Loading ToolBench
Git-based governance hooks for AI coding agents. Prevents hollow artifacts, SSoT pollution, and enforces commit/branch standards.
This MCP server has severe definition quality gaps. Of 27 tools, only 3 (verify, verify:server, doctor) have visible input schemas with parameter descriptions. The remaining 24 tools either lack schemas entirely or have inferred definitions without explicit registration. Descriptions are present but often generic (e.g., 'Manage lessons' for lesson tool). No tool declares output schemas. Error handling is minimal, most tools lack recovery guidance. The server is primarily a CLI wrapper around Git hooks and governance checks, not a well-structured MCP tool suite. Tool naming is inconsistent (verify vs verify:server uses colon; lesson, growth, feedback lack verb prefixes). No tool annotations (readOnlyHint, destructiveHint) are visible. Security-sensitive tools like init (WRITE risk) and feedback (WRITE risk) lack permission gates or audit trail documentation.
Read-only pattern extraction from a target project
Enforces branch naming conventions
Enforces conventional commit format
Audits dependencies for vulnerabilities
Health check — verify config, hooks, and guard status
Evaluate artifact quality with DSPy semantic analysis
Enforces federation and ticket state provider checks
Record TP/FP/FN/TN labels for guards
24 of 27 tools lack visible input schemas. Only verify, verify:server, doctor, and eval have documented parameter schemas. Remaining tools (lesson, growth, feedback, all *Guard tools) have no schema definitions visible in source code.
No tool declares output schemas. LLMs cannot plan downstream calls or extract required fields without knowing what each tool returns. All 27 tools lack documented return types.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 35 | 2026-07-28+ | v2 |
Enforces file size limits
Manage growth metrics checking the system's learning velocity
Enforces human-in-the-loop review requirements
Detects hollow/template artifacts without substantive content
Install Git hooks (pre-commit + pre-push) into your project
Manage lessons (án lệ) in the local memory
Guard effectiveness analytics — F1 scores from feedback
Prevents stub return values
Prevents swallowed/empty error handlers
Prevents trivially true test cases
Prevents type safety bypasses (e.g., 'any' types)
Enforces phase gate requirements
Prevents root directory pollution
Detects secrets and sensitive information
Protects defense-in-depth configuration from tampering
Prevents Single Source of Truth pollution
Verifies ticket identity and federation
Run all guards against staged files or a path
Verify server-side branch protection on GitHub matches baseline
Tool naming inconsistencies and lack of verb prefixes. 'lesson', 'growth', 'feedback' do not start with action verbs (should be 'record_lesson', 'check_growth', 'record_feedback'). Colon-based naming (verify:server) is non-standard. Guard tools use *Guard suffix instead of verb_noun pattern.
Destructive/sensitive tools (init, feedback, lesson) lack permission gates, audit trail documentation, and error recovery guidance. No tool declares required scopes or permission checks. Security-critical operations are not gated.
Generic descriptions for 14 tools. 'Manage lessons', 'Manage growth metrics', 'Record TP/FP/FN/TN labels' lack context for LLM selection. No descriptions explain WHEN to use each tool vs alternatives, or what prerequisites exist.