Catalog of the MCP tools. Pure data: each tool declares its MCP wire fields (name, description, JSON-Schema inputSchema) and its capability tier. Execution lives in boundary.mcp.shell.tools; the gate + audit live in the dispatch.
Tier 0 (BOU-100): :read — zero mutation (explain-error, lint, validate-schema, describe-module, sql-preview).
Tier 1 (BOU-101): :generate — write to disk, reversible via git
(scaffold-module, add-field, gen-tests, gen-migration). Each runs the closed
verify loop (generate → write → kondo → FC/IS → run affected tests →
structured report) so the agent self-corrects. The allow flag requests an
audited override of the soft guardrails (FC/IS BND-806, convention
BND-807); kondo errors and test failures are never overridable.
Tier 2 (BOU-102): :execute — the RCE surface, off by default (run-tests, eval, run-migration, query-db). The security gate denies :execute in every context except :full (local dev), so these refuse in prod/CI; the dispatch audits every call, and each executor additionally audits its payload. The real work is injected (test-runner / evaluator / migrator / db-query) so it targets the project, not the server, and is stubbable in tests.
Catalog of the MCP tools. Pure data: each tool declares its MCP wire fields (name, description, JSON-Schema inputSchema) and its capability tier. Execution lives in boundary.mcp.shell.tools; the gate + audit live in the dispatch. Tier 0 (BOU-100): :read — zero mutation (explain-error, lint, validate-schema, describe-module, sql-preview). Tier 1 (BOU-101): :generate — write to disk, reversible via git (scaffold-module, add-field, gen-tests, gen-migration). Each runs the closed verify loop (generate → write → kondo → FC/IS → run affected tests → structured report) so the agent self-corrects. The `allow` flag requests an audited override of the *soft* guardrails (FC/IS BND-806, convention BND-807); kondo errors and test failures are never overridable. Tier 2 (BOU-102): :execute — the RCE surface, off by default (run-tests, eval, run-migration, query-db). The security gate denies :execute in every context except :full (local dev), so these refuse in prod/CI; the dispatch audits every call, and each executor additionally audits its payload. The real work is injected (test-runner / evaluator / migrator / db-query) so it targets the project, not the server, and is stubbable in tests.
(capability name)Capability tier for tool name (nil if unknown). All Tier 0 tools are :read.
Capability tier for tool `name` (nil if unknown). All Tier 0 tools are :read.
cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |