01Safety
0.0 / 30
What changed in the harness
Selection accuracy 100→100, token cost up 17%, unconfirmed writes 0%→0%.
Category breakdown
Where the score comes from.
Earned points across the four signals Gradable measures. Safety and Legibility are scored out of 30; Economics and Discoverability are scored out of 20.
02Legibility
25.1 / 30
03Economics
19.9 / 20
04Discoverability
10.6 / 20
Highest-impact fix
Estimated gain +30 pointsAdd explicit identity and permission preflight tools
Expose machine-readable principal/tenant confirmation and a non-mutating permission check so agents can verify both before destructive actions.
Description evidence
Defects and rewrites.
7 defects found across the exposed tool descriptions. Suggested rewrites make purpose, inputs, boundaries, and returns easier for an agent to understand.
| Tool | Defect types | Suggested rewrite |
|---|---|---|
publish_temp |
no_return_description |
Publish a NEW artifact (HTML, Markdown, CSV, or Mermaid) to temp.md. On success this returns the new artifact's stable public URL plus its temp_id and update_token, which you need to update or restore the Temp later. Use only for a NEW artifact — if this project already has a Temp for it (check .tempmd), use update_temp to keep the same link. The record is saved to .tempmd automatically. |
update_temp |
params_unexplained no_return_description |
Push a new version of an artifact behind the same temp.md URL — no re-sharing needed. Resets the 7-day active window. Supply file (absolute path to the updated main artifact file), optional additional_files to publish alongside it, an optional new display title for the page, and optional spa_mode to set SPA index fallback explicitly (omitted preserves the current setting). Reads temp_id and update_token from the project's .tempmd file when omitted. Returns the result of the update, confirming the new version is live at the same URL; if the update fails, the previous version stays live. |
get_temp_status |
params_unexplained no_return_description |
Check a Temp's lifecycle and report its status (active, cooling, or expired), when it expires, and whether it can be restored. Supply temp_id (the Temp's ID, omit to read it from the project's .tempmd file) and update_token (the secret that authorizes access to the Temp, omit to read it from .tempmd). project_dir defaults to the current working directory. Returns the lifecycle details so you can decide whether to update or restore the Temp. |
restore_temp |
params_unexplained no_return_description |
Reactivate a recently expired Temp so its same canonical URL comes back to life. Supply temp_id (the Temp's ID, omit to read it from the project's .tempmd file) and update_token (the secret that authorizes access to the Temp, omit to read it from .tempmd). project_dir defaults to the current working directory. Only works within 7 days of expiry; returns the outcome of the reactivation, including the restored canonical URL. |
snapshot_temp |
params_unexplained no_return_description |
Freeze the current version of a Temp as a fixed reference with its own URL — for sign-offs and 'approve exactly this' moments. The canonical link keeps serving the latest version; share the snapshot URL only when exactness matters. Supply temp_id (the Temp's ID, omit to read it from the project's .tempmd file), update_token (the secret that authorizes access to the Temp, omit to read it from .tempmd), and an optional label such as 'client sign-off v2'. project_dir defaults to the current working directory. Returns the immutable snapshot URL for the frozen version. |
set_comments |
params_unexplained no_return_description |
Toggle pinned visitor comments (Pindrop) on a Temp's page. Set enabled to true to enable comments or false to disable. Supply temp_id (the Temp's ID, omit to read it from the project's .tempmd file) and update_token (the secret that authorizes access to the Temp, omit to read it from .tempmd). project_dir defaults to the current working directory. Returns the outcome of the toggle, including whether comments are now enabled. |
list_temps |
name_restates_behavior no_return_description |
Read this project's local .tempmd records file (no network call) and return all recorded Temps for this project, including each Temp's id, title, URL, and record location. project_dir defaults to the current working directory and points at the project root holding the .tempmd records file. |
Selection evidence
Confusable tool pairs.
6 pairs where similar names or overlapping descriptions may send an agent toward the wrong tool.
| Tool A | Tool B | Confidence | Why they collide |
|---|---|---|---|
publish_temp |
update_temp |
high | The classic new-vs-existing artifact ambiguity: a task like 'publish my updated HTML' maps to update_temp if the project already has a .tempmd record, but the verb 'publish' and the same 'temp.md URL' framing pull the agent toward publish_temp, which would wrongly mint a new artifact and break the stable link. The only disambiguator is a check-it-yourself note in the descriptions. |
update_temp |
restore_temp |
medium | Both promise 'the same canonical URL stays working,' so a task like 'get my temp link working again' or 'push the latest version, keep the same link' is ambiguous: update_temp replaces content while restore_temp reactivates an expired record. The expired-vs-not distinction isn't stated in the user's phrasing. |
publish_temp |
restore_temp |
medium | A task like 're-publish my old temp' or 'bring my link back' could select publish_temp (creates a new artifact/URL) when the user actually means restoring the expired canonical URL, or vice versa. Both descriptions share the 'temp.md URL' framing and differ mainly on whether the artifact is brand-new or recently expired. |
publish_temp |
snapshot_temp |
medium | A task like 'give me a stable link for this exact version to approve' is genuinely ambiguous: snapshot_temp freezes an existing temp with its own URL for sign-offs, but the publishing/URL-getting language overlaps heavily with publish_temp's 'publish and get a public URL' behavior, so an agent may publish a duplicate instead of snapshotting. |
update_temp |
snapshot_temp |
medium | Tasks mixing version language ('save/pin this version,' 'make a version of this for sign-off') are ambiguous: update_temp replaces the live version behind the same URL, while snapshot_temp freezes the current version under a new URL. Both schemas share temp_id/update_token and the version concept, so the wrong one is a real risk when the user says 'version' without specifying freeze vs. replace. |
restore_temp |
snapshot_temp |
low | Both act on an existing temp and involve keeping a URL alive for a past/current version ('bring back that signed-off version' vs. 'save the exact current one'), but restore_temp only applies to expired temps and snapshot_temp to live ones, a distinction that usually disambiguates the task even though the wording can overlap. |
Compare the field