Safety-first AI assistant infrastructure, 100% Rust, trait-pluggable architecture. Supports agent-based task execution with tools, skills, memory, routine scheduling, and multi-channel deployment (CLI, Telegram, daemon).
RRClaw defines 12 tools with complete JSON schemas and descriptions present in source. However, significant quality issues prevent a higher score: (1) Naming conventions lack consistent verb-first structure, 'memory_store', 'memory_recall', 'memory_forget' are acceptable but 'routine' and 'skill' are vague action names that don't clearly convey their scope or effect. (2) Descriptions are present but brief (ranging 10 - 120 chars), mostly functional rather than LLM-optimized. Most lack dependency hints, failure modes, or clarity on when to call this tool vs. similar ones. (3) Parameter descriptions are minimal, e.g., 'args' in git tool lacks detail on what each operation expects. (4) No output schemas documented for any tool, LLMs cannot plan downstream tool chains or know what fields to extract. (5) Error handling is not evident from code, no recovery guidance, no classification of retryable vs. fatal errors. (6) Security posture: shell and git tools accept arbitrary commands without visible input sanitization or rate limiting. Memory tools store/recall unstructured strings without validation. (7) Tool composition: file_write + file_read + shell + git are tightly grouped, but no clear guidance on precedence or error handling if one fails. Baseline: 549 production tools average 18-char names (p10=10, p90=27), 194-char descriptions (p10=34, p90=392), 100% have return type docs, 94% have tool descriptions, 100% of params described in A+ tools. RRClaw's avg tool name = 16 chars ✓, avg description ≈ 65 chars (too short, below p10), 0% have return type docs (critical gap), param descriptions ≈ 50% complete. Median MCP server scores 45 - 55; this server lands in that range due to presence of schemas but lack of depth and output documentation.
Get or set RRClaw configuration
Read file contents from the filesystem
Write or append content to a file
Git version control operations (commit, push, pull, branch management)
Make HTTP requests to APIs with mini-LLM response extraction
Delete stored information from memory
Retrieve stored information from memory
No output schemas documented for any of the 12 tools. LLMs cannot plan downstream tool chains or know what fields to extract from responses. This is a critical gap for agent reasoning and composition.
Tool descriptions are under-optimized for LLM selection. Average length ~65 chars vs. production baseline 194 chars (p10=34, p90=392). Descriptions lack 'When to use' guidance, dependencies, and error modes. E.g., 'Execute shell commands with security policy enforcement' does not explain when to prefer shell over git or file operations.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | F | 48 | <=2025-11-25 | v2 |
| 2026-03-09 | F | 30 | - | v1 |
Store information in memory for later recall
Create, update, delete, or list scheduled routine tasks
Get information about RRClaw itself (version, capabilities, configuration paths)
Execute shell commands with security policy enforcement
Execute loaded behavior guides (skills) that extend agent capabilities
Parameter descriptions are minimal. 'args' in git tool lacks detail on what each operation (commit, push, pull, branch, stash) expects. Memory tools accept unstructured 'content' and 'category' strings without validation examples or constraints.
Vague action names reduce clarity. 'routine' (create, update, delete, list scheduled tasks) does not clearly convey scope, agent may confuse it with a generic task executor. 'skill' is even vaguer (execute behavior guides). These should be 'manage_routine' and 'execute_skill' or similar.
No visible error handling or recovery guidance in tool definitions. shell and git tools accept complex input but do not document what errors look like, how to retry, or when operations are retryable vs. fatal. This violates pattern:recovery-guide.
Security: shell tool accepts arbitrary commands with only 'security policy enforcement' mentioned but not detailed in source. No visible input sanitization against command injection or path traversal in code provided. git and file_write tools similarly lack explicit validation.
Pagination and result limits: http_request tool does not document pagination support or result size caps. Returning entire HTTP response bodies (as 'mini-LLM response extraction' suggests) could overflow context. Tool composition: No documented interdependencies, e.g., if file_write fails, should agent retry or call another tool?