01Safety
0.0 / 30
What changed in the harness
Selection accuracy 85→89, token cost up 12%, unconfirmed writes 0%→0%.
Category breakdown
Where the score comes from.
Earned points across the four signals Gradable measures. Safety and Legibility are scored out of 30; Economics and Discoverability are scored out of 20.
02Legibility
26.3 / 30
03Economics
20.0 / 20
04Discoverability
15.4 / 20
Highest-impact fix
Estimated gain +30 pointsAdd explicit identity and permission preflight tools
Expose machine-readable principal/tenant confirmation and a non-mutating permission check so agents can verify both before destructive actions.
Description evidence
Defects and rewrites.
3 defects found across the exposed tool descriptions. Suggested rewrites make purpose, inputs, boundaries, and returns easier for an agent to understand.
| Tool | Defect types | Suggested rewrite |
|---|---|---|
create_secret |
no_return_description |
Create a secure, self-destructing link for sharing sensitive data like passwords, API keys, or credentials. The secret is encrypted end-to-end — the server never sees plaintext. Supports reading secrets from environment variables, files, or .env files without exposing them in the conversation. Returns the secure shareable URL (and decryption key) to send to the recipient. |
view_secret |
params_unexplained |
Retrieve and decrypt a secret from a Vaulted secure link, consuming one view before the secret self-destructs at its view limit. Identify the secret with either url (the share link returned by create_secret) or secret_id (the secret's identifier), and provide encryption_key (the decryption key that ships with the link). Supply passphrase if the creator set one, and use output_mode to choose where the content goes — browser (default), clipboard, file, or direct — with file_path specifying the save location when output_mode is 'file'. Returns the decrypted secret content in the selected output mode. |
check_status |
params_unexplained no_return_description |
Check the status of a previously shared secret without consuming a view — how many times it's been viewed, whether it's still active, and when it expires. Identify the secret with either url (the share link) or secret_id (the secret's identifier) and authenticate with status_token. Returns a status report containing view count, active state, and expiration time. |
Selection evidence
Confusable tool pairs.
0 pairs where similar names or overlapping descriptions may send an agent toward the wrong tool.
| Tool A | Tool B | Confidence | Why they collide |
|---|---|---|---|
| No confusable tool pairs were flagged in this assessment. | |||
Compare the field