Loading ToolBench
Generates an agent-friendly local source map for code analysis, test coverage, untested changes, and cross-service hints. Serves REST endpoints and MCP endpoint for AI agents.
CodeCaChe exposes 12 CLI tools via HTTP/MCP with significant definition gaps. Tool names lack consistent verb-noun structure (scan, check, tokenize, init, changes, deps, prompts, run, insights, sast, audit, install). Descriptions vary widely in quality, some are detailed (scan, changes) but many are vague or assume domain knowledge (check marked deprecated but still callable; init's 'surface' concept unexplained). Input schemas are present but parameter descriptions are sparse or missing context. No output schemas documented. Error handling is absent, tools return raw CLI output without recovery guidance. Security concerns: install tool writes to filesystem without validation; scan/init write without clear permission gates. No tool annotations (readOnlyHint, destructiveHint). Composition is weak, tools are CLI-centric, not agent-optimized; no pagination, no structured output guidance, no chaining IDs.
Resolve dependencies from lockfiles and check them against the OSV advisory database
Surface branch changes to a continuous-testing suite: which services changed, who calls them, and what needs testing (JSON by default).
Deprecated: Verify a written cache. Still callable so existing pipelines keep passing, but no longer offered.
What this branch did to the dependency tree
Set `.ccc/` up: a starter service map, and the surface other repos consume. Both come out of one parse of the tree, and both are things a person edits afterwards rather than output to be regenerated blindly.
Analyse the project and emit the insights payload
Install this `ccc` binary onto your PATH (Linux; defaults to ~/.local/bin)
No output schemas documented. LLMs cannot plan downstream calls or extract structured data from tool responses. Agents must parse unstructured CLI output.
Parameter descriptions are sparse or missing context. E.g., 'encoding' param in scan/tokenize lacks explanation of what o200k_base means or when to use alternatives. 'services' in changes uses shorthand 'NAME=GLOB' without explaining glob syntax.
No error handling guidance. Tools return raw CLI exit codes and stderr without recovery hints. E.g., if 'base' ref does not exist in changes, agent gets no suggestion to list available refs or use a default.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 45 | 2026-07-28+ | v2 |
Query prompts and prompt history for agents
Run the code map over HTTP for AI agents and people: REST endpoints (/find /references /dependencies ...), an MCP endpoint at /mcp, and the insights UI at /insights.
Scan this project's own source for security findings
Parse a project and report what the map holds. Writes nothing without `--dir`: the map is what every other command reads, and it is built in memory whether or not a copy is left on disk
Encode a written cache into a token stream
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). Agents cannot distinguish safe reads from destructive writes. scan, init, install all modify filesystem but lack destructiveHint.
install tool accepts a directory parameter and writes binary to filesystem without validation or permission checks. No dry-run or confirmation step. Agents could write to arbitrary paths.