Security-hardened AI agent runtime on Cloudflare Workers — defense-in-depth reference implementation
Critical gaps across all dimensions. 41 tools with minimal schema visibility, most lack explicit input/output documentation in source. Descriptions range from trivial (5-10 chars: 'Search Jira issues') to moderately detailed (container_shell: 120 chars). No parameter descriptions visible for 35+ tools. No output schemas documented. Error handling absent. Security-critical tools (git_push, browser_evaluate, google_docs_update) lack confirmation/dry-run patterns. Tool composition is poor: browser_* tools duplicate functionality; mem_* and workspace_* are underspecified. Naming is inconsistent: 'container_*' prefix for local tools, but no clear verb-noun pattern for many (e.g., 'mem_search' vs 'search_memory'). This is a reference architecture that prioritizes security policy over tool usability.
Add a comment to a Jira issue
Execute a batch of web actions
Search the web using Brave Search
Click an element on the page
Evaluate JavaScript on the page
Fill a form field on the page
Navigate to a URL in the browser
Take a screenshot of the current browser page
35 of 41 tools have no visible input schema in source code. This violates pattern:constrained-input and pattern:tool-description.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 38 | 2026-07-28+ | v2 |
Select an option from a dropdown
Take a snapshot of the current browser page
Check if a HITL confirmation has been approved
Execute git commands within allowed directories. Access tier controls which sub-commands are available (read: log/status/diff/blame; write: add/commit/stash). Push is never available locally — push goes through the Worker with HITL approval.
Execute approval-gated OpenClaw CLI diagnostics commands. Requires HITL approval for gateway-dependent commands.
Execute read-only shell commands for container inspection. Commands are restricted to a safe allowlist and paths are validated against allowed directories.
Execute web crawling via Crawl4AI with Browserbase CDP support. Validates URLs against SSRF and exfiltration patterns.
Create a Google Calendar event
Create a new Jira issue
Get a Granola meeting
Get a Jira board
Get a Jira issue by ID
Get runtime information about the agent
Push commits to a git repository
Get Google Calendar events
List Google Calendars
Append content to a Google Doc
Create a Google Doc
Read a Google Doc
Update a Google Doc
List Google Drive files
List Gmail messages
List Granola meetings
Write an observation to the agent's long-term memory
Search the agent's long-term memory
Query Granola meetings
Rank a Jira issue
Search Jira issues
Send an email via Gmail
Send a message via Telegram
Transition a Jira issue to a new status
Update a Jira issue
List files in the workspace
Tool descriptions are trivial (5-20 chars) for 35+ tools: 'Search Jira issues', 'Get a Jira issue', etc. These lack WHEN to use, WHAT it returns, and dependencies.
Destructive/irreversible tools (git_push, google_docs_update, browser_evaluate, delete operations) lack confirmation, dry-run, or HITL approval patterns. Per pattern:confirmation-request, agents must not execute irreversible ops without explicit user consent.
No output schemas documented for any tool. Per pattern:tool, LLMs need to know what fields to expect in responses to plan downstream calls. Absence forces LLMs to guess field names and types.
No parameter descriptions visible for 35+ tools. Bare parameter names like 'command', 'args', 'url' without context force LLMs to infer intent.