A native macOS AI assistant application with local LLM inference via MLX, tool calling support, and modular extensions for web search and other capabilities.
Klee defines 7 tools with basic schemas and descriptions, but falls short of production quality. All tools have descriptions (10-100 chars, mostly adequate) and input schemas with type declarations. However, schemas are overly simplistic, all parameters are typed as 'string' with no enums, ranges, or format constraints. Descriptions lack actionable guidance on when to use each tool, error recovery, or prerequisites. Critical security issues: file_write, file_delete, and shell_exec are high-risk operations with no mention of permission gates, dry-run modes, or confirmation patterns. No output schemas documented. Error handling is absent, no guidance on retryability, user-fixable vs fatal errors, or recovery steps. Tool composition is reasonable (each does one thing), but parameter naming could be more explicit (e.g., 'path' should clarify 'absolute_file_path' or 'directory_path').
Delete a file or directory at the given path.
List files and directories at the given path.
Read the contents of a file. Returns the text content, truncated if too large.
Create or overwrite a file at the given path. Parent directories are created automatically.
Execute a shell command via /bin/zsh. Has a 30-second timeout. Use for system operations, running scripts, or checking system state.
Fetch a webpage and extract its content as clean text. Uses Jina Reader for markdown extraction.
Search the web for information. Returns top results with titles, URLs, and content snippets.
All parameters typed as 'string' with no enums, ranges, or format constraints. LLMs cannot validate input and will pass arbitrary values. E.g., shell_exec accepts any command string with no injection guards documented.
No output schemas documented. LLMs cannot plan downstream tool calls or extract structured data. E.g., file_list returns unknown structure; web_search returns unknown fields.
Destructive operations (file_delete, file_write, shell_exec) lack confirmation or dry-run patterns. No mention of permission gates or audit trails. Agents can delete files or execute arbitrary commands without safeguards.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 50 | 2026-07-28+ | v2 |
No error handling guidance. Descriptions do not explain retryability, user-fixable errors, or recovery steps. E.g., file_read does not explain what happens if file is too large or unreadable.
Parameter descriptions lack actionable constraints. 'Absolute file path (~ expands to home directory)' does not specify max length, character restrictions, or symlink handling. LLMs cannot validate inputs.