01Safety
0.0 / 30
What changed in the harness
Selection accuracy 100→100, token cost up 25%, unconfirmed writes 0%→0%.
Category breakdown
Where the score comes from.
Earned points across the four signals Gradable measures. Safety and Legibility are scored out of 30; Economics and Discoverability are scored out of 20.
02Legibility
23.1 / 30
03Economics
19.8 / 20
04Discoverability
13.0 / 20
Highest-impact fix
Estimated gain +30 pointsAdd explicit identity and permission preflight tools
Expose machine-readable principal/tenant confirmation and a non-mutating permission check so agents can verify both before destructive actions.
Description evidence
Defects and rewrites.
13 defects found across the exposed tool descriptions. Suggested rewrites make purpose, inputs, boundaries, and returns easier for an agent to understand.
| Tool | Defect types | Suggested rewrite |
|---|---|---|
cf_zones |
params_unexplained no_return_description |
List Cloudflare zones (domains) on your account. Returns an array of zone objects with properties like id, name, and status. Use page (starts at 1) for pagination and perPage (default 20, max 50) to control how many zones are returned per page. |
cf_dns_list |
params_unexplained no_return_description |
List DNS records for a Cloudflare zone. Returns an array of DNS record objects including id, type, name, content, ttl, and proxied. zoneId is the ID of the zone fetched from cf_zones; page (default 1) and perPage (default 50, max 100) control pagination. |
cf_dns_create |
params_unexplained no_return_description |
Create a DNS record in a Cloudflare zone. Returns the newly created record object including its id and status. zoneId is the zone ID from cf_zones; type is the record type (A, AAAA, CNAME, TXT, MX, etc.); name is the record name (e.g. 'www' or '@'); content is the record value (IP, hostname, or text); ttl defaults to 1 (automatic); proxied defaults to false. |
cf_dns_delete |
params_unexplained no_return_description |
Delete a DNS record from a Cloudflare zone. Returns a confirmation of the deletion. zoneId is the zone ID from cf_zones; recordId is the ID of the record to delete, as returned by cf_dns_list. |
cf_workers_list |
no_return_description |
List Cloudflare Workers scripts for your account. Returns an array of script objects with properties such as id, created_on, and modified_on. accountId is the Cloudflare account ID; if omitted, the value from environment variables is used. |
cf_worker_delete |
params_unexplained no_return_description |
Delete a Cloudflare Workers script by name. Returns a confirmation of the deletion. scriptName is the name of the worker script to delete; accountId is the Cloudflare account ID. |
cf_kv_namespaces |
params_unexplained no_return_description |
List Cloudflare KV namespaces for your account. Returns an array of namespace objects, each with an id and title. accountId is the Cloudflare account ID. |
cf_kv_keys |
params_unexplained no_return_description |
List keys in a Cloudflare KV namespace, optionally filtered by prefix. Returns an array of key objects including name, expiration, and metadata. namespaceId is the KV namespace ID; prefix filters keys by string prefix; limit caps returned keys (default 100, max 1000); accountId is the Cloudflare account ID. |
cf_kv_get |
params_unexplained no_return_description |
Read a value from Cloudflare KV using a namespace and key. Returns the stored value for the key, or null if the key does not exist. namespaceId is the KV namespace ID from cf_kv_namespaces; key is the key to read; accountId is the Cloudflare account ID. |
cf_kv_put |
params_unexplained no_return_description |
Write a string value to a key in a Cloudflare KV namespace. Returns a success status object confirming the write. namespaceId is the KV namespace ID; key is the key to write; value is the string to store; accountId is the Cloudflare account ID. |
cf_kv_delete |
params_unexplained no_return_description |
Delete a key from a Cloudflare KV namespace. Returns a confirmation object indicating the deletion succeeded. namespaceId is the KV namespace ID; key is the key to remove; accountId is the Cloudflare account ID. |
cf_r2_buckets |
params_unexplained no_return_description |
List Cloudflare R2 storage buckets for your account. Returns an array of bucket objects with properties such as name and creation_date. accountId is the Cloudflare account ID. |
cf_cache_purge |
params_unexplained no_return_description |
Purge the Cloudflare cache for a zone, either entirely or for specific URLs. Returns a confirmation with the id of the purge operation. zoneId is the zone ID from cf_zones; set purgeAll to true to clear the whole cache (use with caution), or provide urls to purge only those exact URLs. |
Selection evidence
Confusable tool pairs.
4 pairs where similar names or overlapping descriptions may send an agent toward the wrong tool.
| Tool A | Tool B | Confidence | Why they collide |
|---|---|---|---|
cf_kv_namespaces |
cf_kv_keys |
medium | Both are KV-style list tools; a task like 'list my KV namespaces' or 'show KV namespaces/keys' is ambiguous because cf_kv_keys operates 'in a KV namespace' and shares the same verbs and resource vocabulary, so the agent could pick the wrong one. |
cf_kv_get |
cf_kv_put |
low | Both take the same namespaceId/key and differ only on value direction; a task like 'update/set the value at key X' could be mis-matched to get, though the descriptions ('Get a value' vs 'Write a value') usually disambiguate. |
cf_kv_keys |
cf_kv_get |
low | A task like 'show me what is in my KV store' could resolve to either listing keys or reading a specific value; though 'list keys' vs 'get value' verbs are generally distinct, vague retrieval phrasing leaves mild ambiguity. |
cf_zones |
cf_dns_list |
low | A task like 'list the DNS zones/records for my domain' straddles both: cf_zones lists domains while cf_dns_list lists records within a zone, so an agent could pick the wrong one when the user says 'show my DNS zones' or 'list DNS entries'. |
Compare the field