Loading ToolBench
The deterministic reliability runtime for AI agents — a governance daemon that enforces budget limits, approval gates, and tool controls for LLM-powered applications
RiskKernel exposes 24 HTTP endpoints with minimal schema documentation. Most tools lack explicit input/output schemas in the source code provided. Descriptions are present but generic (avg ~80 chars, well below the 194-char baseline for A+ tools). No parameter type definitions visible. Tools are REST endpoints, not formally registered MCP tools with JSON Schema. This is a governance/observability service, not a traditional agent tool server, the mismatch between HTTP API and MCP tool patterns significantly limits score.
Serves the embedded local web page for human-in-the-loop approval management
Liveness/readiness health check endpoint — unauthenticated, no secrets, safe to expose to a load balancer or orchestrator health probe
Prometheus scrape endpoint exposing daemon's governed-run state metrics (runs by status, halt reasons, spend, tokens, approval-queue depth)
Lists approvals, optionally filtered by status (pending, approved, denied)
Retrieves a specific approval record by ID
Retrieves the latest crash-resumable checkpoint for a run, including step index and accumulated usage (tokens, dollars, loops)
No input/output JSON schemas visible in source code. Tools are HTTP endpoints, not formally registered MCP tools with structured schemas. Cannot verify parameter types, constraints, or response structures.
Descriptions are generic and brief (avg ~80 chars vs 194-char baseline). Missing WHEN to use, prerequisites, and downstream dependencies. E.g., 'Retrieves the latest crash-resumable checkpoint' does not explain when an agent should call this vs other run-state endpoints.
Parameter descriptions missing or minimal. 'run_id' and 'id' are documented but lack format hints (UUID? alphanumeric?). 'status' filter in GET /v1/approvals lacks enum constraint documentation.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 47 | 2026-07-28+ | v2 |
Lists git-native memory entries in the configured namespace
Reads a specific memory entry by name
Lists all facts stored in the run's memory layer
Lists all registered policy bundles
Retrieves a specific named policy bundle
Returns a run's current state including status, halt reason, accumulated usage, and any pending approval
Lists all tool calls made during a run
Returns build identity information including version, commit hash, and build date
Slack interactivity callback endpoint for approval decisions via Slack — authenticated by Slack request signature, not bearer token
Registers a reusable, named policy bundle that can be referenced by runs via policyRef
Creates a new governed run with specified budget constraints and policy
Requests a human-in-the-loop approval for a tool call, blocking execution until approved or denied
Resolves a human-in-the-loop approval gate by approving or denying a pending tool call request
Cancels an active run, halting further execution
Saves a crash-resumable checkpoint for a run, persisting current state and usage metrics
Begins a new step in a run, ticking the loop counter and enforcing loop budget constraints
OTLP/HTTP trace receiver endpoint for consuming OpenTelemetry traces from exporters
Stores or updates a fact in the run's memory layer
No error handling guidance visible. Tools do not document retryable vs fatal errors, or recovery steps. E.g., POST /v1/runs likely fails if budget exceeded, but no guidance on what to do next.
Slack integration endpoint (POST /v1/integrations/slack/interactions) lacks documentation of Slack signature validation, expected payload format, and error responses. Security-critical endpoint is under-documented.