Deterministic governance for AI coding tools and autonomous agents. Intercepts every action and blocks dangerous ones before they execute using Cedar policies.
Vectimus exposes 6 tools via HTTP, but lacks critical definition quality. Tool descriptions are present but minimal (10-80 chars, well below the 50-200 char baseline for LLM-optimized descriptions). Input schemas are either missing entirely or trivial. The 'evaluate' tool accepts a generic 'body' parameter with no type constraints or field documentation. Health/readiness probes are operational tools, not agent-facing capabilities. No parameter descriptions, no output schemas documented, no error recovery guidance. This server is a governance/policy engine, not an agent tool interface, the tools exposed do not follow agentic tool patterns.
Evaluate an incoming tool action against Cedar policies
Server-Sent Events stream of real-time evaluation events
Return server health including policy count and uptime
Lightweight liveness probe for k8s. Returns 200 if the process is alive.
Return metadata about all loaded policies
Readiness probe for k8s. Returns 200 only when policies are loaded.
No input schemas visible for 5 of 6 tools (list_policies, health, healthz, ready, events_stream). The 'evaluate' tool accepts a generic 'body' object with no field-level type constraints or descriptions.
Tool descriptions are 10 - 80 characters, far below the 50 - 200 char baseline for LLM-optimized descriptions. 'health' (20 chars), 'healthz' (15 chars), 'ready' (20 chars) provide minimal context for agent selection.
No parameter descriptions. The 'evaluate' tool's 'body' parameter lacks any documentation of expected fields, format, or constraints. Agents cannot infer what payload structure is required.
No output schemas documented. Agents do not know what fields to expect from responses, preventing downstream tool chaining and data extraction.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 45 | 2026-07-28+ | v2 |
Health/readiness probes (healthz, ready, health) are operational/infrastructure tools, not agent-facing capabilities. They do not follow agentic tool patterns and should not be exposed as MCP tools.