One harness for every AI coding client: guard hooks, skills, subagents, commands, MCP servers, a context engine and a working agreement, authored once here, installed into Claude Code and ported to Codex, Gemini CLI, Cursor and 16 more.
Critical gaps across all dimensions. 18 tools with minimal or no visible schema definitions in source code. Descriptions are present but extremely brief (10-80 chars), well below the 50-200 char LLM-optimized baseline. No input parameter descriptions visible for most tools. Tools like Bash and PowerShell expose dangerous operations with only command/run_in_background params documented, no validation guidance. File tools (Read, Write, Edit, Grep, Glob) lack path validation, encoding, or size constraints. Task/Todo tools are bookkeeping-only with no clear user-facing semantics. No output schemas documented. Error handling is absent, no recovery guidance, no categorization of retryable vs fatal errors. STDIO transport caps protocol readiness at 50, but definition quality itself is severely deficient.
Tool for asking user questions; exempt from repeat-tool-guard as legitimate polling
Shell command execution tool; subject to dev-server-guard and secret-watch hooks
File editing tool; subject to secret-watch hook and guardian policy enforcement
File globbing tool; subject to secret-watch hook
File search tool; subject to secret-watch hook
Tool for monitoring; exempt from repeat-tool-guard as legitimate polling
Notebook editing tool; subject to secret-watch hook and guardian policy enforcement
No input schemas visible for 18 tools. Bash, PowerShell, Read, Write, Edit, NotebookEdit, Grep, Glob show only parameter names and brief descriptions in source; no JSON Schema type definitions, constraints, or validation rules are documented.
Descriptions are extremely brief (10-80 chars), far below the 50-200 char LLM-optimized baseline. E.g., 'Bookkeeping tool for writing todos' (35 chars) lacks context on when to use it, what it returns, or how it fits the agent workflow.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 31 | 2026-07-28+ | v2 |
PowerShell command execution tool; subject to dev-server-guard and secret-watch hooks
File reading tool; subject to secret-watch hook for detecting leaked credentials in output
Bookkeeping tool for scheduling wakeups; transparent to repeat-tool-guard chain
Bookkeeping tool for creating tasks; transparent to repeat-tool-guard chain
Tool for getting task details; exempt from repeat-tool-guard as legitimate polling
Tool for listing tasks; exempt from repeat-tool-guard as legitimate polling
Tool for reading task output; exempt from repeat-tool-guard as legitimate polling
Tool for stopping background tasks; subject to dev-server-guard reminder for Windows process cleanup
Bookkeeping tool for updating tasks; transparent to repeat-tool-guard chain
Bookkeeping tool for writing todos; transparent to repeat-tool-guard chain
File writing tool; subject to secret-watch hook and guardian policy enforcement
Destructive tools (Bash, PowerShell, Write, Edit, NotebookEdit, TaskStop) lack error handling, confirmation steps, or dry-run support. No guidance on recovery if a command fails or a file write is corrupted. No categorization of retryable vs fatal errors.
File tools (Read, Write, Edit, Grep, Glob) expose path parameters with no validation constraints, encoding hints, or traversal guards. LLMs could pass absolute paths, symlinks, or relative paths with '..' sequences without guidance on safe usage.
No output schemas documented for any tool. LLMs cannot plan downstream calls or extract required fields (e.g., task_id after TaskCreate, file_content after Read). Responses are unstructured, forcing LLMs to parse free-text output.