Loading ToolBench
Expose any HiveGuard BaseAgent subclass as a Model Context Protocol (MCP) server. Brings HiveGuard-secured Python agents to OpenClaw, Claude Desktop, and any other MCP-compatible host.
Strong security-focused tool set with well-defined schemas and descriptions. All 17 tools have explicit input schemas with proper JSON Schema structure and type definitions. Descriptions are detailed (avg 150+ chars) and explain purpose, constraints, and security invariants (INV-08, INV-11, INV-19). However, naming conventions are inconsistent: tools like 'health', 'lifecycle_state', 'echo', 'add' lack action verbs; 'fetch_url_safe' and 'parse_json_safe' use '_safe' suffix instead of clear verb_noun pattern. Output schemas are not documented in tool definitions. Error handling is implicit (relies on HiveGuard framework) rather than explicit in tool descriptions. No tool annotations (readOnlyHint, destructiveHint) despite all being READ_ONLY.
Add two integers.
Recent audit log entries from the wrapped agent. Returns up to 'limit' entries (default 20, max 200). Output is recursively scrubbed for sensitive keys (api_key/password/token/credential/private_key).
Return public info about this agent.
Echo back a message.
HTTP fetch with SSRF block + rate limit + DNS-rebinding defense + redirect validation + scrubbed response. INV-08/12/16.
SHA-2/3, BLAKE2 only (INV-19 allowlist).
Wrapped agent's health: status, uptime, lifecycle state, and event-loop activity. Note: `lifecycle_state` (RUNNING/FROZEN/etc.) and `event_loop_active` (boolean) are distinct — call `lifecycle_state` tool for full state details.
Inconsistent naming: 'health', 'echo', 'add', 'lifecycle_state' lack action verbs. LLMs infer intent from verb_noun pattern (get_*, create_*, validate_*). Generic names like 'echo' and 'add' do not convey security or agent-specific purpose.
Output schemas not documented in tool definitions. Tool descriptions state what is returned (e.g. 'Returns up to limit entries') but do not specify the JSON structure. LLMs cannot plan downstream calls without knowing response field names and types.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite all tools being READ_ONLY. Current MCP spec (2026-07-28) supports tool annotations to guide agent planning and safety checks.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 68 | <=2025-11-25 | v2 |
List of HiveGuard security invariants the wrapped agent satisfies (the spec). Useful for auditors + compliance tooling.
Returns secret-shaped data for testing the output scrubber.
Current lifecycle state of the wrapped agent (DORMANT / RUNNING / HIBERNATING / PAUSED / FROZEN / ESCALATED / RESTING / DECOMMISSIONED).
Strict JSON parse with depth + key caps.
CSPRNG-backed token. Hex/base64url/base32.
Detect + redact emails, phones, IBANs (with mod-97), national IDs, credit cards (Luhn), IP addresses, postal codes. The PII protection primitive.
Recursive scan + redact sensitive substrings (INV-08).
Sanitize JSON value (INV-11): strip control chars, cap depth/length/string size.
Preflight URL check (no fetch). Returns whether fetch_url_safe would allow the URL.
Constant-time HMAC verification. Approved algorithm allowlist (INV-19).
Error handling guidance missing from tool descriptions. Tools like 'fetch_url_safe' and 'parse_json_safe' mention constraints (SSRF block, depth caps) but do not document what errors are returned or how to recover. LLMs need explicit error classification (retryable, user-fixable, fatal).
Test/demo tools ('echo', 'add', 'leaks_test_credential') mixed with production security tools. These should be in a separate optional tool set or removed from the default export to avoid LLM confusion and accidental misuse in production agents.