Loading ToolBench
Self-creating AI agent with constitution, background consciousness, and persistent identity
Ouroboros exposes 12 high-risk tools (command execution, file write, service control) with minimal safety guardrails visible in the schema. Tool descriptions are present but generic (avg ~60 chars, well below the 194-char baseline). Parameters lack type constraints (no enums for language/root choices), and no input validation or error recovery guidance is documented. Schemas are visible but sparse, no output schemas documented, no pagination support, no idempotent hints. The tool set conflates multiple concerns (e.g., run_command + run_script could be one tool; edit_text + edit_batch + apply_patch overlap). No evidence of permission gates, audit logging, or secret injection patterns. This is a high-capability but low-safety toolkit typical of internal automation, not production agent tooling.
Apply unified diff patches to files
Apply multiple file edits in a single atomic operation
Edit file contents with line-based or regex replacements
List directory contents with path confinement
Query code structure using tree-sitter AST analysis
Read file contents with path confinement and truncation
Execute shell commands with timeout and output capture
No output schemas documented for any tool. LLMs cannot plan downstream calls or extract required fields (e.g., does run_command return stdout, stderr, exit_code separately or combined?). Violates pattern:tool and pattern:response-shaper.
Destructive tools (run_command, write_file, edit_text, apply_patch, start_service, stop_service) lack confirmation/dry-run support and no error recovery guidance. No indication of retryability or side effects. Violates pattern:confirmation-request and pattern:recovery-guide.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 54 | 2026-07-28+ | v2 |
Execute Python or shell scripts with timeout and output capture
Search repository code with regex patterns and file filtering
Start a background service or daemon process
Stop a running background service or daemon process
Write or create files with path confinement and policy checks
Parameters 'root' (read_file, write_file, list_files) and 'language' (run_script, query_code) accept free-form strings with no enum constraints. LLMs will hallucinate invalid values. Should declare allowed values: root ∈ {active_workspace, repo, user_files, ...}; language ∈ {python, shell, ...}. Violates pattern:constrained-input.
Tool descriptions are generic and under 60 chars on average (baseline 194 chars). E.g., 'Execute shell commands with timeout and output capture' lacks WHEN to use, WHAT it returns, or error guidance. Descriptions should be 50 - 200 chars and answer: what, when, what-if-error. Violates pattern:tool-description.
Tool composition issues: edit_text, edit_batch, and apply_patch all modify files but with different interfaces (line-based, array, unified diff). LLMs must reason about which to use. Consolidate into one canonical edit tool or clearly document when each applies. Violates pattern:tool (single responsibility).