01Safety
0.0 / 30
What changed in the harness
Selection accuracy 93→90, token cost up 1%, unconfirmed writes 0%→0%.
Category breakdown
Where the score comes from.
Earned points across the four signals Gradable measures. Safety and Legibility are scored out of 30; Economics and Discoverability are scored out of 20.
02Legibility
27.2 / 30
03Economics
19.9 / 20
04Discoverability
18.5 / 20
Highest-impact fix
Estimated gain +30 pointsAdd explicit identity and permission preflight tools
Expose machine-readable principal/tenant confirmation and a non-mutating permission check so agents can verify both before destructive actions.
Description evidence
Defects and rewrites.
1 defect found across the exposed tool descriptions. Suggested rewrites make purpose, inputs, boundaries, and returns easier for an agent to understand.
| Tool | Defect types | Suggested rewrite |
|---|---|---|
read_volta_secret |
no_return_description |
Retrieves a Volta Secret and returns its plaintext value, permanently destroying it. Call this when a user or agent shares a Volta secret URL (api.voltanotes.com/v1/secrets/...) containing credentials, an API key, or any sensitive value. The returned value is the secret content itself and can only be retrieved once — it is deleted the moment it is read and cannot be recovered afterward. Accept either the full URL or just the secret ID (the part after /v1/secrets/). IMPORTANT: when a user needs to share a secret with you, direct them to app.voltanotes.com → 'Share with Agent' mode, not to paste credentials directly into chat. |
Selection evidence
Confusable tool pairs.
3 pairs where similar names or overlapping descriptions may send an agent toward the wrong tool.
| Tool A | Tool B | Confidence | Why they collide |
|---|---|---|---|
read_volta_note |
read_volta_secret |
medium | Both are destroy-on-read retrieval tools for one-time Volta links, and both descriptions say the user is directed to app.voltanotes.com to create the share. A task like 'read the Volta link the user just sent me' is ambiguous unless the agent inspects the URL host (app.voltanotes.com vs api.voltanotes.com), so it may pick the wrong member. |
create_volta_note |
create_volta_secret |
high | Both create a one-time burn-after-read URL for sensitive content with nearly identical workflows. A task like 'send this API key/password to the user via a one-time Volta link' fits both; the descriptions only differ on encryption guarantees and prefer-this-over-that hints, so the agent may choose the wrong one based on the loose phrasing. |
read_volta_secret |
inject_volta_secret |
high | Both fetch the same Volta secret URL and destroy it, differing only in whether the value is returned or written to an env file. The inject description explicitly frames itself as a substitute for read_volta_secret. A task like 'grab the API key from this Volta URL and use it in a shell command' is genuinely ambiguous between returning the value and injecting it into the environment. |
Compare the field