Loading ToolBench
Byzantine Fault Tolerant consensus middleware that protects the persistent memory of AI agents from poisoning attacks.
Two well-named tools with clear, detailed descriptions and complete input schemas. write_memory and read_memory follow verb_noun convention and include comprehensive parameter documentation. Descriptions (200+ chars each) explain WHAT, WHEN, and WHY. Input schemas define all parameters with types and defaults. However, output schemas are not formally documented in the tool definitions, responses are inferred from code inspection. Error handling is minimal; no recovery guidance for constraint violations (e.g., invalid source values). No tool annotations (readOnlyHint, destructiveHint). Composition is sound: two focused tools, no overlapping responsibilities.
Retrieve up to `top_k` memories most relevant to `query`. Each result includes its source and confidence_score, with low_confidence=True flagged explicitly for anything below LOW_CONFIDENCE_THRESHOLD — per CLAUDE.md's read flow, low-confidence memories should be surfaced to the caller, not silently trusted the same as everything else.
Propose writing `content` to Lagrange's Byzantine-consensus-protected memory. source: "verified_user" for content directly and verifiably from the authenticated user in this conversation, or "external_unverified" (the default) for anything else — a document, webpage, email, tool output, or content you're otherwise not certain originated with the user. This tool can never write source="internal_system"; only trusted, non-agent-facing code can do that. origin: where the content came from — "direct_chat" (default), "email", "webpage", "readme", "document", or "tool_output". Used by the temporal node to detect indirect injection vectors. The memory is only actually stored if the nodes reach consensus on its provenance; otherwise it's quarantined, and this call still returns normally with accepted=False so you can see what happened.
Output schemas not formally documented. Tool descriptions explain return structure in prose, but no JSON Schema definition visible in tool registration. LLMs cannot reliably parse response structure without explicit schema.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). write_memory is destructive (modifies consensus state); read_memory is read-only. Annotations enable LLM safety reasoning and prevent misuse.
Minimal error handling and recovery guidance. write_memory validates source enum but returns ValueError with no actionable next step. No guidance for quarantined writes or low-confidence reads.
Parameter 'origin' accepts free-form strings with no enum constraint. Description lists examples ('direct_chat', 'email', 'webpage') but does not enforce them. LLMs may pass invalid values.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 67 | 2026-07-28+ | v2 |
read_memory returns up to top_k results but no pagination metadata (total_count, next_cursor). Large result sets could exhaust context; no guidance on limiting or iterating.