01Safety
0.0 / 30
What changed in the harness
Selection accuracy 91→93, token cost down 1%, unconfirmed writes 0%→0%.
Category breakdown
Where the score comes from.
Earned points across the four signals Gradable measures. Safety and Legibility are scored out of 30; Economics and Discoverability are scored out of 20.
02Legibility
23.1 / 30
03Economics
15.7 / 20
04Discoverability
9.4 / 20
Highest-impact fix
Estimated gain +30 pointsAdd explicit identity and permission preflight tools
Expose machine-readable principal/tenant confirmation and a non-mutating permission check so agents can verify both before destructive actions.
Description evidence
Defects and rewrites.
10 defects found across the exposed tool descriptions. Suggested rewrites make purpose, inputs, boundaries, and returns easier for an agent to understand.
| Tool | Defect types | Suggested rewrite |
|---|---|---|
recommend_stack |
name_restates_behavior params_unexplained no_return_description |
Computes a tailored tech stack recommendation using live scoring, weighted by up to three ranked priorities (e.g. time-to-market, scalability, security) and adjusted for the given project type (e.g. saas, api, mobile-app), scale (mvp through enterprise), and optional free-text constraints (e.g. 'must-use-postgresql'). Returns the recommended technology for each category along with scores reflecting the requested priorities and constraints. |
recommend_stack_demo |
params_unexplained |
Generates a quick, deterministic tech stack recommendation for a given project type (e.g. web-app, saas, api, e-commerce, mobile-app) and growth scale (mvp, startup, growth, enterprise). Returns the optimal technology for each category (frontend, backend, database, etc.) along with a score and grade for each pick, based on rule-based scoring rather than AI-generated guesses. |
get_blueprint |
no_return_description |
Fetches an existing blueprint by its UUID, previously generated via the StacksFinder web UI or the create_blueprint tool. Returns the full blueprint record, including the recommended technology stack, project metadata, and generation status. |
create_blueprint |
params_unexplained |
Creates a new tech stack blueprint for a project, matching technologies to the given project type (e.g. saas, api, e-commerce, mobile-app) and scale. projectName is an optional label used to identify the blueprint later. Blueprint generation is asynchronous: by default this tool waits for completion and returns the full blueprint; set waitForCompletion=false to get the job ID immediately for manual polling instead. |
setup_api_key |
no_return_description |
Authenticates with your StacksFinder account and creates an API key using email/password. Returns the newly created API key value along with its ID and name — save the key immediately, as the raw value is only shown once. |
list_api_keys |
name_restates_behavior no_return_description |
Retrieves the API keys associated with your authenticated StacksFinder account (requires a configured API key). Returns each key's ID, name, and creation date — not the raw secret value, which is only shown once at creation. |
revoke_api_key |
name_restates_behavior no_return_description |
Permanently deactivates the specified StacksFinder API key by its UUID so it can no longer authenticate requests. This action cannot be undone. Returns a confirmation that the key was revoked. |
create_api_key |
no_return_description |
Creates a new API key using OAuth authentication, the preferred method for ChatGPT users, and requires a Pro or Team subscription. Returns the newly created API key value along with its ID and name — the raw key is shown only once, so save it securely immediately. |
get_audit_quota |
no_return_description |
Checks your remaining audit quota for the current month. Returns the number of audits used, the monthly limit, and the reset date for your account tier. |
get_estimate_quota |
no_return_description |
Checks your remaining project-estimate quota for the current week and month. Returns the number of estimates used and remaining for each period, along with the applicable limits for your account tier. |
Selection evidence
Confusable tool pairs.
7 pairs where similar names or overlapping descriptions may send an agent toward the wrong tool.
| Tool A | Tool B | Confidence | Why they collide |
|---|---|---|---|
recommend_stack_demo |
recommend_stack |
high | Both take projectType/scale and return a stack recommendation; a task like 'recommend a tech stack for my SaaS' doesn't indicate whether the free demo or the Pro real-time version with priorities/constraints is wanted. |
setup_api_key |
create_api_key |
high | Both create an API key for the account; only the auth mechanism differs (email/password vs OAuth). A generic 'create/get me an API key' request could plausibly trigger either without the agent knowing which auth context applies. |
prepare_mcp_installation |
execute_mcp_installation |
medium | Both are steps in the same MCP install workflow with overlapping descriptions ('generate .env-mcp' vs 'read .env-mcp'); a task phrased simply as 'install MCP servers for my project' could cause the agent to jump straight to execute_mcp_installation without first calling prepare_mcp_installation. |
generate_mcp_kit |
prepare_mcp_installation |
medium | Both produce MCP setup artifacts from a project context (one from a description, one from repo analysis); a vague request like 'set up MCP recommendations for my project' doesn't clarify whether the project already exists as a repo to analyze or is just being described, risking the wrong tool choice. |
get_audit_quota |
get_estimate_quota |
low | Both are zero-arg 'check my remaining quota' tools with nearly identical descriptions differing only in the audit vs estimate feature; a bare request like 'check my quota' without specifying which feature could be misrouted. |
get_audit |
list_audits |
low | A request like 'show me my audit results' is ambiguous between fetching a specific known audit (get_audit) and listing recent audits (list_audits) when the user hasn't supplied an ID. |
analyze_tech |
compare_techs |
low | A task like 'how does Next.js stack up against alternatives' could be read as either a single-tech deep analysis or a multi-tech comparison, though the required array vs single string params partially disambiguate. |
Compare the field