LiuHe
An LLM-native, task-stateful MCP toolkit for safe code operations — plan, read, edit atomically, verify, review, and audit a workspace with reversibility and optimistic concurrency built in.
Plan a change —
code_taskturns a goal (+ optional file/symbol/line anchor) into candidates, structure, and blast radius, and assigns a route (understand/change/diagnose/review/…).Read before editing —
code_readreturns file/symbol content plus aread_refversion anchor;code_querydoes task-free lookups (outline, symbols, body, map, search, references, callers, callees, impact, tests, validate).Edit atomically and reversibly —
code_patch(any text file, dry-run preview default),code_batch(N files, all-or-nothing),edit_transaction(multi-file with rollback/undo journal); all support create, replace_symbol, patch, idempotency keys.Verify with evidence —
code_checkruns test/typecheck/lint, previews exact commands, and records results as task evidence;async: truehandles long suites.Audit read-only —
code_auditruns code review, security, exception/guard patterns, dependency, config drift, dead code, and quality checks over touched files or any scope, with accept/ledger workflow.Maintain code —
code_maintainfixes missing/unused imports (preview then apply) and flags dead code without deleting it.Track state —
code_statusshows what a task changed (state, files, evidence);code_controlhandles status/resume/cancel/reopen/expand/switch_route and background jobs.Land risky changes safely —
code_worktreeapplies edits in a temp git worktree, gates on a verify command, and fast-forwards into the current branch only on pass.Reach everything else —
invoke_capabilitydelegates to any tool by exact name (with dedup/idempotency);code_querymode=capabilities/capability discovers the full catalog.Guardrails throughout — optimistic concurrency (
expected_state_revision,read_refbase versions),allow_unsafe_no_basegate, dry-run defaults, journaled undo, workspace-scoped absolute paths.
Provides Git-based change management: applies edits in a temporary git worktree, runs a verification command, and only fast-forwards the commit into the current branch on success; also supports isolated branch worktrees with verification and merge.
Malong LiuHe(码龙·六合工具)
LLM-Native Code Operations Toolkit — Code tooling reinvented for the LLM that has no hands, no eyes, and no memory.
English | 简体中文 | Docs | GitHub
Malong LiuHe is a toolkit built for LLMs rather than humans. It ships two components:
malong/— an MCP toolset whose default tier is the Six-He line (13 tools:code_task → code_read → code_patch / code_batch → code_check → code_control, with task state, evidence and structurednext_actionhand-back built in); the classic full catalog (44) and the diagnostic tier (18) are one env away —MALONG_INTERFACE=classic/MALONG_INTERFACE=diagnostic. The catalog spans symbol read/write, indexing, impact analysis, reference tracing, call graphs, dead-code detection, code review, security scanning, atomic batch editing, test orchestration, pipeline verification, plus capability discovery (code_querymode=capabilities/capability) and the ADR-018 full-call outlet (invoke_capability) — served to the LLM over MCP (JSON-RPC over stdio). Since 0.5.24 the Six-He line is the default; classic remains the full catalog.malong-parse/— a Rust parsing service: a tree-sitter-based multi-language symbol extraction engine (JavaScript/TypeScript/TSX/Python/Go/Rust/C/C++/Java/Bash), talking to the toolset over a Unix socket, with an LRU tree cache and batched parallel extraction.
Core Idea
Traditional tools (git, sed, IDE) assume a user with hands, eyes, and memory. An LLM has none of these. Malong LiuHe is redesigned around that fact:
Missing | Design Consequence |
No hands | Operations must be atomic, undoable, retryable ( |
No eyes | Output must be structured and self-explanatory (JSON for direct consumption; errors carry |
No memory | Every call is self-contained (takes |
Related MCP server: mcp-reposkein
Performance (Measured)
Metric | Value | Note |
Small-file read P95 | 1ms | 50 runs, warmed |
Small-file write P95 | 7ms | 30 runs, incl. post-write re-index |
| 98ms | down from tens of seconds (SQLite index + Rust parsing) |
Memory | RSS 134MB / 26% | under a real docker |
Concurrency | 128 concurrent / 256 in-flight requests, zero OOM | 32-way mixed read+write on one hot file, no tearing, DB |
Throughput | ~588 calls/s | single-threaded ceiling — 60–600× real LLM demand |
Token estimate (fixed-path) | ↓65.3% | scripted |
Call reduction (fixed-path) | ↓50.0% | 6 calls (legacy chain) → 3 calls (primitives); same scripted path |
Tool-description compression | 44 classic tools ≈ 1.33k tokens | tiered: core kept, low-freq ≤70 chars, verbose ≤230; detail flows via next_step hints |
Default-tier catalog tax (per turn) | 13 tools = 16.5 KB ≈ 4.86k tokens | descriptions 2.0 KB (≈0.60k) + inputSchema 14.5 KB (≈4.26k) — the schema is 88% of it; to shrink the catalog, cut the parameter surface, not the prose |
Index throughput | 538 files / 7s | scoped reindex, measured |
dry_run fidelity | 47/47 | golden-hash comparison across 3 languages, 100% |
Concurrent writes to same symbol | 16/16 | exactly one winner + one conflict, zero silent overwrites |
Language Support
Language | Symbol Extraction | Reference Extraction |
JavaScript / TypeScript / TSX / JSX / MTS / CTS | ✓ | ✓ |
Python | ✓ | ✓ |
Go | ✓ | ✓ |
Rust (impl blocks / trait / enum semantics) | ✓ | ✓ |
C / C++ (incl. headers) | ✓ | ✓ |
Java | ✓ | ✓ |
Bash | ✓ | ✓ |
Tool Overview
Category | Tools |
Six-He line (graph + stateful — recommended daily entry) |
|
I/O primitives |
|
Index & search |
|
Analysis |
|
Editing |
|
Quality gates |
|
Engineering |
|
System |
|
Long test suites must run in the background. The MCP request has a hard 120s ceiling and a foreground stage is capped at 110s, so a suite that takes minutes is reported as
failed— that is a request-budget truncation, not a code defect. Run it as a background job instead:code_checkwithrun: true, async: true(600s cap), then poll withcode_control(action="job").
Architecture
┌─────────────────────────┐ ┌──────────────────────────────┐
│ LLM Client (MCP) │ │ malong-parse (Rust daemon) │
│ malong/ 13 six-he │◄───►│ tree-sitter, 10 languages │
│ (+44/18 gated) │ │ LRU tree cache 50MB / batch │
│ Unix socket client │ │ catch_unwind crash recovery │
└─────────────────────────┘ └──────────────────────────────┘All parsing is done by the Rust service (zero tree-sitter bindings on the Node side)
Index is SQLite (WAL mode, multi-process safe), isolated per workspace
LRU tree cache (50MB / 5min TTL), batched extraction 50 files/batch
Daemon multi-session safety: circuit breaker + liveness probe + cross-session coordinated restart (O_EXCL lock) — a slow request in one session never stalls others
Self-Hosting (Dogfooding)
30+ rounds of "Malong reviews Malong": the toolset audits and fixes its own code, with dozens of real bugs fixed and locked by tests — including directory-scope filtering gaps, false dead-code reports for registration patterns, lost constant read-sites, and SQL parameterization cleanup. Every round grew the suite (now 166 JS test files, full chain 0 failures). Latest round (r5): cross-file reference resolution is now import-aware — member calls such as path.join no longer bind to same-named local symbols (216 false bindings in this repo alone), cross-language (Python↔JS) links are blocked by a language-family filter, and aliases resolve through the import graph (ESM specifier scanning added on the JS side) — locked by test-crossfile-resolve (14 assertions, red→green); the DSH bridge also now pins MALONG_STATE_DIR when spawning the server, locked by test-dsh-bridge.
Scan Boundaries (limits acknowledged; committed within)
Deterministic scanners only — regex pattern matching and reference graphs. No control-flow, data-flow, or cross-module semantic coverage. 0 findings ≠ clean; high scores ≠ healthy.
security_reviewscans: injection (eval/Function-ctor, exec/spawn string building, template${},$()substitution, SQL concat), XSS, hardcoded secrets, CORS *, timing/insecure compare, dotenv. Not scanned: SSRF, XXE, deserialization, auth/logic flaws, control-flow defects.sweep_dead_codereference scope: import graph + fixed text-ref fallback (.sh/.json/.md etc.); CLI-string references count as alive (miss-over-delete). Not scanned: dynamic/reflection wiring.Commitment: issues in scope get fixed; covered patterns are test-locked; new rules must stay within committed categories.
Quick Start
Standard install (default — recommended)
npm ci installs better-sqlite3 (the full SQLite backend); this is the default recommended path:
# 1) Get the parsing daemon — download a prebuilt binary from releases/, or build:
cd malong-parse && cargo build --release && cp target/release/malong-parse ~/.local/bin
malong-parse & # start the daemon (Unix socket)
# 2) Install the toolset (npm ci installs the full better-sqlite3 backend)
cd ../malong && npm ci
# 3) Register the MCP server (works with any MCP client, e.g. opencode / Claude Desktop)
# opencode (project-root opencode.json; Windows paths use double backslashes, Linux/macOS forward slashes):
# {
# "mcp": { # opencode V2 native: servers grouping (V1 used direct mcp.<name>)
# "servers": {
# "malong": {
# "type": "local",
# "command": ["node", "--max-old-space-size=512", "N:\\repo\\liuhe\\malong\\mcp-server.js", "--workspace", "N:\\repo\\liuhe"],
# # default since 0.5.24 = Six-He line (13 tools); this block is optional now — delete it for the classic 44 catalog
# "environment": { "MALONG_INTERFACE": "graph", "MALONG_ENTRY_STATE": "1" }
# }
# }
# }
# }
# Claude Desktop (verified on Windows: %APPDATA%\Claude\claude_desktop_config.json):
# {
# "mcpServers": {
# "malong": { "command": "node", "args": ["/path/to/malong/mcp-server.js"], "env": { "MALONG_INTERFACE": "graph", "MALONG_ENTRY_STATE": "1" } }
# }
# }
# 4) Ask your LLM: "search for the symbol 'handle' in my workspace"
# DeepSeek Harness (dsh web) — auto session-workspace convenience (extra, optional):
# Run once on the dsh host (Linux/macOS):
# Option A (npm, one line — full backend + platform binary included):
# dsh plugin --profile web add @jieai/dsh-malong-bridge
# pkill -f "dsh web"; dsh web --port 3456 --host 0.0.0.0 --trusted-host <LAN IP>
# Option B (script, points at a checkout of this repo):
# bash malong/dsh/install-dsh.sh # idempotent; edits ~/.dsh/profiles/web/cordis.patch.yml with backup
# The bridge exposes the Six-He line (13 tools: code_task/code_read/code_patch/...) as malong__* and auto-fills workspace_dir from the
# current conversation's workspace (no per-call path needed; explicit paths still win).
# Need the classic full catalog (44) or the diagnostic tier (18)? export MALONG_INTERFACE=classic|diagnostic on the dsh host.
# Full guide incl. index rules: malong/dsh/DSH-INTEGRATION.md
# Troubleshooting: if EVERY malong__* call hangs until timeout, the bridge's
# mcp-server subprocess is gone. The bridge now auto-restarts it (exponential
# backoff, pending calls fail fast with "restarting — retry shortly"); if that
# keeps failing, restart dsh web: kill <dsh web pid> && dsh web --port 3456 ...SQL backend note: the default is the full
better-sqlite3backend. Ifnpm installfails (offline / no build toolchain / Node < 20), the server automatically degrades to the vendored sql.js WASM sandbox backend (malong/vendor/, zero-dependency, no network) — the startup log shows which backend is active and the upgrade command. Data files are fully compatible between backends (both are SQLite).
Zero-build deployment (degraded path: sandbox / offline environments)
For environments with Node >= 20 and no npm access (no npm ci, no native
compilation), everything runs from the repo files as-is (Linux/Windows — the
prebuilt binaries are linux-x86_64 and windows-x86_64). On this path SQLite
runs on the sql.js sandbox backend (degraded):
# 0) Clone, then enter the toolset directory:
git clone <repo-url> liuhe && cd liuhe/malong
# 1) Parse daemon — prebuilt binary from releases/ (no cargo needed):
mkdir -p ~/.local/bin
tar -xzf ../releases/malong-liuhe-0.5.29-linux-x86_64.tar.gz
cp malong-parse/target/release/malong-parse ~/.local/bin
malong-parse & # start the daemon (socket: /tmp/malong-parse-$UID.sock)
# 2) Run the toolset — zero npm install:
node --max-old-space-size=4096 mcp-server.js --workspace /path/to/project
# vendored SQLite (sql.js WASM) auto-enabled when better-sqlite3 is unavailable
# 3) Self-check (30s, optional):
node tests/test-db-adapter.js # 22 assertions: sql.js backend + persistence
node tests/test-mcp-server.js # 37 assertions: MCP stdio + daemon round-tripWindows users: use
malong-liuhe-0.5.29-windows-x86_64.tar.gzfrom GitHub Releases (containsmalong-parse.exe), extract and put it on PATH; the MCP server auto-starts the daemon, so step 1'smalong-parse &is not required. Themkdir -p/tar -xzfabove are Unix syntax — on Windows use any extractor (tar -xzfworks on Win10+).
Note: if the daemon is not running, parse-dependent tools (symbol extraction etc.) degrade; the SQLite-backed tools (repo-map / code-index / health-check) still work.
See
THIRD_PARTY_NOTICES.mdfor the vendored component.
What the LLM sees back:
{
"results": [
{ "name": "handle", "type": "function", "start_line": 6, "end_line": 12, "file": "app.js" },
{ "name": "handle_login", "type": "function", "start_line": 5, "end_line": 9, "file": "src/auth.py" }
],
"count": 2,
"next_step": "Before modifying found symbols, check blast radius: impact_analysis(...)"
}Build the Rust parsing service
cd malong-parse
cargo build --release
cp target/release/malong-parse ~/.local/bin/ # or add to PATH
malong-parse & # daemon (Unix socket: /tmp/malong-parse-$(id -u).sock)Prebuilt binaries for Linux x86_64 are committed under
releases/ (with .sha256 checksums) — pick one up instead of building if you prefer.
Platforms: Linux and macOS use the Unix socket; on Windows the daemon listens on TCP 127.0.0.1:31001 (set MALONG_PORT to override) — the MCP server probes and auto-starts malong-parse.exe on startup, so no manual launch is needed (if you use the parse-client API directly outside MCP, start it manually). Set MALONG_SOCKET to override the Unix socket path.
Install the toolset
cd malong
npm ci
npm test # 166 test files (daemon must be running)Start the MCP server
cd malong
node --max-old-space-size=512 mcp-server.js --workspace /path/to/projectRegister the MCP server with any MCP-capable LLM client and the tools become available. For opencode, register in the project root opencode.json (the environment block is optional since 0.5.24 — the default tier already is the Six-He line, 13 tools; set MALONG_INTERFACE=classic for the classic 44-tool catalog):
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"servers": {
"malong": {
"type": "local",
"command": ["node", "--max-old-space-size=512", "malong/mcp-server.js", "--workspace", "."],
"environment": { "MALONG_INTERFACE": "graph", "MALONG_ENTRY_STATE": "1" }
}
}
}
}Windows note: relative paths in
--workspaceandmalong/mcp-server.jsresolve against the directory where opencode is launched; pass absolute paths (escape backslashes as\\in JSON) if you start it elsewhere. The daemon is auto-started by the MCP server — no need to launchmalong-parse.exemanually.
For opencode V2 details — config shape, tool visibility (codemode), and troubleshooting — see malong/opencode/OPENCODE-V2.md.
Configuration (environment variables)
All optional — sensible defaults apply when unset.
Variable | Default | Purpose |
|
| Root of MCP state since 0.5.0: workspace indexes ( |
| unset | Set to |
|
| Unix socket path to the parse daemon (Linux / macOS). |
|
| TCP port for the parse daemon (Windows). |
| npm platform pkg / | Binary used when the client auto-starts the daemon. Resolution order: this env → |
| rust-service | Parse transport. Only |
|
| Days a workspace index cache may sit untouched before |
|
| Tool tier. Default (unset) = the Six-He line (13 tools: |
| on | The state layer (S1–S5 task state machine + ADR-018 |
| unset | Explicit interpreter for Python test runs ( |
Suppressing security false positives
security_review is deliberately conservative, so benign patterns (a hash used as a cache key, process.exit in a CLI entry) can trip it. Two explicit, auditable suppression mechanisms exist — neither ever auto-suppresses injection rules.
Inline — append malong-ignore to a line to suppress all findings on it, or malong-ignore[eval,exec-cmd] for specific rules (a reason after : is encouraged):
const id = crypto.createHash('md5').update(p).digest('hex') // malong-ignore: cache-dir name, not securityConfig — add a securityIgnore array to .ai-patterns.json (the same file guard_patterns reads). Each entry takes files (* / ** globs) and/or rules; omit one side to match all:
{ "securityIgnore": [ { "files": ["**/mcp-server.js"], "rules": ["process-exit"] } ] }Suppressed findings are dropped from the score but counted in the summary's suppressed field, so nothing is hidden silently. Injection rules (eval / exec / SQL / spawn) are only ever suppressed by an explicit marker or entry you authored — never heuristically.
Journal auto-cleanup
Every safe write (write_symbol / write_symbols / edit_batch) leaves an undo journal under .malong/journal/. Terminal transactions (committed / rolled_back / abandoned / failed) older than a TTL (default 24h, configurable) are pruned automatically — throttled to at most one scan per hour per workspace, so it costs nothing. In-flight (created / staged) and needs_review (external change awaiting human review) journals are never auto-deleted. This only ever touches the tool's own rollback backups — never your source files.
Using with Claude Code
Verified end-to-end with Claude Code 2.x. The MCP layer is standard JSON-RPC over stdio, so any MCP client (Claude Code, codex, opencode, Claude Desktop…) connects the same way.
1) Prerequisites — Node >= 20 and the parsing daemon running (see the Zero-build deployment or Build the Rust parsing service sections above).
2) Install Claude Code
npm install -g @anthropic-ai/claude-code3) Point Claude Code at an Anthropic-compatible provider
Claude Code needs an LLM backend. Any Anthropic-compatible endpoint works — set the
variables below (or manage them with cc-switch):
export ANTHROPIC_BASE_URL="https://your-provider/anthropic" # any Anthropic-compatible endpoint
export ANTHROPIC_AUTH_TOKEN="your-api-key" # never commit this
export ANTHROPIC_MODEL="your-model" # a model your provider servesWith
cc-switch:npm i -g @cc-switch/cli,cc-switch new my-provider(fill in the sameANTHROPIC_*keys underenv),cc-switch switch my-provider, theneval $(cc-switch export).
4) Register the MCP server
claude mcp add liuhe -- node /path/to/malong/mcp-server.js --workspace /path/to/project
claude mcp list # → "liuhe … ✔ Connected"5) Use it — start claude in your project and ask, or run headless:
claude -p "index the workspace with reindex, then find createDb with symbol_search" \
--allowedTools "mcp__liuhe__reindex" "mcp__liuhe__symbol_search"Tools are exposed as mcp__liuhe__<tool> (e.g. mcp__liuhe__health,
mcp__liuhe__symbol_search, mcp__liuhe__repo_map). Run reindex (optionally
blocking=true) once per workspace first, so symbol search / impact analysis have
an index to query.
Using with codex
Verified end-to-end with codex (same JSON-RPC-over-stdio MCP layer).
Version note: recent codex releases force the OpenAI Responses API (
wire_api = "responses"). Use a version that still supportswire_api = "chat"together with MCP — verified with 0.50.0:npm install -g @openai/codex@0.50.0.
1) Prerequisites — Node >= 20 and the parsing daemon running (see above).
2) Configure ~/.codex/config.toml — point codex at any OpenAI-compatible
provider (example below: OpenCode Zen) and register the MCP
server:
model = "deepseek-v4-flash"
model_provider = "opencode-zen"
[model_providers.opencode-zen]
name = "OpenCode Zen"
base_url = "https://opencode.ai/zen/go/v1" # any OpenAI-compatible endpoint
wire_api = "chat"
env_key = "OPENCODE_ZEN_API_KEY" # codex reads the API key from this env var
[mcp_servers.liuhe]
command = "node"
args = ["/path/to/malong/mcp-server.js", "--workspace", "/path/to/project"]3) Run — export the API key, then start codex:
export OPENCODE_ZEN_API_KEY="your-api-key" # never commit this
codex exec "index the workspace with reindex, then find createDb with symbol_search"Tools are exposed by the malong-mcp server; the prefix follows the name you
register it under — opencode malong_<tool> (e.g. malong_health,
malong_symbol_search), Claude Code mcp__liuhe__<tool>, the DSH bridge
malong__<tool>. Run reindex once per workspace first so symbol search has an
index to query.
Testing
Rust:
cargo test(97 assertions: per-language extraction + protocol framing/decoding + cache LFU + server dispatch/priority queue + batch_extract + deep-nesting guards + hello handshake)JS: 166 test files (authoritative list:
scripts.testinpackage.json; includes primitives / tool-registry / manifest-quality / write-runtime / edit-transaction-ext / verify-pipeline, the dogfood r12–r30 end-to-end series, plus G0/G1 capability-contract / capability-catalog / invoke-capability / invoke-stdio suites)Total: 166 JS test files, full chain 0 failures (plus cargo test: 97 assertions)
One-shot:
./scripts/ci.sh(self-contained: cargo test + npm test + dogfood; reuses or auto-starts the daemon)
License
Changelog
See CHANGELOG.md for the full release history.
Available Tools
13 toolscode_auditA
Read-only review pass (code review, security, dead code…) on files you touched or any scope — reports findings via checks, changes nothing. Zero findings is not proof.
| Name | Required | Description | Default |
|---|---|---|---|
| files | No | Scope; default task materials. | |
| scope | No | Subdir (workspace checks). | |
| action | No | run default; accept/ledger. | |
| checks | No | Default first two. | |
| reason | No | accept: why. | |
| options | No | Per-check passthrough to the original analyzer: code_review: source/diff/max_issues; security_review: source; guard_patterns: ruleset; dead_code: include_files. Full schema via code_query mode=capability. | |
| task_id | Yes | Task id. | |
| fingerprint | No | accept: from prior run. | |
| max_findings | No | Default 50. | |
| workspace_dir | Yes | Project root (abs). | |
| expected_state_revision | No | Guard. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It usefully discloses that the audit is read-only, changes nothing, reports findings via checks, and that zero findings is not proof; however, it leaves the accept/ledger actions and their state implications unclear, which matters for an 11-parameter tool with no annotation safety profile.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no wasted text. It efficiently communicates the core operation, immutability, and a key caution.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex tool with 11 parameters, nested options, and no output schema, the description covers the high-level purpose but does not explain return format, action modes such as accept/ledger, or how findings are surfaced. The rich schema compensates for parameter documentation, but the description alone is only adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all 11 parameters already have documented meaning in the schema. The description mentions checks and scoping in passing but adds no parameter semantics beyond what the schema already provides, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action and resource: a read-only review pass over files that reports findings via checks and changes nothing. It clearly distinguishes audit behavior from mutating siblings by emphasizing read-only operation, but it does not name or contrast against any specific sibling tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives implied usage context by saying the pass can run on files you touched or any scope, and warns that zero findings is not proof. However, it does not explicitly state when to use this versus code_check, code_maintain, or other siblings, nor does it describe exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
code_batchA
Apply edits to N files in ONE atomic call — all or nothing; single edit → code_patch. New: create:true + content + locator.file_path. dry_run default preview.
| Name | Required | Description | Default |
|---|---|---|---|
| policy | No | {all_or_nothing: boolean} (default true). | |
| safety | No | Validation gate: {profile: standard|strict|fast, block_on_validation_error: boolean}. | |
| writes | Yes | Non-empty; per entry: read_ref/locator + one edit payload. | |
| dry_run | No | true = preview; false = apply. | |
| task_id | Yes | Task id. | |
| read_ref | No | Default base; same file only. | |
| request_id | No | Idempotency key. | |
| workspace_dir | Yes | Project root. | |
| allow_unsafe_no_base | No | Force apply without prior file-level reads (default false; gate). | |
| expected_state_revision | No | Guard. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It usefully discloses atomicity, that the default is a preview (dry_run), and the create-file recipe, but says nothing about failure/rollback reporting, validation-gate behavior, or the allow_unsafe_no_base gate — significant gaps for a destructive multi-file writer.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the atomic-write contract and the sibling routing in a single dense sentence; zero filler. The create-mode fragment is telegraphic but still parseable, and nothing is buried.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 10-parameter nested mutation tool with no annotations and no output schema, the description covers atomicity, preview default, and creation, but omits conflict/guard semantics and what a failed batch returns. The rich schema compensates for most parameter gaps, but behavioral completeness for a write tool is only adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3, and the description adds meaning on top: it maps create:true to content + locator.file_path and clarifies dry_run's default to preview. The policy, safety, guard, and idempotency params are left to the schema, which already documents them.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb+resource+scale: 'Apply edits to N files in ONE atomic call' with the explicit constraint 'all or nothing'. It also names the sibling that handles single edits (code_patch) and flags the create path, so an agent can distinguish it from code_patch and edit_transaction without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit routing rule: multi-file atomic edits here, 'single edit → code_patch', and states dry_run defaults to preview. It does not cover when to prefer edit_transaction or invoke_capability, but the primary alternative is clearly named.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
code_checkA
Run test/typecheck/lint after editing — records commands + results as task evidence; better than raw shell. Previews exact commands first; async:true for long suites.
| Name | Required | Description | Default |
|---|---|---|---|
| run | No | true = execute. | |
| async | No | Background; query code_control. | |
| checks | No | Default [test]. | |
| task_id | Yes | Task id. | |
| timeout | No | Per-stage ms (30000). | |
| workdir | No | Subdir; verification stages run here (tsc-check dir equivalent). | |
| verifier | No | protocol default; or exit. | |
| request_id | No | Idempotency key. | |
| workspace_dir | Yes | Project root (abs). | |
| expected_state_revision | No | Guard. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does meaningful work: it discloses the evidence side effect (commands + results recorded against a task), the preview-first safety behavior implying execution requires an explicit opt-in, and that async mode must be polled via code_control. It stops short of failure/exit semantics and any permission or rate considerations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two compact clauses pack purpose, evidence recording, the shell alternative, preview behavior, and the async escape hatch with zero filler, and the core action is front-loaded. The telegraphic phrasing ('async:true for long suites') is efficient but slightly at the cost of readability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 10-parameter execution tool with no annotations and no output schema, the description covers intent, safety preview, and async handling but leaves the response shape, failure semantics, and the verifier modes entirely unexplained. Enough to call it correctly in the common case, not enough to call it confidently in edge cases.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents all ten parameters, making 3 the baseline. The description adds only scattered meaning (async ties to code_control, checks defaulting) and says nothing about verifier, timeout, workdir, or expected_state_revision, all of which are terse one-word schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a concrete verb+resource: run test/typecheck/lint, scoped to 'after editing', plus two differentiators (records evidence, precedes execution with a preview). It positions itself against raw shell and points to code_control for background results, but never names the read/audit siblings it might be confused with.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Run ... after editing' gives a clear trigger, and 'async:true for long suites' gives an explicit conditional for switching modes. It also advises preferring this over raw shell. Missing is any explicit when-not guidance (e.g., when to use code_audit or code_query instead of re-running checks).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
code_controlC
Manage task lifecycle: cancel a running task, resume a dropped one (returns a self-contained brief), reopen a finished one, check a background job.
| Name | Required | Description | Default |
|---|---|---|---|
| ref | No | expand: id or candidates. | |
| goal | No | switch_route goal. | |
| route | No | switch_route. | |
| action | Yes | Action. | |
| job_id | No | job/cancel_job id. | |
| reason | No | cancel/reopen: why. | |
| task_id | Yes | Task id. | |
| wait_ms | No | cancel_job: ms (5000). | |
| workspace_dir | Yes | Project root (abs). | |
| expected_state_revision | No | Guard. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full disclosure burden. It notes that resume 'returns a self-contained brief', which is useful, but says nothing about whether cancel/reopen are destructive, what happens to an interrupted job, permission requirements, or the role of the expected_state_revision guard. For a lifecycle-mutation tool this is a significant gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence listing operations with no filler. The one parenthetical adds real value. It is compact, though the enumeration is incomplete relative to the action enum.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 10-parameter, 8-action, unannotated mutation tool with no output schema, the description covers only half the actions and one return value. An agent still lacks enough to select the right action safely or predict effects of cancel/reopen/switch_route.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema baseline already documents all ten parameters, including the enums. The description only adds meaning for resume's return value; it does not explain ref, goal, route, or how expected_state_revision interacts with the actions, so it stays at baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a specific verb+resource phrase ('Manage task lifecycle') and names four concrete operations (cancel, resume, reopen, check job). However, it omits three of the eight enum actions (switch_route, expand, cancel_job) and gives no hint of how it differs from siblings like code_task or code_status.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use or when-not-to-use guidance is present, and no alternatives are named. An agent cannot tell from the description why it would call code_control rather than code_task or code_status, nor which of the unlisted actions apply.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
code_maintainB
Clean up imports in files you touched (missing/unused). plan = preview by default; dead code is never removed automatically, only flagged.
| Name | Required | Description | Default |
|---|---|---|---|
| files | No | Scope; default task materials. | |
| action | No | plan default; apply writes. | |
| dry_run | No | true = preview. | |
| task_id | Yes | Task id. | |
| proposals | No | Fingerprints (default all safe). | |
| request_id | No | Idempotency key. | |
| max_per_file | No | Default 20. | |
| workspace_dir | Yes | Project root (abs). | |
| max_candidates | No | fix_imports candidates per file (default 10, 1-100). | |
| expected_state_revision | No | Optimistic guard. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations at all, the description carries the full burden. It usefully discloses that plan is the default and that dead code is only flagged, never removed — real safety context. However it omits that apply mutates files on disk, says nothing about idempotency (request_id) or the optimistic guard (expected_state_revision), leaving meaningful behavioral gaps for a 10-param write tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight clauses, front-loaded with the action, zero filler. It could be marginally clearer about what happens on apply, but nothing is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema and no annotations mean the description must carry safety and return semantics, yet it only covers the preview-flag and dead-code policy. For a 10-parameter mutation tool with fingerprints and revision guards, that is adequate but not complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so every parameter is already documented and the baseline is 3. The description reinforces the plan/apply duality but adds no syntax beyond the schema (e.g. fingerprint semantics for proposals are left to the schema).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Clean up imports in files you touched') with the scope qualifier 'files you touched', which distinguishes it from a general patcher like code_patch. It stops short of naming a sibling, so 4 rather than 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'plan = preview by default' implies the safe-first workflow, and 'dead code is never removed automatically' implies a boundary. But there is no explicit statement of when to choose this over code_patch or edit_transaction, and no prerequisites given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
code_patchA
Edit any text file (code, md, config) — a reversible alternative to Edit/Write: patch text you already read (pass its read_ref), or create:true + content + locator.file_path. dry_run default: preview; false applies.
| Name | Required | Description | Default |
|---|---|---|---|
| patch | No | For patch {old_string, new_string}; old_string exact, unique. | |
| create | No | New file: content + locator.file_path. | |
| safety | No | Validation gate: {profile: standard|strict|fast, block_on_validation_error: boolean}. | |
| content | No | For replace_symbol. | |
| dry_run | No | true = preview; false = apply. | |
| locator | No | Anchor {file_path, name}/{symbol_id}. | |
| task_id | Yes | Task id. | |
| boundary | No | replace_symbol: full (default, includes signature) or body (body only). | |
| read_ref | No | Preferred; supplies base_version. | |
| edit_mode | No | patch default; replace_symbol: content. | |
| request_id | No | Idempotency key. | |
| workspace_dir | Yes | Project root (abs). | |
| preserve_decorators | No | replace_symbol: keep decorators (default true). | |
| allow_unsafe_no_base | No | Force write without a prior file-level read (default false; gate). | |
| expected_state_revision | No | Optimistic guard. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral burden and usefully discloses reversibility, `dry_run` preview default, and read-before-write via `read_ref`. However, for a 15-parameter mutation tool it omits validation-gate behavior, unsafe-write override, idempotency, and what happens when `dry_run:false` applies changes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense and front-loaded: purpose, modes, and the important `dry_run` default are all stated without wasted words. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The schema fully covers parameters, and the description gives the core workflow for patch/create and preview/apply. But with no annotations and no output schema, it should say more about validation behavior, idempotency, and return/result semantics for a complex mutation tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters. The description adds some context for `read_ref`, `create`, `content`, and `dry_run`, but leaves many parameters such as `safety`, `boundary`, `preserve_decorators`, and `expected_state_revision` to the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb, 'Edit', and a clear resource, 'any text file (code, md, config)', plus two operation modes. It positions itself as a reversible alternative to Edit/Write, but does not explicitly differentiate from sibling `edit_transaction`.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explains when to use patch mode with `read_ref` for text already read, and when to use `create:true` with `content` and `locator.file_path`. It also states the `dry_run` default behavior, though it gives no explicit when-not guidance or sibling comparison.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
code_queryB
Look things up fast, no task needed: where is X, who calls it, what's in this file. mode: outline|symbols|body|map|search|impact|references|callers|callees|tests|validate|capabilities. Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
| dir | No | map only: subdir inside workspace_dir (escapes rejected). | |
| file | No | Required for outline/callers/callees/impact/tests/validate; optional with symbol for references. | |
| kind | No | references only: filter by kind (call,import,use,assign,extends,implements; comma-separated). | |
| line | No | callers/callees: disambiguate a line. | |
| mode | Yes | map=compact paged overview (+dir drill); body=read file/symbol content without a task; search=code_search intent search; tests=find_tests candidates; validate=sandbox_validate content; capabilities=list; capability=describe by name. | |
| name | No | capability mode: exact original tool name. | |
| page | No | map only: page number (default 1; pass next_page). | |
| rich | No | body only: include rich projection (outline). | |
| depth | No | callers/callees/impact: traversal depth. | |
| limit | No | Max rows (symbols, references). | |
| query | No | Required for symbols (substring); capabilities: optional name/summary filter. | |
| cursor | No | capabilities mode: pagination offset (from next_cursor). | |
| symbol | No | Required for references; optional with file for callers/callees/impact. | |
| options | No | Advanced per-mode passthrough to the original tool (e.g. callers: max_callers; impact: symbols/change_type; body: locators/context_lines). Protected keys rejected; full schema via mode=capability. | |
| category | No | capabilities mode: filter by category (e.g. query/audit/maintain). | |
| page_size | No | map only: entries per page (default 12; packing hint). | |
| max_tokens | No | map only: map token budget (default 700). | |
| budget_hint | No | body only: max chars (default 1200; 0 = full, hard-capped). | |
| new_content | No | validate only: candidate full content to check (no write). | |
| workspace_dir | Yes | Root (abs). Any workspace path works — a fresh one is indexed automatically on first read. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full behavioral burden. It discloses 'Read-only' and 'no task needed', which are useful traits, but it does not explain mode-specific effects, output behavior, or the workspace indexing side effect mentioned in the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loads the core purpose before listing modes. The mode list is long but necessary; it omits 'capability' even though the schema enum includes it, which slightly reduces precision.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a complex 20-parameter, multi-mode tool with no output schema and no annotations. The description does not explain return values, mode selection, pagination, or the auto-indexing behavior, leaving significant gaps for an agent to infer from the schema alone.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all 20 parameters in detail. The description lists the mode names and gives high-level lookup examples but does not add parameter meaning beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear lookup purpose and gives concrete examples: 'where is X, who calls it, what's in this file.' It lists the available modes, making the tool's scope distinguishable from task-oriented siblings. It stops short of naming a sibling, so it is clear but not fully differentiated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'no task needed' implies when to use this instead of task-based tools, and 'Read-only' clarifies the safety posture. However, it does not explicitly compare against siblings like code_read, code_task, or code_search, nor does it explain when each mode should be selected.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
code_readA
Read a file or one symbol before editing; returns content + a read_ref to pass back when editing. budget_hint=0 → full file.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | core default; rich adds outline. | |
| locator | No | Anchor {symbol_id}/{file_path+name}; line_range = degraded. | |
| task_id | Yes | Task id. | |
| read_ref | No | Re-read by read_ref. | |
| budget_hint | No | Max chars; 0 = full. | |
| workspace_dir | Yes | Project root (abs). | |
| expected_state_revision | No | Guard. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It usefully discloses that the tool returns content plus a read_ref to pass back during editing and that budget_hint=0 returns the full file, but it does not cover permissions, error behavior, or broader read-only guarantees.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two compact sentences, front-loads the primary purpose, then adds the return and budget details. Every clause earns its place with no wasted text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with seven parameters, a nested locator object, and no output schema, the description is minimal. It covers the core action and return artifact but leaves locator formats, required workspace/task context, and expected_state_revision guard behavior to the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters. The description restates budget_hint=0 and the read_ref lifecycle but adds no extra syntax or anchor detail beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: reads a file or one symbol. It also names the timing (before editing) and the return artifact (content plus read_ref). It does not distinguish itself from siblings such as code_query, so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'before editing' gives clear usage context, and the read_ref return value explains the follow-up workflow. It does not name alternatives or when-not-to-use cases, so it is not a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
code_statusA
See what a task changed so far: state, files, evidence. Omit task_id → list active tasks.
| Name | Required | Description | Default |
|---|---|---|---|
| task_id | No | Task id; omit = list. | |
| workspace_dir | Yes | Project root (abs). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It discloses the shape of the returned payload (state, files, evidence) and the listing fallback behavior, which implies a read-only inspection, but it never states that explicitly, nor any permission or scope requirements. Useful but incomplete for a zero-annotation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two compact clauses, the primary purpose front-loaded and the mode switch second. Every fragment carries information; nothing is padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple 2-parameter tool with full schema coverage and no output schema, the description says what is reported and how to get a list instead of a single task. The main remaining gap is not saying what 'active' means or what happens when a task_id is unknown.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%: task_id already says 'omit = list' and workspace_dir says 'Project root (abs).' The description restates the omit-to-list behavior and adds 'active' as a qualifier on the listing, but adds no real semantics about what a task_id accepts or what workspace_dir scoping means. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb and resource: reports what a task changed so far, naming the returned facets (state, files, evidence). It also covers the dual mode (single task vs. list). It does not distinguish itself from siblings like code_audit, code_query, or code_check, so it stops short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Omit task_id → list active tasks' gives explicit mode-selection guidance, which is genuinely useful. However there is no guidance on when to prefer this over sibling status/audit tools (code_audit, code_query, code_check) and no stated exclusions, leaving usage implied rather than specified.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
code_taskA
Start here for any change: describe the goal, get candidates + structure + impact in one call. Planning only — does not itself edit or check; then code_read → code_patch / code_batch → code_check.
| Name | Required | Description | Default |
|---|---|---|---|
| goal | Yes | Coding goal. | |
| route | No | Inferred when omitted. | |
| target | No | Anchor {file, symbol, line}. | |
| request_id | No | Correlation id. | |
| search_terms | No | Extra terms (≤8). | |
| workspace_dir | Yes | Project root (abs). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose the critical trait: this tool does not mutate or verify anything. It also names the three payload kinds (candidates, structure, impact). It says nothing about cost, whether prior indexing/workspace state is required, or determinism of the returned candidates, which matters for a planning call intended as the first step.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the call-to-action and closed with the follow-on chain; nothing is padded. The arrow-chain notation is dense to the point of being telegraphic, which costs a little readability against the otherwise tight structure.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 6-parameter, nested-object, no-output-schema tool, the description covers the two things an agent most needs: when to call it and what happens next. Parameter-level detail is delegated entirely to a fully-covered schema, and return shape is only named, not characterized — acceptable given no output schema exists but not exhaustive.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so goal, route, target, request_id, search_terms, and workspace_dir are already documented in the schema, making 3 the baseline. The description mentions only 'describe the goal' and adds no guidance beyond the schema — notably it never explains when to override route or how target anchors steering, even though route inference ('Inferred when omitted') is a meaningful behavioral lever.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a concrete purpose: a planning call that takes a goal and returns candidates, structure, and impact in one shot. It differentiates from siblings by naming the read/patch/check sequence that follows. What it lacks is a crisp verb+resource label (e.g. 'plan a code change'), leaving 'start here for any change' slightly open-ended about the artifact produced.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives an explicit trigger ('Start here for any change'), an explicit exclusion ('Planning only — does not itself edit or check'), and names the alternatives plus their order (code_read → code_patch / code_batch → code_check). An agent can route correctly without inspecting any other tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
code_worktreeA
Land a risky change safely: apply runs edits in a temp git worktree, your verify command gates it, and only on pass does the commit fast-forward into the CURRENT branch.
| Name | Required | Description | Default |
|---|---|---|---|
| action | No | preview default; apply: dry_run=false; status: list. | |
| changes | No | Required for preview/apply: [{path, new_content, delete}]. | |
| dry_run | No | true = preview. | |
| message | No | Commit message. | |
| task_id | Yes | Task id. | |
| timeout | No | verify_cmd timeout ms. | |
| request_id | No | Idempotency key. | |
| verify_cmd | No | Non-zero = abort + rollback. | |
| workspace_dir | Yes | Project root (abs, git repo). | |
| expected_state_revision | No | Optimistic guard. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does disclose meaningful behavior: edits happen in an isolated temp worktree, the verify command gates the outcome, and the commit only fast-forwards to the current branch on pass. It omits auth/permission requirements, idempotency semantics (despite a request_id param), and the rollback-on-preview distinction, keeping it short of a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single well-formed sentence that front-loads the value proposition and uses a colon to unpack the mechanism. Dense but zero filler; it does not waste space on restating the name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 10-parameter tool with three actions (preview/apply/status) and no output schema, the description addresses only the apply path. Preview and status modes — and what a caller should expect from them — are left entirely to the schema, leaving the multi-mode behavior under-explained.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so every parameter is already documented, establishing a baseline of 3. The description reinforces the gating role of the verify command but adds no format or usage detail beyond what the schema states.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a concrete mechanism (temp git worktree + verify gate + fast-forward commit into the CURRENT branch), which tells an agent exactly what the tool accomplishes. The verb is somewhat implicit ('apply runs edits') and it never names or contrasts with siblings like edit_transaction or code_patch, so differentiation falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'Land a risky change safely' implies the intended scenario (high-risk edits needing verification), which is useful implied guidance. However, there is no explicit when/when-not, and no routing to the alternative transaction/edit tools that occupy the same space.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
edit_transactionA
Multi-file edit with rollback/undo (begin->edit->commit); single-file edits don't need one.
| Name | Required | Description | Default |
|---|---|---|---|
| seq | No | Chunk seq. | |
| file | No | Path (edit). | |
| name | No | Txn name (begin). | |
| edits | No | Array of {old_string,new_string} | {line_span,new_lines}; line_span {start_line,end_line,expect_sha}, end_line null=EOF. | |
| files | No | Broadcast to all. | |
| lines | No | Chunk lines. | |
| total | No | Chunk count. | |
| action | Yes | Action. | |
| atomic | No | Default true. | |
| create | No | New file (needs content). | |
| txn_id | No | Txn id. | |
| content | No | File content (create). | |
| dry_run | No | edit/edit_multi: validate only. | |
| expect_sha | No | assemble sha256. | |
| file_edits | No | edit_multi: [{file, edits}] (same edit objects). | |
| workspace_dir | Yes | Project root (abs). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It discloses the transactional rollback/undo model and workflow, but omits mutation risks, atomicity semantics, action-specific side effects, and error/concurrency behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence, front-loaded with the core capability and workflow. Every clause earns its place and there is no redundant text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a 16-parameter, 9-action mutation tool with no annotations and no output schema. One sentence does not adequately explain actions like edit_chunk, assemble, undo_commit, info, or the roles of atomic, dry_run, create, and txn_id; the schema descriptions are too terse to fill those gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all 16 parameters, establishing a baseline of 3. The description adds little parameter-level meaning beyond the begin->edit->commit sequence and relies on the schema's terse field descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific capability: multi-file edit with rollback/undo via begin->edit->commit. It also distinguishes itself from single-file edits, though it does not name a specific sibling alternative.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use guidance (multi-file edits needing rollback/undo) and when-not-to-use guidance (single-file edits don't need one). It does not name the preferred tool for single-file edits.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
invoke_capabilityA
Escape hatch: call a tool not listed above, by exact name; delegates once per call — no retries. Prefer listed tools; read-only unless the target itself writes.
| Name | Required | Description | Default |
|---|---|---|---|
| args | No | Original tool arguments per its schema; nested workspace_dir/task_id are ignored. | |
| name | Yes | Exact original tool name (see code_query mode=capabilities). | |
| task_id | No | Optional task to associate (must belong to workspace_dir). | |
| request_id | No | Optional idempotency key consumed by the outlet for side-effect calls: same id + same payload → deduplicated replay (no re-execution); different payload → request_conflict. | |
| workspace_dir | Yes | Root (abs); top-level boundary. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well: it discloses the single-shot delegation model ('once per call — no retries') and the mutation risk ('read-only unless the target itself writes'). It leaves failure handling and auth prerequisites unstated, but the key behavioral traits an agent needs are present.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single dense line that front-loads the purpose, then the delegation semantics, then the selection guidance. Every clause earns its place with zero padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given a nested-args escape hatch with a fully-described schema and no output schema, the description covers purpose, delegation model, retry behavior, and write risk adequately. Only error/response handling is left implicit, a minor gap against the rich schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents name, args, workspace_dir, task_id, and request_id thoroughly. The description adds no parameter-level detail beyond what the schema provides, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'Escape hatch: call a tool not listed above, by exact name' — a specific verb, resource, and mechanism. It distinguishes itself from the listing-focused siblings by making clear it is the fallback for tools not surfaced elsewhere.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to reach for it ('call a tool not listed above') and when not to ('Prefer listed tools'), which routes the agent away from it by default. It stops short of naming a concrete sibling alternative, but the guidance is clear and actionable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
1 tool update
v0.5.29- Changed
code_query1 field changed- changed
Input schema / properties / workspace_dir / descriptionPrevious value: -"Root (abs)."New value: +"Root (abs). Any workspace path works — a fresh one is indexed automatically on first read."
56 tool updates
v0.5.28- Removed
active_todos - Removed
call_chain - Added
code_audit - Added
code_batch - Added
code_check - Added
code_control - Added
code_maintain - Added
code_patch - Removed
code_quality - Added
code_query - Added
code_read - Removed
code_review - Removed
code_search - Added
code_status - Added
code_task - Added
code_worktree - Removed
config_drift - Removed
debug_runner - Removed
dep_graph - Removed
dependency_gatekeeper - Removed
diff_facts - Removed
edit_batch - Removed
edit_collision_guard - Changed
edit_transaction22 fields changed- changed
Input schema / properties / action / descriptionPrevious value: -"Transaction action to perform."New value: +"Action." - changed
Input schema / properties / action / enumPrevious value: -[ - "begin", - "edit", - "edit_multi", - "commit", - "undo_commit", - "rollback", - "info" -]New value: +[ + "begin", + "edit", + "edit_multi", + "edit_chunk", + "assemble", + "commit", + "undo_commit", + "rollback", + "info" +] - changed
Input schema / properties / atomic / descriptionPrevious value: -"For edit_multi: all-or-nothing (default: true)."New value: +"Default true." - added
Input schema / properties / contentAdded value: +{ + "description": "File content (create).", + "type": "string" +} - added
Input schema / properties / createAdded value: +{ + "description": "New file (needs content).", + "type": "boolean" +} - added
Input schema / properties / dry_runAdded value: +{ + "description": "edit/edit_multi: validate only.", + "type": "boolean" +} - changed
Input schema / properties / edits / descriptionPrevious value: -"Array of {old_string,new_string}. Required for edit."New value: +"Array of {old_string,new_string} | {line_span,new_lines}; line_span {start_line,end_line,expect_sha}, end_line null=EOF." - added
Input schema / properties / edits / items / properties / line_spanAdded value: +{ + "type": "object" +} - added
Input schema / properties / edits / items / properties / new_linesAdded value: +{ + "items": { + "type": "string" + }, + "type": "array" +} - removed
Input schema / properties / edits / items / properties / replace_allRemoved value: -{ - "type": "boolean" -} - removed
Input schema / properties / edits / items / requiredRemoved value: -[ - "old_string" -] - added
Input schema / properties / expect_shaAdded value: +{ + "description": "assemble sha256.", + "type": "string" +} - changed
Input schema / properties / file / descriptionPrevious value: -"Single file path relative to workspace_dir (required for action=edit)."New value: +"Path (edit)." - changed
Input schema / properties / file_edits / descriptionPrevious value: -"Per-file edits for edit_multi: [{file, edits}]. Overrides files+edits."New value: +"edit_multi: [{file, edits}] (same edit objects)." - removed
Input schema / properties / file_edits / itemsRemoved value: -{ - "properties": { - "edits": { - "description": "Array of edits for this file", - "items": { - "properties": { - "new_string": { - "type": "string" - }, - "old_string": { - "type": "string" - }, - "replace_all": { - "type": "boolean" - } - }, - "required": [ - "old_string" - ], - "type": "object" - }, - "type": "array" - }, - "file": { - "description": "File path relative to workspace_dir", - "type": "string" - } - }, - "required": [ - "file", - "edits" - ], - "type": "object" -} - changed
Input schema / properties / files / descriptionPrevious value: -"Multiple file paths relative to workspace_dir. Same edits applied to all (broadcast mode)."New value: +"Broadcast to all." - added
Input schema / properties / linesAdded value: +{ + "description": "Chunk lines.", + "items": { + "type": "string" + }, + "type": "array" +} - changed
Input schema / properties / name / descriptionPrevious value: -"Transaction name (required for action=begin)."New value: +"Txn name (begin)." - added
Input schema / properties / seqAdded value: +{ + "description": "Chunk seq.", + "type": "integer" +} - added
Input schema / properties / totalAdded value: +{ + "description": "Chunk count.", + "type": "integer" +} - changed
Input schema / properties / txn_id / descriptionPrevious value: -"Transaction ID (required for edit, edit_multi, commit, undo_commit, rollback, info)."New value: +"Txn id." - changed
Input schema / properties / workspace_dir / descriptionPrevious value: -"REQUIRED: project root (abs). reindex first if new."New value: +"Project root (abs)."
- Removed
exception_guard - Removed
feedback - Removed
find_tests - Removed
fix_imports - Removed
gc - Removed
git_worktree - Removed
guard_patterns - Removed
health - Removed
impact_analysis - Removed
inspect - Added
invoke_capability - Removed
mock_sync - Removed
naming_consistency - Removed
patch_parser - Removed
read_outline - Removed
read_symbol - Removed
references - Removed
reindex - Removed
rename_symbol - Removed
repo_map - Removed
sandbox_validate - Removed
security_review - Removed
spec_gen - Removed
style_sniffer - Removed
sweep_dead_code - Removed
symbol_search - Removed
test_bridge - Removed
trace_symbol - Removed
tsc_check - Removed
verify_pipeline - Removed
write_symbol - Removed
write_symbols
9 tool updates
v0.4.5-post9- Changed
code_quality2 fields changed- added
Input schema / properties / file / descriptionAdded value: +"File to probe, relative to workspace_dir" - added
Input schema / properties / workspace_dir / descriptionAdded value: +"REQUIRED: project root (abs)."
- Changed
code_search2 fields changed- added
Input schema / properties / limit / descriptionAdded value: +"Max results (default 30)" - added
Input schema / properties / workspace_dir / descriptionAdded value: +"REQUIRED: project root (abs). reindex first if new."
- Changed
patch_parser2 fields changed- added
Input schema / properties / file / descriptionAdded value: +"File path relative to workspace_dir" - added
Input schema / properties / workspace_dir / descriptionAdded value: +"REQUIRED: project root (abs). reindex first if new."
- Changed
read_symbol1 field changed- added
Input schema / properties / locator / descriptionAdded value: +"Symbol anchor: {symbol_id} or {file_path}+{name} (single read)"
- Changed
spec_gen2 fields changed- added
Input schema / properties / file / descriptionAdded value: +"Source file (relative to workspace_dir) to generate spec for" - added
Input schema / properties / workspace_dir / descriptionAdded value: +"REQUIRED: project root (abs). reindex first if new."
- Changed
tsc_check2 fields changed- added
Input schema / properties / timeout / descriptionAdded value: +"tsc run timeout in ms (default 60000)" - added
Input schema / properties / workspace_dir / descriptionAdded value: +"REQUIRED: project root (abs)."
- Changed
verify_pipeline4 fields changed- added
Input schema / properties / stages / descriptionAdded value: +"Comma-separated: lint|test|typecheck (default all)" - added
Input schema / properties / timeout / descriptionAdded value: +"Per-stage timeout in ms (default 30000)" - added
Input schema / properties / workdir / descriptionAdded value: +"Optional subdir to run in (default workspace_dir)" - added
Input schema / properties / workspace_dir / descriptionAdded value: +"REQUIRED: project root (abs). reindex first if new."
- Changed
write_symbol1 field changed- added
Input schema / properties / locator / descriptionAdded value: +"Symbol anchor: {symbol_id} or {file_path}+{name}. Read first via read_symbol."
- Changed
write_symbols2 fields changed- added
Input schema / properties / policy / descriptionAdded value: +"{all_or_nothing: true} (default) | {false} best-effort" - added
Input schema / properties / safety / descriptionAdded value: +"Safety profile: fast|standard|strict (default standard)"
44 tool updates
- First observed
active_todos - First observed
call_chain - First observed
code_quality - First observed
code_review - First observed
code_search - First observed
config_drift - First observed
debug_runner - First observed
dep_graph - First observed
dependency_gatekeeper - First observed
diff_facts - First observed
edit_batch - First observed
edit_collision_guard - First observed
edit_transaction - First observed
exception_guard - First observed
feedback - First observed
find_tests - First observed
fix_imports - First observed
gc - First observed
git_worktree - First observed
guard_patterns - First observed
health - First observed
impact_analysis - First observed
inspect - First observed
mock_sync - First observed
naming_consistency - First observed
patch_parser - First observed
read_outline - First observed
read_symbol - First observed
references - First observed
reindex - First observed
rename_symbol - First observed
repo_map - First observed
sandbox_validate - First observed
security_review - First observed
spec_gen - First observed
style_sniffer - First observed
sweep_dead_code - First observed
symbol_search - First observed
test_bridge - First observed
trace_symbol - First observed
tsc_check - First observed
verify_pipeline - First observed
write_symbol - First observed
write_symbols
TDQS
Scored across 13 tools
The editing surface is crowded: code_patch, code_batch, edit_transaction, and code_worktree all mutate files, and the boundary between code_batch's atomic multi-file apply and edit_transaction's multi-file rollback/undo is not sharp. code_read and code_query also overlap on reading file contents, though descriptions provide some guidance.
All tools use snake_case and ten of thirteen share a code_ prefix; edit_transaction and invoke_capability are exceptions but remain readable. The mix of verb and noun suffixes (code_read vs code_task/code_worktree) is a minor inconsistency.
13 tools is within the well-scoped 3–15 range for a code-editing workflow. Each tool maps to a planning, reading, editing, verification, maintenance, or lifecycle concern.
The surface covers planning, querying, reading, single/multi-file edits, transactions, worktrees, checks, audits, maintenance, and task control. Minor gaps remain around explicit file deletion/rename and first-class diff/undo of applied patches.
Maintenance
Related MCP Connectors
Graph-native persistent memory for AI agents — 33 MCP tools, zero-LLM writes.
Codebase intelligence for agents: 152 structured artifacts across 21 programs, one call.
Shared control plane for AI coding agents — tasks, memory, decisions, file locks. 12 tools.
Code intelligence platform for AI agents. 20 tools for architecture, security & impact analysis.
Related MCP Servers
- AlicenseNot gradedqualityAmaintenanceStandalone MCP server for code structure analysis using tree-sitter. Directory trees, symbol definitions, and call graphs without reading raw source files. Supports Rust, Python, Go, Java, TypeScript, Fortran, JavaScript, C/C++, and C#. Benchmarked up to 68% fewer tokens vs native tools.7Apache 2.0

mcp-reposkeinofficial
AlicenseAqualityAmaintenanceDeterministic code-graph (GraphRAG) over your repo for LLM agents — local-first, git-native, zero-infra, served via MCP. Python, TS/JS, Rust, Go, Java, C#.813Apache 2.0- AlicenseNot gradedqualityAmaintenanceEnables coding agents to perform deterministic, model-free repository analysis and patch operations—tree-sitter repo maps, symbol/reference lookup, and SEARCH/REPLACE parsing/validation—via a CLI or MCP stdio server, without ever calling a language model.1MIT
- AlicenseNot gradedqualityAmaintenanceEnables AI coding agents to query code structure efficiently through 16 MCP tools, including symbol lookup, full-text search, dependency analysis, and refactor planning, powered by tree-sitter parsing and index-backed code intelligence.3MIT