Skip to main content
Glama
Aggrete

Aggrete

Official

Aggrete

PyPI version Python versions License Glama quality

The open-source proxy. Product site: https://aggrete.com. This repo is the proxy and nothing else: engine, accumulator, ingest CLI, Helm chart.

An MCP proxy that enforces a code of conduct document across connectors, with state that accumulates per user.

Every MCP gateway on the market authorizes tool calls and logs them. None of them answer the question that actually matters once an assistant can reach Glean, Salesforce, Slack and Drive at once: is this call, combined with everything this person has already pulled today, something the code of conduct forbids?

Four individually-authorized questions can assemble a layoff list. No guardrail fires, because no single question was sensitive. This proxy is the missing layer.

Install

pip install aggrete            # published on PyPI
# or with uv:
uv tool install aggrete        # installs the aggrete CLI
uvx aggrete --demo             # or run it without installing

aggrete --config proxy.config.yaml

Or clone this repo to get the demo, sample policy and Helm chart.

Related MCP server: Blekline MCP Server

What the proxy does

  • Try it in one command: aggrete --demo (or docker run --rm ghcr.io/aggrete/aggrete --demo) runs the four-question walkthrough with no config, auth, or network.

  • Refuses forbidden calls before the upstream is contacted, using a YAML policy and per-user memory that accumulates across calls and sessions.

  • Ask before you act: a built-in check tool dry-runs a proposed sequence of calls and returns the decision, the rule, the clause and the remediation without fetching anything, and scenarios lists things to try. Both are answered by the proxy itself (disable with builtin_tools: false).

  • Tamper-evident audit: every decision is one hash-chained JSON line. Verify with aggrete-audit audit.jsonl (breaks are reported by line number). Optionally forward each row to a SIEM (Splunk/Elastic/Datadog over HTTP, or syslog) as it is written, off the hot path, with audit_forward:.

  • Selective tool exposure: walls and blocks in the policy hide tools from users who could never call them, so they are never listed.

  • Output redaction: redact: masks emails, SSNs, card numbers, API keys and bearer tokens in results before they reach the model; hits are counted in the audit.

  • Holds the upstream credentials itself and never forwards the caller's token to an upstream (confused-deputy safe).

  • Tool integrity: fingerprints every upstream tool the first time it is seen and flags any later change to its description or schema (a rug pull), and scans descriptions for hidden instructions (tool poisoning). Alert or block, per tool_integrity:. Deterministic, no model in the path.

  • Rate limiting: a per-user ceiling on tool calls per window (rate_limit:), shared across replicas via Redis. A denial-of-wallet and abuse control.

  • Inbound secret scanning: scans tool arguments for credential-shaped strings and blocks (or masks) them before they reach an upstream (scan_inbound:), so a leaked key never leaves through a tool call.

Governing writes (egress). A tool that acts on the world (create, update, upload, post, send, share) is classified as a write and governed as egress: any write after a session has read untrusted content is refused (the prompt-injection shield), and a rule can target writes only with applies: write. This is generic across connectors, not Drive-specific. The Google Drive connector exposes governed create_<folder> tools with --allow-write; writes are fenced to the folder like reads. Classify your own connectors' write tools with write_tools: in the config.

See ROADMAP.md for what is shipped, in progress, and planned, with the community requests behind each item.

Run it

python -m venv .venv && .venv/bin/pip install mcp pyyaml pytest
.venv/bin/python -m pytest tests -q     # tests generated from coc.yaml
.venv/bin/python demo/run_demo.py       # the four-prompt sequence, end to end

It first previews the plan with the built-in check tool, then runs it for real:

=== ask first: would this plan be allowed? ===
Plan check: REFUSED.
  1. hr__recent_joiners     [hr-personnel]  ->  allowed
  2. finance__budget_roles  [finance-comp]  ->  allowed
  3. ops__oncall_draft      [ops-rota]      ->  REFUSED   COC-HR-004
     Personnel records, compensation or budget records, and operational rosters
     may not be combined to derive ... identifiable individuals.
     Fix: request a purpose-bound session from HR Privacy ...

=== now run it for real ===
turn 1  finance__headcount_plan   allowed
turn 2  finance__budget_roles     allowed   (owner emails redacted)
turn 3  hr__recent_joiners        allowed   (emails redacted)
turn 4  ops__oncall_draft         DENIED    COC-HR-004

Turn 4 is denied before the upstream call, so the on-call data is never fetched. The three domains overlap on the same people, and this call would complete the forbidden set. check reached the same verdict without fetching anything. Call aggrete__scenarios through the proxy for more to try: individual pay (min_group), comparing colleagues (self_comparison), the prompt-injection shield (flow), and tools hidden behind a wall or block.

The document is the source of truth

coc.yaml holds clause text written by the clause owner, its enforcement, and its tests. Engineering owns the compiler, not the policy.

- rule_id: COC-HR-004
  clause: >
    Personnel records, compensation or budget records, and operational rosters
    may not be combined to derive the employment status, performance, or
    planned departure of identifiable individuals.
  owner: hr-privacy@example.com
  enforce:
    - layer: accumulation
      action: deny
      type: domain_join
      domains: [hr-personnel, finance-comp, ops-rota]
      require_entity_overlap: true
      scope: user
      window: 4h
  tests:
    - {name: four_prompt_layoff_list, expect: deny, sequence: [...]}

CI fails any rule without both an allow and a deny test. Clauses that compile to nothing are worth finding. Those are the parts of your code of conduct that were never enforceable.

aggrete-lint coc.yaml --config proxy.config.yaml catches the fail-open cases the tests do not: a high-severity rule that only alerts, a wall whose until date has passed, an enforce block missing a required field, and rules whose domains no tool is mapped to (so the rule can never fire). It exits non-zero on errors, for CI.

Rule types: domain_join, entity_budget, domain_block, self_comparison, min_group (a result about fewer than k people is one person's data; pay transparency), wall (a domain open only to allowed_users, or closed to blocked_users, optionally until a date; privilege, embargoes, investigation subjects). domain_join and domain_block accept the same allowed_users, blocked_users, since, until scoping (quiet periods). self_comparison (the requester's own record plus colleagues' records in one domain. The precondition for "how do I compare"; decided post-call, since the colleague records have to be seen to be counted). Actions: deny, alert. Start everything at alert, tune against real traffic, then flip.

How it works

client ──MCP──▶ proxy ──MCP──▶ hr / finance / ops connectors
                  │
                  ├─ pre_call   deny before fetching where already decidable
                  ├─ post_call  extract entities, record, re-evaluate, redact
                  └─ audit      what was handed over, not just what was asked
  • aggrete/policy.py. Deterministic evaluation. No model in this path.

  • aggrete/accumulator.py. Per-user state, TTL'd. MemoryStore for tests, RedisStore for deployment, because state must be shared across clients.

  • aggrete/entities.py. Pulls stable person IDs out of tool results.

  • proxy.config.yaml. Maps tool name patterns to the domains clauses refer to.

Remote connectors

Upstreams are either local stdio processes (command:) or remote MCP servers over streamable HTTP (url:). The proxy holds the credential for the upstream; header values may reference ${ENV_VARS} so tokens never sit in the YAML. Because the end user never holds that token, the only path to the connector is through the proxy.

upstreams:
  ops:
    url: https://mcp.example.com/ops/mcp
    headers:
      Authorization: "Bearer ${OPS_MCP_TOKEN}"

tests/test_http_upstream.py runs the mock ops connector over HTTP (demo/mock_server.py --transport streamable-http) behind the proxy end to end.

Architecture: where the proxy lives and how the pieces connect

  people's assistants                 your network                          your systems
  (Claude, Copilot, Cursor)   |                                     |
                              |   mcp.example.com  (this proxy)     |   HR system (Workday)
   ── HTTPS + OAuth ────────► |   Starlette, streamable HTTP        | ─► Finance (budget lines)
                              |   identity from the token           | ─► On-call rotations
                              |   policy: coc.yaml                  | ─► Drive, Slack, CRM ...
                              |   state: Redis (or memory)          |   (reachable only from the proxy)
                              |         │ writes                    |
                              |         ▼                           |
                              |   audit.jsonl  ◄── read only ──  Aggrete Console (live.example.com)
                              |   coc.yaml                          HR / Legal / IT, behind SSO or basic auth

Three rules make this safe:

  1. Only the proxy holds connector credentials. People sign in to the proxy (your IdP via mode: jwt, or the built-in sign-in via mode: builtin when you have no IdP yet); the proxy signs in to the connectors. Fence the connectors so they accept traffic only from the proxy host.

  2. The console never touches the connectors. It reads two files the proxy writes, audit.jsonl and coc.yaml, on the same host or a shared volume, and it changes nothing the proxy enforces. Put it behind your SSO or, at minimum, HTTP basic auth; it shows who asked what.

  3. The assistants may only talk to the proxy. Managed client policy (Claude Code managed settings, Claude Enterprise connectors, Copilot and Cursor org policies) allow-lists https://mcp.example.com/mcp and nothing else.

Connecting Claude (claude.ai): Settings → Connectors → Add custom connector → URL https://mcp.example.com/mcp. Claude discovers the sign-in from the proxy's OAuth metadata, registers itself, and sends you to /signin. From then on every question Claude asks on your behalf passes the policy.

Sample handbook: samples/northwind-handbook.docx (synthetic, tailored to the rule types); coc.yaml maps to its clauses 7.1 to 7.11 one to one (7.4 and 7.12 are not enforceable at a data proxy). aggrete-ingest samples/northwind-handbook.docx reproduces it. The samples/ directory also has real public-domain examples (GSA/TTS code of conduct, Indiana state employee handbook); see samples/README.md.

Serving it to a whole company: streamable HTTP + OAuth

stdio is for one laptop. For everyone else, run Aggrete as a service and let identity come from the token:

python -m aggrete.proxy --config proxy.config.yaml --transport streamable-http --host 0.0.0.0 --port 8080

HTTP mode refuses to start without an auth: block. In jwt mode it validates bearer JWTs from your IdP (issuer, audience, expiry, signature via JWKS, required scopes) and derives the user from the email claim. Configurable with identity_claim. Every request without a valid token is a 401 with an RFC 9728 WWW-Authenticate pointer, and the user: line in the config is ignored entirely. builtin mode is a small OAuth server inside the proxy (dynamic client registration, a sign-in page, passcodes from the environment) for teams with no IdP yet. static mode (fixed tokens) exists for development and the test-suite. The accumulator keys state on the token identity, so the same person hitting Aggrete from Claude Code, Claude.ai and Cursor shares one history. Which is the point.

Register it in a client as a remote MCP server at https://<host>/mcp with the bearer token your IdP issues; keep the connectors themselves reachable only from the Aggrete host.

Inside a gateway you already run

If agentgateway, IBM ContextForge, Kong or your own gateway is already the control plane, don't add a second one. Embed Aggrete:

from aggrete.plugin import PolicyHook, AggreteMiddleware

hook = PolicyHook("coc.yaml", domains={"hr__*": "hr-personnel", "ops__*": "ops-rota"},
                  store=RedisStore(redis_client))
# as two calls from your plugin system
v = hook.before(user, tool)             # v.allow, v.message (clause + remediation)
v = hook.after(user, tool, result_text) # records entities, re-evaluates
# or as ASGI middleware around any MCP server that answers in JSON
app = AggreteMiddleware(app, hook, identity=lambda scope: scope["state"]["user"])

Identity is a callable over the request, so it composes with whatever auth the host performs. The middleware refuses at pre-call without forwarding and inspects JSON tools/call results for post-call recording.

Ways to deploy

Who

How

One developer

uvx aggrete --config proxy.config.yaml (PyPI) or the .mcp.json in this repo

A team

docker run ghcr.io/aggrete/aggrete with /etc/aggrete mounted, or helm install aggrete deploy/helm/aggrete (bundled Redis, JWT auth, Ingress)

A company

Helm/Docker behind your IdP, then make https://aggrete.<corp>/mcp the only MCP server your assistant policies allow (Claude Code managed settings, Claude Enterprise connectors, Copilot/Cursor org policies), with connectors network-restricted to the Aggrete hosts

Existing gateway

aggrete.plugin (above)

Putting a real system behind the proxy: Google Drive

aggrete/connectors/drive.py is a Drive upstream the proxy runs itself. How it is done, in the order you do it:

  1. A service account, not a person. In Google Cloud: enable the Drive API, create a service account (say aggrete-drive), download its JSON key. The proxy holds the key; nobody's personal Google login is involved, which is what makes the proxy the only road.

  2. Share the folders, read only. In Drive, create a root folder (say Northwind) with one subfolder per kind of material (Restructuring plan, Legal hold, Team documents) and share the root with the service account email as Viewer. Service accounts own nothing; they only see what is shared with them.

  3. One tool pair per folder. The connector lists the root's subfolders and exposes search_<folder> and read_<folder> for each, so the policy can name folders:

    upstreams:
      drive: {command: python3, args: [-m, aggrete.connectors.drive, --credentials, /opt/aggrete/drive-sa.json, --root, Northwind]}
    domains:
      "drive__*_restructuring_plan": restructuring-plan   # clause 7.9: embargo until announced
      "drive__*_legal_hold": legal-hold                    # clause 7.3: never for assistants
      "drive__*": drive-general
  4. Results name people. Every file comes back with owner_email and editor_email, so the policy's tallies and joins work on Drive results like on HR records.

  5. Remove the direct road. Disable the assistant's native Drive connector for governed accounts (Claude Enterprise: managed connectors; personal accounts: remove it). Otherwise the assistant has two ways to Drive and the policy only sees one.

python -m aggrete.connectors.drive --credentials sa.json --root Northwind --list prints the tools that will be exposed. If the root is not shared yet the connector still starts and exposes a single status tool that says what is missing, so the proxy never fails to boot because of Drive.

Building your own connector

Drive is the reference; the pattern is general. A connector is just an MCP server, and the proxy governs any MCP server, so putting a new system behind the proxy is: expose read tools, name write tools with a write verb, and map the tools to a policy domain.

aggrete/connectors/base.py removes the boilerplate:

from aggrete.connectors.base import Connector

c = Connector("crm")

@c.read("search_accounts", "Search CRM accounts by name.")
def search(query: str) -> str:
    return my_crm.search(query)          # a JSON string

@c.write("create_note", "Add a note to an account.")
def create_note(account_id: str, text: str) -> str:
    return my_crm.add_note(account_id, text)

if __name__ == "__main__":
    c.run()
upstreams:
  crm: {command: python3, args: [my_crm_connector.py]}
domains:
  "crm__*": crm-accounts

c.write(...) refuses a tool name with no write verb, because a mis-named write would slip past egress governance. Full guide with the folder-fencing pattern and a copy-paste template: docs/CONNECTORS.md and examples/connectors/knowledgebase_connector.py.

For teams that would rather not build and maintain their own, Aggrete for teams is where supported, certified connectors live: maintained and covered by support, with Drive shipping and Slack, GitHub, Jira, Salesforce and Workday on the roadmap. The proxy and this SDK stay Apache-2.0.

Starting from the document you already have

aggrete/ingest.py turns a code-of-conduct document into a draft coc.yaml:

python -m aggrete.ingest handbook.pdf --domains proxy.config.yaml -o coc.draft.yaml

PDFs go to the model as native document blocks; DOCX, Markdown and text as text. The model proposes rules in the exact coc.yaml schema with clause text verbatim, every action forced to alert, and each rule's own tests are run through the real Engine before the file is written. A draft that fails its tests is rejected. Clauses no data proxy can enforce (tone, harassment, expenses) are listed separately with the reason. Model set by AGGRETE_INGEST_MODEL. Needs ANTHROPIC_API_KEY or an ant auth login profile.

Purpose binding

A permanent block gets routed around. engine.grant_purpose(user, rule_id, purpose, ttl_s) opens a scoped window and stamps every retrieval made under it with the stated purpose. Wire it to an approval workflow owned by the clause owner named in the rule.

Honest limitations

  • Entity extraction is the weak point. entities.py works on stable IDs and emails. Tune IDENTIFIER_KEYS against your own connectors before trusting any threshold, or Layer 4 will either never fire or fire constantly.

  • Post-call denial redacts, it does not un-fetch. The data left the upstream. Prefer rules that can be decided pre-call.

  • stdio identity is advisory. The user is whoever launched the process and the config is user-editable. Real enforcement needs streamable HTTP with OAuth, the subject taken from the token, and IdP-level blocking of direct connector grants so this proxy is the only path.

  • Aggregation cannot be solved, only narrowed. A user who spaces requests beyond the window, or paraphrases across systems this proxy doesn't front, gets through. This raises the cost and creates the audit trail; it is not a ceiling.

  • Not a gateway. No multi-tenancy, no token vault, no HA. For production, port this policy engine onto agentgateway or IBM ContextForge as a plugin rather than running it as your control plane.

Available Tools

12 tools
aggrete__checkCheck a plan against the code of conductA

Ask whether a sequence of tool calls would be allowed before running any of them. Returns the decision (allowed, allowed-with-alert, or refused), the rule that applies, its clause, and the remediation. Nothing is fetched. Use this to answer 'can I do X?' questions: translate the request into the tool calls it would take, then pass them as tools in order.

ParametersJSON Schema
NameRequiredDescriptionDefault
toolsYesThe tool calls you are considering, in order, by their exact names on this server, e.g. ["hr__recent_joiners", "finance__budget_roles", "hr__leave_balance"].
entitiesNoOptional. The people the plan concerns, as p:<email> ids, applied to each read. Omit to evaluate assuming the calls concern the same people (you and a colleague).

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the behavioral disclosure burden. It explicitly states 'Nothing is fetched,' implying no data access or side effects, and explains what the tool returns. It could go further on edge cases like what triggers 'allowed-with-alert,' but it is transparent about the core behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences with no filler. It front-loads the core purpose, then gives return details and a concrete usage pattern. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no output schema and no annotations, the description covers the essential context: purpose, side effects, return values, and how to invoke it. The optional entities parameter is fully documented in the schema, so no critical information is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the input schema already documents both parameters thoroughly. The description reinforces the idea of passing tool calls in order and translating a request into calls, but it adds limited new parameter-level meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: ask whether a sequence of tool calls would be allowed, before running any of them. It also names the return values (decision, rule, clause, remediation), which makes the tool's function unmistakable and distinguishes it from sibling tools like aggrete__scenarios.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly says when to use it: before running any tool calls, and to answer 'can I do X?' questions by translating the request into tool calls. It lacks explicit when-not-to-use guidance or named alternatives, but the usage context is strong.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

aggrete__scenariosThings to try in this demoA

List concrete things to try here, each showing a different kind of policy decision (redaction, refusing a combination, individual pay, comparing colleagues, the prompt-injection shield, hidden tools). Takes no arguments. Start here if you are new.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the disclosure burden. 'List' signals a non-mutating read operation and 'Takes no arguments' confirms the call shape; the enumerated policy topics tell the agent what kind of content to expect. It doesn't state auth requirements or output formatting, but for a no-argument scenario listing these are minor omissions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences front-load the action, then give the key decision types, the no-argument contract, and the audience guidance. Every sentence adds value and there is no redundant padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple zero-parameter tool with no output schema, this is complete: it says what is returned, what topics are covered, and when to start. There is no missing input/output information that would prevent a correct call.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has zero parameters and 100% coverage, so baseline is 4. The description reinforces this with 'Takes no arguments', which prevents an agent from inventing parameters. No parameter-level detail is needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description identifies the action ('List concrete things to try') and the resource ('here', i.e. the demo scenarios), and enumerates the specific policy topics covered, so an agent can tell what the tool returns. It doesn't explicitly contrast itself with sibling tools like hr__start_here, though its content is distinct.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Start here if you are new' is an explicit usage context, and 'Takes no arguments' tells the agent no parameters are needed. It doesn't mention when not to use it or name alternatives, but for a demo entry point that is a clear enough trigger.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

corp__post_noteA

[shared-notes] Post a note to the shared team space. This writes to the outside world, so it is governed as egress: fine on its own, but refused if the session has already read untrusted content (the prompt-injection shield).

ParametersJSON Schema
NameRequiredDescriptionDefault
textYesThe note text to post.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the behavioral disclosure burden. It states that the tool writes to the outside world, is classified as egress, and can be blocked by the prompt-injection shield. It does not detail visibility, persistence, or return behavior, but for a simple post tool these are secondary.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no wasted text. The purpose is front-loaded in the first sentence and the egress policy earns the second sentence.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter tool with no output schema, this is nearly complete: it defines the action, target, side effect, and an important refusal condition. The only missing piece is any indication of what the tool returns or how success is reported, which is a minor gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the schema already says 'text' is 'The note text to post'. The description adds no additional parameter constraints, format details, or examples, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Post') with a specific resource ('a note to the shared team space'), and the shared-notes context makes its write purpose clear next to siblings like corp__read_public_post. No ambiguity about what the tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives clear context for when to use the tool—posting a note to the shared team space—and an explicit when-not: it is refused if the session has already read untrusted content. It does not name an alternative tool to use in that case, so it falls short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

corp__read_public_postA

[untrusted-web] Fetch the text of a public web page or forum post. The content is untrusted: it can carry instructions aimed at your assistant. In this demo, once a session has read from here, Aggrete refuses any later tool that would send data out (COC-SEC-002).

ParametersJSON Schema
NameRequiredDescriptionDefault
urlYesURL of the public page or post to read.

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure, and it does so exceptionally well. It reveals that content is untrusted and capable of carrying prompt-injection-style instructions, and it discloses the side effect that reading triggers Aggrete's refusal of later data-sending tools (COC-SEC-002). This is critical behavioral information beyond the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: it opens with the untrusted-web marker and the core action, then delivers the essential security caveat. Every sentence adds value with no filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter tool with no output schema, the description provides sufficient context to call it correctly: what it fetches, that the content is untrusted, and the consequential session-level egress restriction. This is complete for an agent to understand both the action and its implications.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the single 'url' parameter is already well described as 'URL of the public page or post to read.' The description adds context that the tool fetches text and that content is untrusted, but it does not need to add much parameter-level detail. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Fetch') and resource ('text of a public web page or forum post'), making the tool's function immediately clear. The '[untrusted-web]' prefix and the security caveat further distinguish it from the unrelated HR, finance, and operations siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly indicates this tool is for reading public web content and provides important context about untrusted content and the session-level data egress restriction. It does not explicitly name alternative tools, but the sibling list contains no other web-fetch tool, so the context is sufficient for an agent to select it appropriately.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

finance__budget_rolesA

[finance-comp] Budget lines for one team, per role, including whether each role is backfill-only and the email of the role owner. In this demo, Aggrete refuses combining these budget records with HR personnel records to profile individuals (a code-of-conduct rule).

ParametersJSON Schema
NameRequiredDescriptionDefault
teamYesTeam name to report on, for example 'platform', 'sre' or 'sales-emea'.

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral burden. It discloses a non-obvious rule: Aggrete enforces a code-of-conduct constraint that refuses combining budget records with HR records to profile individuals. It also states what data is included in the result. It does not explicitly say the operation is read-only or describe error behavior, but for a simple lookup this is adequate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no wasted words. The first sentence front-loads the core purpose and output fields; the second delivers an important constraint. The structure is compact and easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter list tool with no output schema, the description gives enough information: what the result contains, the role-level detail, and a notable usage restriction. The absence of a mention of return shape or unknown-team behavior is minor given the low complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the 'team' parameter is already documented with examples in the schema. The description adds only the general context of 'one team, per role,' which does not materially enrich parameter semantics beyond the schema. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the resource — budget lines for one team per role — and names the key fields returned (backfill-only flag, role owner email). It does not use an explicit verb like 'list' or 'get', and it does not clearly differentiate from the sibling finance__headcount_plan, so it stops short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context: the tool reports budget lines for one team, per role. It also provides an explicit when-not-to-use instruction: Aggrete refuses combining these records with HR personnel records for individual profiling, which is relevant to the hr__ sibling tools. It could be stronger by naming which tool to use instead of this one in other finance scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

finance__headcount_planA

[finance-planning] Aggregate headcount plan for one team: approved, filled and open role counts. Returns totals only, never individual people. Use it to see how many roles a team is budgeted for and how many are still open.

ParametersJSON Schema
NameRequiredDescriptionDefault
teamYesTeam name to report on, for example 'platform', 'sre' or 'sales-emea'.

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden. It discloses the key behavioral traits upfront: results are totals only, never individual people, and the scope is exactly one team. It does not cover error handling or data freshness, but for a read-only aggregate tool the main privacy and aggregation behaviors are disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences: the first states function and core constraint, the second gives a user-oriented purpose. There is no filler, and the most important facts are front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple with one required parameter and no nested objects, and the description covers scope, output nature, and intended use. It lacks an output schema and does not spell out behavior for unknown team names, so it is complete but not exhaustive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema covers the only parameter, team, at 100% with a clear description and examples ('platform', 'sre', 'sales-emea'). The tool description adds no parameter-level detail beyond restating 'one team', so the baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with the specific verb 'Aggregate' and a clear resource: headcount plan for one team, enumerating approved, filled, and open role counts. It also clarifies scope with 'one team' and 'Returns totals only, never individual people.' It stops short of a 5 because it does not explicitly differentiate from the sibling finance__budget_roles.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states a concrete use case: 'Use it to see how many roles a team is budgeted for and how many are still open.' This is clear contextual guidance, but it does not name alternatives like finance__budget_roles or state when not to use the tool, so it earns 4 rather than 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

finance__pay_bandA

[pay-aggregates] Average pay for a category of workers. Pay may be shared only as averages for large enough groups: a category describing fewer than ten people resolves to individual pay and Aggrete refuses it (COC-HR-031). A broad category (a job family or location) is fine.

ParametersJSON Schema
NameRequiredDescriptionDefault
categoryYesWorker category to average, for example 'engineering' or 'sales-emea'. Small categories like 'executives' or 'legal' describe only a few people.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden and does so well by disclosing that small categories resolve to individual pay and are refused under policy COC-HR-031. This reveals an important failure behavior and privacy constraint that an agent would not otherwise know.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three short sentences with no filler. The purpose is front-loaded, and the constraint is stated efficiently with a policy reference rather than unnecessary explanation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter tool with no annotations, the description provides the core purpose, the key boundary condition, and a refusal behavior. It does not describe the exact return format or currency, but the meaning of 'average pay' is clear enough to make a correct call.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already documents the single 'category' parameter at 100% coverage, so the baseline is 3. The description adds real value by defining the ten-person threshold and clarifying that broad categories are appropriate, which helps the agent choose a safe input value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Average pay for a category of workers', which names the specific operation, resource, and scope. It also clearly distinguishes this tool from the sibling tools, which cover on-call, timecards, posts, budget roles, and headcount planning rather than pay aggregation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives concrete guidance on when the tool can and cannot be used: categories with fewer than ten people are refused, while broad categories such as job family or location are acceptable. It does not name alternative tools, but the when/when-not guidance is explicit enough for the simple parameter set.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

hr__leave_balanceA

[hr-personnel] Look up the remaining leave and absence balance for one person by email. In this demo, Aggrete redacts the email in the result before it reaches the model.

ParametersJSON Schema
NameRequiredDescriptionDefault
emailYesEmail address of the person whose leave balance to look up, for example 'alice.n@example.com'.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral disclosure burden. It does disclose a notable behavior: Aggrete redacts the email from the result before it reaches the model. This goes beyond the basic purpose and gives the agent useful expectations about output privacy.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is short, front-loaded with the core purpose, and the demo redaction note is the only extra information. Every sentence adds value and there is no wasted text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple single-parameter lookup with no output schema, the description plus schema is adequate: purpose, input, and a relevant behavioral note are all present. It does not detail error cases or exact response structure, but those are not essential for this tool's simplicity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the email parameter already has a clear description with an example. The tool description adds 'by email' but does not materially improve on the schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Look up') and a specific resource ('remaining leave and absence balance') scoped to one person by email. This clearly distinguishes the tool from sibling tools like hr__recent_joiners, which operate on groups or lists.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly indicates this is for a single-person lookup identified by email, which provides enough context to avoid confusion with the sibling HR tools. It does not explicitly name alternatives or state when not to use the tool, so it falls short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

hr__recent_joinersA

[hr-personnel] List the people who joined a team within the last N months, with each person's email, employee id and start date. Use it to find recent hires on a team.

ParametersJSON Schema
NameRequiredDescriptionDefault
teamYesTeam name to report on, for example 'platform', 'sre' or 'sales-emea'.
monthsNoLook-back window in months (1 to 60). Defaults to 18.

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden of behavioral disclosure. It does disclose that this is a listing operation and names the returned fields, which is useful. It does not mention ordering, pagination, whether 'joined' refers to team membership vs hire date, or any access/authorization considerations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with no filler. The primary action and resource are front-loaded, and the use-case sentence earns its place by guiding selection.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only list tool with two parameters and no output schema, the description is largely sufficient: it states inputs, purpose, and expected output fields. It could be slightly more complete by clarifying edge cases around the time window or result ordering, but nothing critical is missing for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both parameters are already documented with examples and constraints. The description mostly restates the time-window concept ('within the last N months') and does not add significant new meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('List') and resource ('people who joined a team within the last N months'), and clarifies the returned fields: email, employee id, and start date. It is clearly distinct from sibling tools by topic, though it does not explicitly contrast itself with any sibling.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states a clear use case: 'Use it to find recent hires on a team.' This gives an agent a direct trigger condition for selecting the tool. It does not, however, list exclusions or explicitly contrast with nearby HR tools like hr__start_here or hr__leave_balance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

hr__start_hereA

[hr-personnel] Start here. Explains what this demo is and points you at the guided menu. Takes no arguments.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the burden of behavioral disclosure. It clearly states the tool 'takes no arguments' and describes its behavior as explaining and pointing, implying a read-only informational action. It does not discuss side effects or output format, but for such a simple tool this is adequate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise: three short phrases, each earning its place. 'Start here' is front-loaded, followed by the tool's purpose and argument clarification. There is no filler or redundant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-argument, no-output-schema orientation tool, this description is complete. It tells the agent what the tool does, that it requires no arguments, and how it guides the user. Nothing essential is missing for invoking it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already shows zero properties, but the description reinforces this by explicitly stating 'Takes no arguments.' Since there are no parameters, the description adds the needed semantic confirmation beyond the schema, warranting the baseline 4 for zero-parameter tools.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear purpose: it is an entry point that 'Explains what this demo is and points you at the guided menu.' This uses a specific verb/resource combination and clearly distinguishes the tool from the sibling HR, finance, ops, and corp tools, which are all operational rather than orientation tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Start here' is an explicit directive to invoke this tool first, which is strong usage guidance for an entry-point tool. It does not name alternatives or specify when not to use it, but given the tool's simple orientation role and zero arguments, the guidance is sufficient.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

hr__timecardA

[timesheets] Timecard for one person by email: hours logged per week this month. In this demo, putting your own timecard next to a colleague's to compare is refused (COC-HR-021); reviewing your team's cards is fine.

ParametersJSON Schema
NameRequiredDescriptionDefault
emailYesEmail of the person whose timecard to read, for example your own or a colleague's.

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It discloses an important non-obvious guardrail: attempting to place your own timecard next to a colleague's for comparison is refused under COC-HR-021, while team review is allowed. This gives the agent actionable policy context beyond the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences with no wasted words. It front-loads the core operation and then adds the necessary policy exception. The category tag and policy code convey extra context efficiently.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter read tool with no output schema, the description gives the input scope (one person by email), the output semantics (hours per week this month), and the key access restriction. Nothing essential is missing for an agent to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single email parameter has 100% schema description coverage, so the schema already documents its meaning. The description only repeats 'by email' without adding new format, default, or usage detail. The schema's own example ('your own or a colleague's') is more informative than the description's mention.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific resource ('timecard for one person by email') and the exact output ('hours logged per week this month'). This clearly distinguishes it from sibling HR tools like leave balance or recent joiners. The [timesheets] prefix adds useful category context.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The first clause states when to use the tool: to read one person's timecard by email. The demo caveat explicitly marks a refused use case (comparing your own card with a colleague's) and an allowed one (reviewing your team's cards). It does not name an alternative tool, but no sibling appears to cover this exact function.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ops__oncall_draftA

[ops-rota] Draft an on-call rotation for one team and quarter: one shift per week with the assigned person's email. Use it to propose who is on call, week by week.

ParametersJSON Schema
NameRequiredDescriptionDefault
teamYesTeam name to report on, for example 'platform', 'sre' or 'sales-emea'.
quarterYesQuarter to draft, in the form 'YYYY-Qn', for example '2026-Q1'.

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the responsibility for behavioral disclosure. 'Draft' and 'propose' signal a non-committal, generated rotation rather than a final schedule, and the output content is stated. However, it does not disclose side effects, persistence, permissions, or whether anything is actually written to the rota.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two short sentences with no filler; the core action and scope are front-loaded in the first sentence. The second sentence clarifies the intended use without repeating the schema. It is efficient and scannable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter tool, the schema covers the inputs and the description covers the output format (weekly shifts with the assigned person's email). No output schema exists, but an agent receives enough to invoke it correctly. It would benefit from stating what happens when no person is available, but that is a marginal gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Both parameters are fully documented in the schema with format constraints and examples, so the schema does the heavy lifting. The description reinforces that team and quarter are the scope, but adds no parameter-level meaning beyond that. A baseline of 3 is appropriate given 100% schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with the specific action 'Draft an on-call rotation' and immediately scopes it to 'one team and quarter.' It adds output detail—'one shift per week with the assigned person's email'—which makes the tool's purpose concrete. No sibling tool covers this domain, so it is distinguishable from the listed HR/finance tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly tells the agent to use the tool 'to propose who is on call, week by week,' which establishes the primary use case. It also constrains use to a single team and quarter. There are no alternative on-call siblings, so no exclusion condition is needed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 6 tool updates
    • Addedaggrete__check
    • Addedaggrete__scenarios
    • Addedcorp__post_note
    • Addedcorp__read_public_post
    • Addedfinance__pay_band
    • Addedhr__timecard
  2. 6 tool updatesv0.5.4
    • Changedfinance__budget_roles1 field changed
      • addedInput schema / properties / team / description
        Added value: +"Team name to report on, for example 'platform', 'sre' or 'sales-emea'."
    • Changedfinance__headcount_plan1 field changed
      • addedInput schema / properties / team / description
        Added value: +"Team name to report on, for example 'platform', 'sre' or 'sales-emea'."
    • Changedhr__leave_balance1 field changed
      • addedInput schema / properties / email / description
        Added value: +"Email address of the person whose leave balance to look up, for example 'alice.n@example.com'."
    • Changedhr__recent_joiners4 fields changed
      • addedInput schema / properties / months / description
        Added value: +"Look-back window in months (1 to 60). Defaults to 18."
      • addedInput schema / properties / months / maximum
        Added value: +60
      • addedInput schema / properties / months / minimum
        Added value: +1
      • addedInput schema / properties / team / description
        Added value: +"Team name to report on, for example 'platform', 'sre' or 'sales-emea'."
    • Addedhr__start_here
    • Changedops__oncall_draft2 fields changed
      • addedInput schema / properties / quarter / description
        Added value: +"Quarter to draft, in the form 'YYYY-Qn', for example '2026-Q1'."
      • addedInput schema / properties / team / description
        Added value: +"Team name to report on, for example 'platform', 'sre' or 'sales-emea'."
  3. 5 tool updatesv0.5.2
    • First observedfinance__budget_roles
    • First observedfinance__headcount_plan
    • First observedhr__leave_balance
    • First observedhr__recent_joiners
    • First observedops__oncall_draft

TDQS

A4.1/5.0
Disambiguation4/5

Most tools map cleanly to a distinct resource/action, but the two no-argument onboarding tools (hr__start_here and aggrete__scenarios) overlap in purpose and could mislead an agent. The rest of the set is clearly separated by domain prefix and output kind.

Naming Consistency4/5

The double-underscore domain prefix (ops__, hr__, finance__, corp__, aggrete__) is consistent and helpful. However, suffixes mix resource nouns (timecard, pay_band, budget_roles) with action verbs (read_public_post, post_note, start_here), so the convention is not fully predictable.

Tool Count5/5

12 tools is a well-scoped size for a multi-domain policy demo. Each tool appears to have a distinct role, and none feel redundant or like padding.

Completeness4/5

The set covers the policy scenarios it advertises: redaction, refusing combinations, individual pay, colleague comparison, prompt-injection egress, and onboarding. It is not a full CRUD API—there are no update/delete operations or read-back for posted notes—but those are minor gaps for a demo-oriented server.

Maintenance

ActivityMaintained
ResponsivenessUnresponsive

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    A
    maintenance
    Local zero-trust permission gateway for AI agents. Enforces policy-based tool authorization, human approvals, scoped permissions, and cryptographically verifiable audit logs.
    4
    5
    Apache 2.0
  • A
    license
    A
    quality
    A
    maintenance
    Provides AI ingress governance by masking prompts, classifying risk, and enforcing tool policies before agent calls reach model providers or sandboxes.
    6
    1
    AGPL 3.0
  • A
    license
    B
    quality
    A
    maintenance
    A governance proxy for AI tools — every MCP/agent tool call is policy-gated, secret-redacted, and written to a hash-chained, offline-verifiable audit trail.
    13
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Deterministic policy enforcement for AI agent tool calls. It evaluates every tool call against user-defined rules before execution, with no LLM in the authorization path.
    3
    MIT

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/Aggrete/aggrete'

If you have feedback or need assistance with the MCP directory API, please join our Discord server