apcore integration for pydantic-ai: governed modules as agent tools, and agent tools as governed modules
This is a pydantic-ai integration library, not a standalone MCP server. Tool definitions are inferred from apcore module descriptors at runtime via _descriptor_to_tool_def(), not explicitly registered in source. Schemas are present but minimal. Descriptions vary widely: crm_read and send_invoice have adequate descriptions (20-40 chars), but lookup lacks any description, and recent_activity's description is meta-commentary ('Needs the agent run context...') rather than actionable guidance. No parameter descriptions visible in schema definitions. No output schemas documented. Error handling deferred to apcore pipeline with no recovery guidance surfaced to LLM. Tool composition is reasonable (single responsibility), but naming lacks consistency (crm_read vs send_invoice vs wire_transfer, mixed verb_noun patterns). No evidence of idempotency markers, confirmation gates for destructive ops, or rate limiting.
Delete a CRM record
Read a single CRM record
Needs the agent run context, so apcore cannot invoke it.
Refund a payment in full.
Send an invoice to a customer.
Move money to an external account.
Tool definitions inferred from runtime descriptors, not explicitly registered in source code.
recent_activity description is meta-commentary ('Needs the agent run context...') rather than actionable guidance for LLM. Does not explain WHAT the tool does or WHEN to use it.
No parameter descriptions visible in schema definitions. Rubric requires every parameter to have a description explaining what it controls. 'record_id', 'customer_id', 'amount', 'confirmed', 'account', 'q', 'limit' lack context.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 45 | 2026-07-28+ | v2 |
Destructive tools (crm_delete, wire_transfer) lack confirmation gates or dry-run support. No evidence of idempotency markers or recovery guidance. Agents can trigger irreversible actions without safeguards.