Loading ToolBench
Local-first trust layer for AI coding agents — structural prompt-injection and action guards, secret scanning, semantic memory, and code review. No model API required.
Nexus provides 17 tools with explicit schemas and descriptions. Most tools have clear, action-oriented names (nexus_scan, nexus_guard, nexus_secrets) and detailed descriptions (100-300 chars). However, several tools lack parameter descriptions, output schemas are not documented, and error handling guidance is minimal. Tool composition is reasonable, each tool has a single responsibility, but chaining support is weak (no IDs returned to enable downstream calls). Security-focused tools (guard, secrets, scan) are well-described; memory and knowledge tools are generic. No tool annotations (readOnlyHint/destructiveHint) despite clear risk profiles.
Extract learned skills and knowledge from memory.
Agent firewall: vet untrusted content for prompt injection, and/or screen a shell command for danger, BEFORE acting on it. Pass `content` (e.g. a fetched page, an issue body, a tool result) and/or `command` (a shell command you're about to run). Returns a verdict — for content: block/warn/allow; for commands: deny/ask/allow — with a reason. Local, with no model API required.
Quick check: is this text safe from prompt injection? Returns true/false.
Render the knowledge base extracted from memory.
Map the architecture of a codebase — files, imports, dependencies, entry points, hotspots.
Add an observation to the semantic memory store.
Query the semantic memory store for knowledge related to a topic.
Output schemas not documented. Tools return structured responses (via safeExternalResponse, sanitizeExternalContent) but LLMs cannot see what fields to expect. Breaks downstream tool chaining and forces agents to parse unstructured text.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). nexus_memory_add is WRITE but unmarked; nexus_secrets, nexus_guard, nexus_review are READ_ONLY but lack explicit annotations. Agents cannot infer safety/retry semantics.
Memory and knowledge tools (nexus_memory_query, nexus_memory_add, nexus_knowledge_base, nexus_extract_skills) have generic descriptions (<70 chars). No guidance on when to use memory vs knowledge_base, or how to structure observations for semantic search.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 68 | 2026-07-28+ | v2 |
Get statistics about the semantic memory store.
Generate a human-readable onboarding guide for a codebase.
Parse a specific AI session and return its messages, tools, and topics.
Review a source file for bugs, security issues, AI slop, performance problems, and dead code. 19 detectors.
Scan text for prompt injection attacks. 6 local detection layers and 100+ rules across English plus 10 language packs.
Scan a directory for leaked credentials — API keys, tokens, private keys — in the working tree and, optionally, across git history (secrets committed then removed remain exposed in history). Returns redacted findings; raw secret values are never included.
List all AI sessions from Claude Code and OpenClaw.
Suggest fixes for broken tests.
Check test suite health — broken imports, stale mocks, missing tests, and a tested-file estimate.
Validate a configuration file for common issues.
No error handling guidance. Tools return sanitized responses but do not document failure modes (e.g., 'file not found', 'invalid git history', 'entropy scan timeout'). Agents cannot self-correct on errors.
Parameter descriptions missing or minimal. nexus_secrets has 4 params (directory, include_history, entropy, max_commits) but descriptions are terse. nexus_memory_query 'limit' param lacks guidance on default/max. Agents cannot infer valid ranges.