Kontrol Freek
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Kontrol Freekcheck assumption: use AWS Lambda for deployment"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Kontrol Freek — AI Assumption Firewall for MCP Agents
Kontrol Freek is an open-source Model Context Protocol (MCP) server that acts as an AI safety guardrail for autonomous agents. It intercepts AI assumptions before they cause irreversible mistakes, verifies every decision against a persistent project log, detects contradictions, scores risk, and routes human approval requests through Telegram, Slack, or native MCP elicitation — all without blocking your workflow.
Gate every AI assumption. Keep humans in the loop. Prevent agentic mistakes before they happen.
Why Kontrol Freek?
AI agents and coding assistants make implicit assumptions constantly — about architecture choices, file locations, API designs, and deployment targets. Without a structured checkpoint, these assumptions silently accumulate into hard-to-reverse technical debt or outright mistakes.
Kontrol Freek solves the human-in-the-loop problem for MCP agents: it sits between your AI agent and every risky decision, comparing new assumptions against your project's history, flagging contradictions, and routing approval requests to you — wherever you are.
Kontrol Freek adds a decision firewall between your AI agent and every risky action:
AI: "I'll use PostgreSQL for this project" ← assumption
↓
check_assumption("Use PostgreSQL", risk="medium", category="architecture")
↓
Kontrol Freek: query past decisions → detect contradictions → score risk
↓
├─ Low risk + past approval match → ✅ Auto-approve, continue
├─ Medium risk / new decision → 🔍 Notify human (Telegram / Slack / elicit)
└─ Contradiction or critical risk → ⛔ Block + require explicit approvalRelated MCP server: @vaibot/mcp-server
Key Features
Feature | Description |
Assumption interception | Catches AI guesses before they execute |
SQLite decision log | Persists every decision per project |
Semantic similarity | Finds related past decisions using TF-IDF or sentence-transformers |
Contradiction detection | Blocks decisions that conflict with approved history |
Risk scoring | Adaptive policy engine — auto-approve low risk, gate high risk |
Time-based decay | Old decisions lose weight; prevents stale approvals |
Telegram polling | Background loop processes |
Multi-channel routing | ctx.elicit() → Telegram → Slack → Web dashboard |
HMAC-SHA256 audit trail | Cryptographically signed, hash-chained decision log |
Per-project isolation | Each project gets its own DB, audit log, and config |
MCP native | Works with any MCP-compatible client |
How It Compares
Feature | clarify-mcp | CONTINUITY | mcp-human-loop | VantaGate | Kontrol Freek |
ctx.elicit() support | ✅ | ❌ | ❌ | ❌ | ✅ |
SQLite decision log | ❌ | ✅ | ❌ | ❌ | ✅ |
Risk scoring | ❌ | ❌ | ✅ | ❌ | ✅ |
Semantic similarity | ❌ | ❌ | ❌ | ❌ | ✅ |
Contradiction detection | ❌ | ❌ | ❌ | ❌ | ✅ |
Cryptographic audit trail | ❌ | ❌ | ❌ | ✅ | ✅ |
Time-based decision decay | ❌ | ❌ | ❌ | ❌ | ✅ |
Telegram interactive approval | ❌ | ❌ | ❌ | ❌ | ✅ |
Per-project isolation | ❌ | ❌ | ❌ | ❌ | ✅ |
Adaptive policy engine | ❌ | ❌ | Basic | Static | Adaptive |
Installation
pip (recommended)
pip install kontrol-freek-mcpOne-command setup (macOS / Linux / Windows)
git clone https://github.com/berkbayri/kontrol-freek-mcp.git
cd kontrol-freek-mcp
python install.pyThe installer:
Installs the Python package
Generates a
.envwith a random HMAC secretRegisters a system service (auto-start on boot, crash recovery)
Registers the MCP server with compatible clients automatically
Manual install
pip install -e ".[full]" # Full: Telegram + Web + sentence-transformers embeddings
pip install -e ".[lite]" # Lite: Telegram + Web (no embeddings)
pip install -e . # Minimal: stdio onlyConfiguration
MCP client config
Add to your MCP client's server configuration (mcpServers block):
{
"mcpServers": {
"kontrol-freek": {
"command": "kontrol-freek",
"env": {
"KF_HMAC_SECRET": "your-secret",
"KF_TELEGRAM_TOKEN": "your-bot-token",
"KF_TELEGRAM_CHAT_ID": "your-chat-id"
}
}
}
}Or using python -m if installed without the entry point:
{
"mcpServers": {
"kontrol-freek": {
"command": "python",
"args": ["-m", "kontrol_freek_mcp"],
"env": {
"KF_HMAC_SECRET": "your-secret"
}
}
}
}Per-project config (.kontrol-freek.json)
Place this file in your project root to override global credentials and set a project name:
{
"project_name": "my-app",
"telegram_token": "bot-token-override",
"telegram_chat_id": "chat-id-override",
"slack_webhook": ""
}Per-project config is detected automatically — no restart required when the file changes.
HTTP server mode (remote / multi-user)
kontrol-freek --transport streamable-http --port 8765{
"mcpServers": {
"kontrol-freek": {
"transport": "streamable-http",
"url": "http://localhost:8765/mcp"
}
}
}Telegram Setup
Message @BotFather →
/newbot→ copy the tokenStart a DM with your bot or add it to a group
Get your chat ID:
https://api.telegram.org/bot<TOKEN>/getUpdatesSet credentials in
.envor.kontrol-freek.json
Telegram commands
/kf approve <id> Approve a pending assumption
/kf reject <id> [reason] Reject with an optional reason
/kf answer <id> <answer> Answer a direct questionKontrol Freek runs a background long-poll loop — no webhook setup needed. Commands are processed in real time while the MCP server is running.
MCP Tools Reference
Always pass project_root as your current working directory so decisions are isolated per project.
Tool | When to use |
| At every decision point — architecture, file paths, API choices, etc. |
| To record a finalized decision; set |
| When genuinely uncertain — prompts human via Telegram/Slack/elicitation |
| At the start of a task — load prior context before making new decisions |
| When a past decision is no longer valid — prevents it from influencing future auto-approvals |
| View approval rates, total decisions, and activity by category |
| Verify DB, audit chain, and notification channel health |
| Initialize per-project config on first use |
check_assumption response statuses
Status | Meaning | Agent should… |
| Low risk, matches prior approved decision | Proceed |
| Human review recommended (architecture / security / deployment) | Proceed with caution — call |
| Contradiction detected or critical risk | Stop — do not proceed without explicit human approval |
| Human approved via Telegram/Slack | Proceed |
| Human rejected | Stop and reconsider |
How It Works
Decision flow
AI calls check_assumption(assumption, risk_level, category, project_root)
│
├── Query SQLite for similar past decisions
├── Compute semantic similarity score (TF-IDF or sentence-transformers)
├── Run contradiction analysis
├── Policy engine → auto_approve / review / block
│
├── auto_approve → log, return status: "auto_approved"
├── pending_review → log, return status: "pending_review" (non-blocking)
│ optionally notify Telegram/Slack in background
└── block → log, return status: "blocked"
if Telegram/Slack configured → notify + wait (3 min max)
│
├── Telegram bot (/kf approve/reject <id>)
└── Slack webhook (text instructions)Policy rules
Condition | Verdict |
| ⛔ Block — always requires human approval |
Contradiction with approved decision | ⛔ Block |
Category: | 🔍 Human review |
Low risk + ≥78% similarity + prior approval | ✅ Auto-approve |
| 🔍 Human review |
Default | 🔍 Human review |
Time-based decision decay
Older decisions carry less weight in similarity matching, preventing stale approvals from auto-approving new assumptions:
Age | Weight |
0 days | 1.00 |
30 days | 0.72 |
90 days | 0.37 |
180 days | 0.14 |
Cryptographic audit trail
Every action is written to an HMAC-SHA256 signed, hash-chained JSONL file:
{
"action": "human_approve",
"text": "Use PostgreSQL",
"detail": "Approved via Telegram",
"decision_id": 42,
"ts": "2025-01-15T14:30:00Z",
"prev": "a1b2c3...",
"hash": "d4e5f6..."
}Verify audit chain integrity:
from kontrol_freek_mcp.audit import AuditTrail
trail = AuditTrail("~/.kontrol-freek/projects/my-app/audit.jsonl", "your-secret")
valid, count = trail.verify_chain()
print(f"Chain valid: {valid} — {count} entries")Auto-Start & Crash Recovery
python install.py configures an OS-native service:
Platform | Mechanism | Details |
macOS | LaunchAgent |
|
Linux | systemd user service |
|
Windows | Task Scheduler |
|
The wrapper script includes exponential backoff (5s → 10s → 20s → ..., max 10 restarts).
python install.py --status # Health check
python install.py --uninstall # Clean removalProject Structure
kontrol-freek-mcp/
├── src/kontrol_freek_mcp/
│ ├── server.py # MCP server — 7 tools, 2 resources, 1 prompt
│ ├── db.py # SQLite decision database
│ ├── policy.py # Adaptive policy engine (risk scoring, decay)
│ ├── similarity.py # Semantic similarity (TF-IDF + sentence-transformers)
│ ├── notifier.py # Multi-channel routing + Telegram polling loop
│ ├── audit.py # HMAC-SHA256 hash-chain audit trail
│ └── web.py # FastAPI approval dashboard
├── tests/
├── install.py # One-command installer
├── pyproject.toml
├── .env.example
└── README.mdLicense
MIT — free to use, modify, and distribute.
Available Tools
8 toolsask_humanB
Ask the human a direct question and wait for their response. Call this whenever uncertain. Always pass project_root as the current working directory.
| Name | Required | Description | Default |
|---|---|---|---|
| context | No | ||
| options | No | ||
| urgency | No | normal | |
| question | Yes | ||
| project_root | No | . |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of behavioral disclosure. It does disclose that the tool asks a question and blocks until the human responds, which is important interactive behavior. However, it does not explain what happens with options or urgency, whether the call pauses execution, or what the human's response means beyond being returned.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler. The purpose, trigger condition, and an important parameter instruction are all front-loaded. Every sentence earns its place, and the description is easy to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the essential flow and project_root, but with five parameters, no schema descriptions, and no annotations, it leaves context, options, and urgency undefined. The output schema existing helps with return values, but parameter semantics remain materially incomplete for effective agent use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for the undocumented parameters. It adds meaning for project_root ('Always pass project_root as the current working directory') and implicitly for question, but context, options, and urgency are entirely unexplained. The compensation is partial at best.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('Ask'), the resource ('the human'), and the behavior ('wait for their response'), making the tool's core function obvious. It does not explicitly contrast with sibling tools like confirm_decision or check_assumption, but the 'direct question' framing distinguishes it from assumption-checking and confirmation workflows.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit guidance: 'Call this whenever uncertain.' This is a clear condition for use, though it does not specify when not to use the tool or name alternatives such as confirm_decision or check_assumption. That keeps it at a 4 rather than a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
check_assumptionA
Verify an assumption against past decisions. Checks for contradictions, scores risk, and requests human approval when needed.
ALWAYS pass project_root as the current working directory so decisions are stored per-project and not mixed across projects.
The AI MUST call this at every decision point:
When guessing instead of using confirmed info
When choosing between multiple valid options
When the choice might contradict a previous decision
Before any hard-to-reverse step
| Name | Required | Description | Default |
|---|---|---|---|
| context | No | ||
| category | No | general | |
| assumption | Yes | ||
| risk_level | No | medium | |
| alternatives | No | ||
| project_root | No | . |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It discloses that the tool checks contradictions, scores risk, requests human approval, and stores per-project decisions. Still, it does not explain what happens after approval, whether the tool can block execution, or what side effects it has beyond requesting approval.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is reasonably concise and well-structured: a summary sentence, a critical parameter directive, then bulleted usage triggers. The 'MUST call at every decision point' framing is slightly repetitive with the following bullets, but overall it earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The usage context is strong: the description clearly says when to invoke the tool and stresses per-project storage via project_root. However, with no annotations and 0% schema coverage, the missing parameter semantics and ambiguity around the approval/contradiction flow leave the agent under-informed for a 6-parameter tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for six parameters. It only explicitly explains project_root and implies assumption; context, category, risk_level, and alternatives receive no semantic guidance. This is a significant gap for an agent deciding how to populate those fields.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Verify an assumption against past decisions.' It clearly distinguishes the tool from siblings by adding behavioral details—checks for contradictions, scores risk, and requests human approval—which separates it from query_decisions and ask_human.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit trigger conditions with 'The AI MUST call this at every decision point' and a bulleted list of when to use it. It also gives a mandatory project_root instruction. However, it does not name sibling alternatives or provide when-not-to-use guidance, so it falls short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
confirm_decisionA
Record a finalized decision. Irreversible decisions always require human approval. Always pass project_root as the current working directory.
| Name | Required | Description | Default |
|---|---|---|---|
| category | No | general | |
| decision | Yes | ||
| rationale | Yes | ||
| project_root | No | . | |
| is_irreversible | No | ||
| alternatives_considered | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses an important behavioral constraint—irreversible decisions require human approval—and the project_root requirement. It does not explain what happens when approval is missing, whether the record is persisted, or what the response is, so transparency is partial.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler: the first states the primary purpose, and the second packs two critical usage constraints. The structure front-loads the main action and keeps necessary operational details compact.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given six parameters and no annotations or output schema, the description covers the most decision-relevant behaviors but leaves gaps. It does not describe the approval workflow, the persistence or result of recording, or how this tool relates to ask_human and revoke_decision, so an agent still has to infer part of the invocation context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds meaning to project_root ('current working directory') and is_irreversible ('requires human approval'), which the bare schema does not convey. However, it does not clarify category, alternatives_considered, or the required decision and rationale fields beyond their names.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('Record') and a specific object ('a finalized decision'), making the tool's core purpose clear. It is distinguishable from siblings like query_decisions and revoke_decision, though it does not explicitly name them or contrast with them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides useful situational guidance: irreversible decisions require human approval, and project_root must be passed as the current working directory. However, it does not explicitly state when to choose this tool over query_decisions, revoke_decision, or ask_human, leaving the selection partly implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_firewall_statsA
Return firewall statistics for the current project. Always pass project_root as the current working directory.
| Name | Required | Description | Default |
|---|---|---|---|
| project_root | No | . |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
There are no annotations, so the description carries the behavioral burden. 'Return' implies a read-only operation and the project_root instruction adds procedural context, but it does not disclose potential side effects, permission requirements, or whether statistics are cumulative or reset.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler. The core purpose is front-loaded and the critical invocation instruction is concise and actionable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-optional-parameter tool with an output schema, the description covers the essential invocation detail and return purpose. It does not discuss when to call it or edge cases, but the low complexity and output schema reduce that need.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must clarify the parameter. It explains that project_root should be set to the current working directory, which adds meaning beyond the raw schema and default value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Return') and resource ('firewall statistics') with a clear scope ('current project'). It is unambiguous and naturally distinguishes from unrelated siblings like check_assumption and healthcheck.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides explicit invocation guidance: 'Always pass project_root as the current working directory.' It does not name alternatives or exclusions, but no sibling tool performs a comparable function, so the guidance is sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
healthcheckA
Full health check — DB, audit chain, channels. Always pass project_root as the current working directory.
| Name | Required | Description | Default |
|---|---|---|---|
| project_root | No | . |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
As no annotations are provided, the description carries the behavioral disclosure burden. It discloses the scope (DB, audit chain, channels) and the working-directory prerequisite, which are useful. But it does not explicitly state side effects, whether it is read-only, or what happens on failure, leaving some behavioral ambiguity.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences accomplish everything: the first defines the tool's scope, the second gives the key parameter requirement. There is no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter health check with an output schema, the description covers the essential invocation details and scope. It could be more complete by noting any environmental prerequisites beyond CWD, but nothing critical is missing for basic use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage and only one optional parameter, the description compensates by explaining how to set project_root: 'Always pass project_root as the current working directory.' This adds concrete meaning beyond the schema's bare string type and default.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description states 'Full health check — DB, audit chain, channels,' naming a clear action and the specific resources it covers. This distinguishes it from sibling tools like get_firewall_stats, which target a narrower metric. The scope is concise and immediately understandable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The 'Full health check' phrasing implies it is the comprehensive diagnostic choice, and the instruction to 'always pass project_root as the current working directory' gives call-time guidance. However, it does not explicitly state when to choose this tool over alternatives such as get_firewall_stats.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
query_decisionsA
Search past decisions for context and consistency. Always pass project_root as the current working directory.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| status | No | ||
| keyword | No | ||
| category | No | ||
| project_root | No | . |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. 'Search' reasonably implies a read-only lookup, and the project_root guidance adds an important operational requirement. However, it does not explicitly disclose side-effect freedom, result behavior, or any caveats about how searches are performed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, both purposeful and front-loaded. The primary action and purpose come first, followed by the critical project_root instruction. No fluff or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the tool's purpose and the most important call requirement, and an output schema exists, so return-value documentation is not required. However, with no parameter explanations and no guidance about alternatives like ask_human or check_assumption, the definition has meaningful gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It only clarifies project_root; the meanings of limit, status, keyword, and category are left entirely to inference from their names and defaults. This is a clear gap for a tool with five parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Search past decisions'. It also gives the intent ('for context and consistency'), which clearly distinguishes this read-oriented tool from mutation siblings like confirm_decision and revoke_decision.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'for context and consistency' provides clear context for when to use the tool. It also gives a concrete per-call instruction about project_root. It does not explicitly name alternatives or state when not to use it, so it stops short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
revoke_decisionA
Revoke or supersede a previously approved decision.
Use this when a past decision was wrong, circumstances changed, or it conflicts with new requirements. The decision is marked 'revoked' in the log so future similarity checks ignore it.
Always pass project_root as the current working directory.
| Name | Required | Description | Default |
|---|---|---|---|
| reason | Yes | ||
| decision_id | Yes | ||
| project_root | No | . |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It usefully reveals a non-obvious consequence: 'the decision is marked revoked in the log so future similarity checks ignore it.' However, it does not disclose whether revocation is reversible, whether it affects dependent decisions, or what permissions are required, leaving notable gaps for a mutating tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is four short sentences, front-loads the purpose, and includes the core trigger conditions and side effect without any filler. Every sentence contributes meaning, and the project_root instruction is placed at the end as an actionable note.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description gives the essential purpose, usage trigger, key side effect, and a parameter instruction, which is enough to attempt a call. However, parameter semantics are incomplete, and the absence of annotations combined with no mention of reversibility or edge cases makes it only partially complete. The output schema presumably covers return values, so that gap is excused.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for the lack of parameter documentation. It clarifies project_root with 'Always pass project_root as the current working directory', but gives no explanation of decision_id or reason beyond their names. This leaves two of three parameters only implicitly defined.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('Revoke or supersede') on a specific resource ('a previously approved decision'), making the tool's core purpose immediately clear. It also differentiates from sibling tools like confirm_decision and query_decisions by focusing on undoing or overriding an existing decision rather than creating or reading one.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use the tool: 'when a past decision was wrong, circumstances changed, or it conflicts with new requirements.' It does not mention when not to use it or name alternative tools, so it stops short of a 5, but the context is clear enough for an agent to select it in most situations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
setup_projectA
Initialize Kontrol Freek for the current project.
Checks if .kontrol-freek.json exists in the project root. If not, analyzes project files to infer a configuration, then asks the human for confirmation before writing the file.
Always pass project_root as the current working directory. Call this at the start of every session in a new project.
| Name | Required | Description | Default |
|---|---|---|---|
| project_root | No | . |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the behavioral disclosure burden and does it well: it reveals the existence check, the inference step, the human confirmation requirement, and the file-writing side effect. It could add more detail about what happens when the config already exists or what occurs if confirmation is denied, but the key safety-relevant behavior is disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and well-structured: main purpose first, then the conditional workflow, then binding usage and parameter instructions. Every sentence contributes actionable information with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with one optional parameter, no annotations, and an output schema available, the description covers the essential usage context: when to call it, what it checks, how it behaves interactively, and how to set its parameter. Nothing critical is missing for an agent to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% and the only parameter, project_root, has no description in the schema. The description compensates by instructing the agent to always pass the current working directory as project_root, which adds real semantic guidance beyond the bare parameter name and default.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Initialize') and resource ('Kontrol Freek for the current project'), and elaborates the flow: check for existing config, infer from project files, confirm with human, write file. This clearly distinguishes setup_project from its sibling tools, none of which perform project initialization.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit timing guidance ('Call this at the start of every session in a new project') and parameter guidance ('Always pass project_root as the current working directory'). It implies the conditional behavior when a config already exists, but does not explicitly state 'do not call if already initialized' or name alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
8 tool updates
v1.2.1- First observed
ask_human - First observed
check_assumption - First observed
confirm_decision - First observed
get_firewall_stats - First observed
healthcheck - First observed
query_decisions - First observed
revoke_decision - First observed
setup_project
TDQS
Scored across 8 tools
Decision-related tools are mostly distinct: check_assumption verifies, confirm_decision records, query_decisions searches, revoke_decision invalidates. Some overlap exists between check_assumption and ask_human since both can involve seeking human input, but their primary purposes remain distinguishable.
Most tool names follow a clear verb_noun snake_case pattern: check_assumption, confirm_decision, query_decisions, revoke_decision, get_firewall_stats, setup_project. The single deviation is 'healthcheck', which is a compound noun without an explicit verb separator, but it is still readable and consistent in style.
Eight tools is a well-scoped set for a decision-management server. Each tool has a clear role in the lifecycle, and the count is within the ideal range without redundancy or bloat.
The decision lifecycle is well covered: setup, assumption checking, confirmation, querying, revocation, and human escalation are all present. Minor gaps exist, such as no explicit update_decision operation, but revoke_decision handles superseding, and healthcheck/stat tools round out operational coverage.
Maintenance
Related MCP Connectors
MCP server for AI agents to plan, verify, and deploy Cloudflare-native apps.
Zero-secret MCP gateway for AI agents: risk-scored, audited calls with human-in-the-loop approval.
MCP enforcement layer that intercepts AI agent actions and blocks rule violations before execution.
AI governance MCP server for EU AI Act compliance and jurisdiction verification
Related MCP Servers
- AlicenseAqualityAmaintenanceAn MCP server that enables AI agents to pause and request human approval or information via Slack, Telegram, or macOS dialogs before proceeding with actions.215Apache 2.0

@vaibot/mcp-serverofficial
FlicenseAqualityDmaintenanceGovernance circuit-breaker MCP server that enables AI agents to request risk-based decisions, approve or deny actions, and finalize outcomes with full audit receipts.4-- AlicenseNot gradedqualityCmaintenanceAn MCP server that provides on-demand safety for AI coding workflows, enabling inspection, review, checkpointing, and rollback of risky actions.9 npm1MIT
- AlicenseNot gradedqualityCmaintenanceMCP server that provides human-in-the-loop approval for risky AI agent actions, with durable state and audit logs.MIT