Loading ToolBench
A self-hosted Codex app-server shell with Web/Feishu entrypoints and platform-gateway integration for managing digital employees (managed agents), operations ledger, and scheduled tasks.
Themis exposes 21 tools with significant definition gaps. Tool names follow verb_noun convention (list_, get_, create_, update_, dispatch_, manage_, provision_) which is good. However, most tools lack visible input schemas in the provided source. Only 6 tools (11-17) show explicit parameter schemas with type definitions and descriptions. The remaining 15 tools have descriptions but no visible schema definitions in the code excerpt. Descriptions vary widely: some are detailed (e.g., dispatch_work_item at ~200 chars), others are terse (e.g., list_managed_agents at ~50 chars). No output schemas are documented. Error handling guidance is absent. Security concerns: manage_themis_secret and provision_worker_secret handle credentials but lack explicit documentation of secret injection patterns. The codebase shows sophisticated domain logic (managed agents, operations ledger, scheduled tasks) but tool definitions are not production-grade.
Cancel a previously scheduled task
Create a new digital employee (managed agent)
Create a new operation edge (relationship) between operation objects using relationship types: depends_on, blocks, mitigates, tracks, relates_to, evidence_for
Create a new operation object (Asset, Decision, Risk, Cadence, or Commitment) in the operations ledger
Create a scheduled task or reminder with optional recurrence (daily, weekly, monthly) and optional work item watch
Dispatch work to a managed agent with optional read-only fact source packs (cloudflare_readonly, operations_ledger_readonly, feishu_base_readonly) and secret environment references
Missing input schemas for 15 of 21 tools. Only tools 11-17 and 19-21 show explicit parameter schemas with type definitions. Tools 1-10 and 18 have no visible schema in source code, violating pattern:constrained-input and pattern:tool-description.
No output schemas documented for any tool. LLMs cannot plan downstream calls or extract required fields (e.g., agent_id, work_item_id) without knowing response structure. Violates pattern:tool and pattern:response-shaper.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 45 | 2025-06-18+ | v2 |
Get detailed information about a specific managed agent including its dossier, workspace, and runtime boundary
Get read-only operating status view of the operations ledger
Inspect a dispatched work item, its current status, runs, completion detail, messages, and parent/child collaboration summary
List managed agents in the current session
List operation edges (relationships between operation objects) from the operations ledger
List operation objects (Asset, Decision, Risk, Cadence, or Commitment) from the operations ledger
List all scheduled tasks in the current session
Manage Themis password book: list, get, set, rename, or remove secret references. Never returns secret values, only metadata and existence status.
Generic worker credential delivery tool for existing Themis password-book secret references, with support for Cloudflare and other credential modes
Query the operation graph to inspect blast radius, dependencies, and shortest paths between operation objects
Update a managed agent's employee dossier
Update a managed agent's execution boundary and workspace policy
Pause, resume, or archive managed agents
Update an existing operation edge in the operations ledger
Update an existing operation object in the operations ledger
Credential handling (manage_themis_secret, provision_worker_secret) lacks explicit documentation of secret injection patterns. No evidence of server-side secret storage or environment variable injection. Violates pattern:secret-injection.
No error handling guidance. Tools lack recovery hints, error categorization (retryable vs fatal), or actionable error messages. Violates pattern:recovery-guide and pattern:error-classification.
Descriptions for tools 1-10 are terse (35-75 chars) and lack WHEN/WHY context. Baseline for A+ tools is 50-200 chars with clear selection criteria. E.g., 'List managed agents in the current session' does not explain when to call it vs get_managed_agent_detail.