Loading ToolBench
An MCP server that manages a knowledge graph for Claude Code projects. Enables reading, searching, and writing structured knowledge across user and project-specific graphs with persistent storage and multi-session support.
The Knowledge Graph MCP server exhibits strong intentional design around knowledge persistence and session management. Tool naming follows verb_noun conventions (kg_read, kg_search, kg_put_node, etc.). Descriptions are substantive (averaging 180-280 chars) and explain WHEN to use each tool. Input schemas are present and properly typed for all 8 tools. However, there are notable gaps: output schemas are not documented in the tool definitions, error handling lacks recovery guidance, and parameter descriptions could be more explicit about constraints and formats. The session_id pattern introduces state management complexity that may violate stateless request handling principles.
Archive a node — remove it from the active graph view without deleting it. Archived nodes can be recalled with kg_read(id=...).
Delete an edge connecting two nodes.
Delete a node. Hard delete — no undo.
Create or update an edge connecting two nodes. Edges make nodes durable — an unconnected node risks archival after 3 sessions without touches.
Create or update a node. level determines storage: 'user' for cross-project wisdom, 'project' for codebase-specific knowledge. If node ID exists, fields are merged (omitted fields unchanged). Search before creating to avoid duplicates. Connect with kg_put_edge after — unconnected nodes risk archival.
Read the knowledge graph. First call: pass cwd to initialize the session — the result includes session_id; pass that session_id on every later call (cwd then optional). Without id/ids: full graph — active nodes (gist), archived anchors (id only), live edges — always fits inline. With id or ids: full node content (gist + notes + touches + the node's edges); archived nodes get promoted to active. Reading several related nodes via ids in ONE call is cheaper than sequential single reads.
Output schemas not documented in tool definitions. Tools return results (e.g., full node content with gist + notes + touches + edges) but LLMs have no formal schema to parse the response structure. This forces LLMs to infer output structure from description text alone, increasing hallucination risk.
Session state management via session_id parameter violates stateless request handling. Each request requires passing session_id from prior kg_read() call, creating implicit session dependency. Current MCP spec (2026-07-28) emphasizes stateless protocol with _meta per-request. Session management should be transparent server-side or use request context, not client-passed tokens.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | B | 73 | <=2025-11-25 | v2 |
Full-text search across node IDs, gists, notes, and touches in both graphs — reaches archived and orphaned nodes that no render shows. Use when a problem feels familiar, before asserting an assumption, and whenever a mature graph plausibly covers the topic: in a long-lived graph the needed fact is often buried under fresher work. Search is what reaches it, but being found feeds nothing on its own — a node you had to dig for, and that should have been on the surface, is a miss worth kg_useful.
Mark nodes as 'useful' — signal to the server that these nodes proved their worth in this session. The server uses this feedback to tune archival heuristics and surface prioritization. Call once per session per node, not per mention.
Error handling lacks recovery guidance. Tools document risk levels (READ_ONLY, WRITE, DESTRUCTIVE, REVERSIBLE) but tool definitions contain no error responses explaining what LLM should do on failure. E.g., kg_delete_node states 'Hard delete, no undo' but provides no guidance on errors: what if node doesn't exist? How does LLM recover?
Parameter constraints not fully formalized. 'id' parameter in kg_put_node describes format rules (kebab-case, 3-5 words, 7+ words refused) but these are not expressed as regex patterns or formal constraints in the schema. LLMs cannot programmatically validate and risk passing invalid IDs.
Tool annotations missing. Tools declare risk levels in docstring (READ_ONLY, WRITE, DESTRUCTIVE, REVERSIBLE) but these are not mapped to MCP's readOnlyHint, destructiveHint, idempotentHint annotations. LLMs cannot automatically infer which tools require confirmation or cannot be safely retried.
No confirmation/dry-run pattern for destructive operations. kg_delete_node and kg_delete_edge are hard deletes with no undo, but tools lack a dry-run or confirmation step. Agents make mistakes, irreversible operations should support confirmation_required or similar safety gate.
Parameter descriptions lack format guidance. 'cwd' is described as 'Project root directory' but no validation rules: is it a file path? Relative or absolute? Does it require trailing slash? LLMs may pass malformed paths, causing silent failures.