Loading ToolBench
The Weave 2.0 — markdown-native agentic AI memory architecture. Five-pattern engine over a plain-markdown vault, exposed via the Model Context Protocol.
TheWeave exposes 7 tools with clear verb-noun naming (view, hydrate, recall, create, str_replace, insert, delete). All tools have descriptions (avg ~180 chars, within baseline 194). Input schemas are present with typed parameters and descriptions. However, output schemas are undocumented, LLMs cannot predict return structure. Error handling is minimal; tools return raw strings without recovery guidance. The write-gate advisory mechanism is sophisticated but not exposed as a tool feature. No tool annotations (readOnlyHint/destructiveHint) despite clear risk stratification in the code.
Create or overwrite a file at the given vault-relative path. Entity/signal writes get an ADVISORY conflict proposal appended (verdict + rationale + sibling candidates); the write always proceeds.
Delete a file (or empty directory) at the given vault-relative path.
Hydrate an entity into an injectable role + memory preamble. STRICTLY READ-ONLY — never writes to the vault. Returns a tiered, security-bound preamble (identity + red_lines + charter + guardrails, then nonce-fenced domain memory/signals). Missing soul/entity or a superseded entity returns an honest '[hydrate-error] ...' string rather than a fabricated persona. Registered before the read-only guard so a WEAVE_READONLY peer can hydrate without any write verb.
Insert content BEFORE the given 1-indexed line (line=0 prepends).
Hybrid semantic recall over the vault (cortex: dense + graph PPR). READ-ONLY. Finds notes by MEANING, not just entity-name mention; includes superseded notes (marked) so history is reachable; abstains honestly when nothing in the vault is semantically close. With the cortex absent or the embedder down it degrades loudly to the plain PPR boot retriever (today's behavior) instead of failing. `lane` (lane firewall): one of "operational" (default), "thesis", "neutral". Only notes in the requested lane (or neutral) are ever retrievable — choosing a lane is a deliberate anonymisation-boundary decision, never auto-detected from the query.
Output schemas undocumented. Tools return strings without structured field definitions. LLMs cannot predict return structure or chain results to downstream tools.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). Code clearly marks tools as READ_ONLY or WRITE/DESTRUCTIVE, but MCP schema does not expose this. Agents cannot reason about safety.
Error handling returns raw strings (e.g. '[hydrate-error] ...'). No recovery guidance. LLMs cannot determine if error is retryable, user-fixable, or fatal.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 60 | 2026-07-28+ | v2 |
Replace exactly one occurrence of old_str with new_str in the given file.
View a file or directory in the vault. Optionally restrict to a line range (1-indexed, inclusive).
Parameter 'lane' in recall accepts free-form string; should be enum ['operational', 'thesis', 'neutral']. Prevents hallucinated values.
create/str_replace/insert/delete lack confirmation or dry-run support. Irreversible operations should offer confirmation pattern to prevent agent mistakes.