Loading ToolBench
Persistent agent memory sold per-call via x402. Namespace = payer wallet address (your wallet is your memory). Semantic (embedding) search. MCP + HTTP.
memory-mcp defines 4 tools with reasonable naming (verb_noun pattern) and descriptions (100-150 chars each). All tools have input schemas with typed parameters and descriptions. However, output schemas are not documented, LLMs cannot predict response structure. Parameter descriptions lack constraints (e.g., max content length stated in code but not in schema descriptions). Error handling is minimal; no recovery guidance. Security model relies on x402 payment verification but lacks explicit permission/scope declarations. Tool composition is sound (each does one thing), but missing pagination details and result limits in schema.
Export memories from a namespace as JSON (paginated, max 1000 per call).
Semantic search over memories in a namespace using vector embeddings.
Get statistics about a namespace (free call, no payment required).
Write a memory entry to the namespace. Supports semantic embedding, tagging, and supersession tracking.
Output schemas not documented. LLMs cannot predict response structure (fields, types, pagination). memory_search and memory_export return lists but lack documented pagination cursors or total counts.
Parameter constraints not in schema descriptions. Code enforces MAX_CONTENT=8000, MAX_EXPORT=1000, k max=20, but these limits are invisible to LLMs. Descriptions say 'max 8000 chars' for content but not for other params.
No error recovery guidance. Tools validate namespaces and grants but return generic ValueError messages. LLMs receive 'payer wallet could not be determined' with no hint on how to retry or what to provide next.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 67 | 2026-07-28+ | v2 |
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). memory_write is destructive (supersedes old entries) but unmarked. memory_search and memory_export are read-only but not annotated. Agents cannot infer safety properties.
Grant and agent-keyed memory parameters (on_behalf, grant, agent_id) lack clear mutual-exclusivity documentation. LLMs may pass conflicting combinations without guidance on which takes precedence.