observedget_firewall_stats
    • First observedhealthcheck
    • First observedquery_decisions
    • First observedrevoke_decision
    • First observedsetup_project

TDQS

A3.9/5.0

Scored across 8 tools

Disambiguation4/5

Decision-related tools are mostly distinct: check_assumption verifies, confirm_decision records, query_decisions searches, revoke_decision invalidates. Some overlap exists between check_assumption and ask_human since both can involve seeking human input, but their primary purposes remain distinguishable.

Naming Consistency4/5

Most tool names follow a clear verb_noun snake_case pattern: check_assumption, confirm_decision, query_decisions, revoke_decision, get_firewall_stats, setup_project. The single deviation is 'healthcheck', which is a compound noun without an explicit verb separator, but it is still readable and consistent in style.

Tool Count5/5

Eight tools is a well-scoped set for a decision-management server. Each tool has a clear role in the lifecycle, and the count is within the ideal range without redundancy or bloat.

Completeness4/5

The decision lifecycle is well covered: setup, assumption checking, confirmation, querying, revocation, and human escalation are all present. Minor gaps exist, such as no explicit update_decision operation, but revoke_decision handles superseding, and healthcheck/stat tools round out operational coverage.

Maintenance

ActivityInactive
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    A
    maintenance
    An MCP server that enables AI agents to pause and request human approval or information via Slack, Telegram, or macOS dialogs before proceeding with actions.
    2
    15
    Apache 2.0
  • F
    license
    A
    quality
    D
    maintenance
    Governance circuit-breaker MCP server that enables AI agents to request risk-based decisions, approve or deny actions, and finalize outcomes with full audit receipts.
    4
    -
  • A
    license
    Not graded
    quality
    C
    maintenance
    An MCP server that provides on-demand safety for AI coding workflows, enabling inspection, review, checkpointing, and rollback of risky actions.
    9 npm
    1
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    MCP server that provides human-in-the-loop approval for risky AI agent actions, with durable state and audit logs.
    MIT