01Safety
0.0 / 30
What changed in the harness
Selection accuracy 97→100, token cost up 4%, unconfirmed writes 0%→0%.
Category breakdown
Where the score comes from.
Earned points across the four signals Gradable measures. Safety and Legibility are scored out of 30; Economics and Discoverability are scored out of 20.
02Legibility
27.0 / 30
03Economics
19.3 / 20
04Discoverability
10.2 / 20
Highest-impact fix
Estimated gain +30 pointsAdd explicit identity and permission preflight tools
Expose machine-readable principal/tenant confirmation and a non-mutating permission check so agents can verify both before destructive actions.
Description evidence
Defects and rewrites.
4 defects found across the exposed tool descriptions. Suggested rewrites make purpose, inputs, boundaries, and returns easier for an agent to understand.
| Tool | Defect types | Suggested rewrite |
|---|---|---|
kya_reportBadgeOutcome |
no_return_description |
[DEPRECATED — outcomes are now tracked automatically via the verify endpoint. This tool will be removed in a future version.] Report how the merchant responded when you presented your Badge (verification_token, merchant, and outcome: not_denied, denied, or unparseable) so kyaLabs records the result. Returns confirmation that the outcome was recorded, including the reported status. |
kya_reportBadgeNotPresented |
no_return_description |
[DEPRECATED — this event is no longer needed. This tool will be removed in a future version.] Report that you did NOT present your Badge at a merchant, along with the reason (abandoned, merchant_didnt_ask, or other), so kyaLabs records the skipped presentation. Returns confirmation that the event was recorded. |
kya_getCard |
no_return_description |
Get a single-use virtual Visa to make a purchase on behalf of the user. You MUST call kya_getAgentIdentity first — you cannot pay without being identified. Declare the merchant, estimated amount (max $500), and what you're buying; the user approves via MFA, then kyaLabs issues a card locked to this purchase that self-destructs after use. Returns the issued card details, including the intent_id you pass to kya_reportPurchase after the transaction. |
kya_reportPurchase |
params_unexplained no_return_description |
Report the outcome of a purchase after using a kyaLabs virtual card. Must be called after every purchase attempt — this closes the audit trail. Pass the intent_id returned by kya_getCard, whether the purchase succeeded, and details: the actual amount charged, the merchant name as shown on the receipt, the items purchased, and the merchant's order confirmation number used to verify the transaction against the audit trail. Returns confirmation that the purchase outcome was recorded. |
Selection evidence
Confusable tool pairs.
5 pairs where similar names or overlapping descriptions may send an agent toward the wrong tool.
| Tool A | Tool B | Confidence | Why they collide |
|---|---|---|---|
kya_reportBadgePresented |
kya_reportBadgeNotPresented |
medium | Names differ only by 'not' and share identical token sets (badge/kya/presented/report); a task like 'report that the badge was not presented at checkout' could match the shared tokens to kya_reportBadgePresented, especially since the non-deprecated one is a tempting default. |
kya_reportBadgePresented |
kya_reportBadgeOutcome |
medium | Both record a badge-event after presentation; a task like 'report how the badge presentation went' or 'report the state of the badge at checkout' shares keywords with both, and an agent may skip the deprecation note and file the outcome through the presented tool. |
kya_reportBadgeOutcome |
kya_reportBadgeNotPresented |
medium | Both are deprecated note tools for what happened with a badge at a merchant, with nearly identical inputs (verification_token, merchant); a task like 'report what happened with the badge when I did not present it' is ambiguous about which event tool to call. |
kya_reportBadgeOutcome |
kya_reportPurchase |
medium | Both are 'report outcome' tools sharing the words report and outcome; a vague task like 'report the outcome of the merchant interaction' could be filed as the badge-denial outcome instead of the purchase outcome, and vice-versa. |
kya_getAgentIdentity |
kya_getHeaders |
low | A task like 'get the identity info/headers for this merchant' shares get+identity tokens with both; one tool declares identity while the other returns headers, so the agent could return headers without declaring, or declare without obtaining the header. |
Compare the field