Loading ToolBench
A security-first MCP bridge that lets Codex supervise Reasonix ACP workers.
Three tools with comprehensive schemas and detailed descriptions. reasonix_delegate and reasonix_control have extensive parameter documentation (20-1024 chars per param) with enums, ranges, and clear constraints. reasonix_inspect is simpler but well-described. All tools declare destructive/read-only risk levels via annotations. Schemas use Zod with strict validation. However, output schemas are not documented in the source, LLMs cannot see what these tools return. Error handling guidance is minimal; descriptions focus on input mechanics rather than recovery paths. Tool names are domain-specific (reasonix_*) rather than action-verb style (delegate_task, control_task), reducing discoverability.
Control a task created by reasonix_delegate. On the default happy path, call finalize once after reviewing the returned bundle; finalize waits for a committed terminal result. For finalize, copy review_revision to expected_review_revision and review_tree_hash to expected_review_tree_hash. finalize accepts any valid acceptance id in approved_review_criteria; automated ids are ignored for approval but every review-evidence criterion from required_review_criteria must be approved. If finalize fails, preserve the task at review, inspect or repair it there, then retry with the new snapshot; never copy the diff manually into the source checkout or close the task. Use respond, cancel, close, or steer only for explicit recovery or interaction handling. The returned commit is isolated and must be cherry-picked explicitly; this tool never merges or pushes.
After explicit user approval, delegate one immutable TaskContractV1 to an isolated Reasonix edit worker. For a trivial edit whose local context is already verified, do one focused preflight and delegate directly; do not browse docs or memory solely to construct the contract. write_scope is the exclusive write allowlist and already denies every other path. forbidden_scope is only for sensitive carve-outs inside broader write scopes; never use **/* or another catch-all that matches a concrete write_scope target. Default wait_mode=review holds this call until review, interaction, failure, or timeout; a wait timeout is recoverable and does not cancel the worker. New tasks default to worker_lane=fast (direct edits; no Goal, AutoResearch, review/task skills, or subagents); use worker_lane=deep only for explicitly long-horizon delivery/goal work. Select the lowest reasoning_effort adequate for the task (low is the lowest supported). Set execution_timeout_seconds proportionately (fast default 600, deep default 3600, maximum 14400); omitted resumes retain the stored deadline. Use background only when the caller intentionally wants asynchronous recovery flow. Contract verification and allowed_commands run as exact static argv with no shell: sh -c/bash -c/eval, pipes, redirection, and inline interpreters are rejected. For byte-exact file content, use file_assertions instead of shell comparison commands.
Output schemas not documented. LLMs cannot see what reasonix_delegate, reasonix_control, and reasonix_inspect return. This forces agents to guess field names and types, breaking tool chaining and increasing errors.
Tool names do not follow action-verb convention. 'reasonix_delegate', 'reasonix_control', 'reasonix_inspect' are domain-specific but not verb-noun style (e.g., delegate_task, control_task, inspect_task). LLMs rely on verb prefixes to infer intent.
Error handling descriptions missing. Tool descriptions explain input mechanics but do not guide recovery. E.g., reasonix_delegate says 'delegate one immutable TaskContractV1' but does not explain what errors can occur, when to retry, or what to do if delegation fails.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 69 | 2025-06-18+ | v2 |
Recovery-only bounded inspection of status, evidence, interactions, and optional paginated diff or event output. Events are opt-in. The default two-call happy path uses no inspect polling.
reasonix_control action parameter is a flat enum, but each action has different required/optional fields. The schema uses discriminatedUnion internally (controlDomainSchema) but the wire schema flattens it. LLMs may pass invalid field combinations (e.g., 'message' with action='finalize').
reasonix_delegate contract parameter is a complex nested object (TaskContractV1) with no inline schema documentation. LLMs cannot see the structure of verification, allowed_commands, or file_assertions without external docs.