A shared tool-call interception substrate for agent safety demos. Provides middleware-based governance of agent tool calls with policy gates, injection tripwires, and flight recording.
This is a demo/shim server with minimal production intent. All 6 tools have basic descriptions (10-50 chars) and simple input schemas with only 1-2 parameters each. Schemas are present but lack depth: no enums, no format constraints, no output schema documentation. Descriptions are too brief to guide LLM selection (e.g., 'Read the contents of a file from the workspace' is generic). No error handling guidance, no parameter validation rules, no security warnings despite destructive/irreversible operations. Tools are well-named (verb_noun pattern) but lack the richness expected of production tools. The shim is intentionally lightweight for demo purposes, not a reference implementation.
Delete a file from the workspace
Make an HTTP GET request to a URL
Make an HTTP POST request to a URL with optional body
Read the contents of a file from the workspace
Execute a shell command
Write content to a file in the workspace
No output schema documentation. Tools return free-text strings; LLMs cannot parse structured results or chain calls.
Descriptions are too brief (10-50 chars). They lack context on WHEN to use each tool, prerequisites, or side effects. Pattern baseline is 194 chars.
Destructive/irreversible operations (delete_file, run_shell) lack confirmation or dry-run support. No error guidance on recovery.
No parameter constraints (enums, ranges, patterns). 'path' and 'url' accept any string; 'command' is unbounded. LLMs will hallucinate invalid values.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 54 | 2026-07-28+ | v2 |
No error handling guidance. Tools return simulated results; real errors (file not found, network timeout, permission denied) are not documented.