// SCAN REPORT

Knitbrain

36 tools. 15 can modify or destroy data without limits.

1 destructive tool with no built-in limits. Policy required.

Last updated: 2 Jul 2026

15 can modify or destroy data

21 read-only

36 tools total

Community server · catalogue entry verified 02/07/2026

How to control Knitbrain ↓

TOOL MAP

What Knitbrain exposes to your agents

Read (21) Write / Execute (14) Destructive / Financial (1)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous Knitbrain tools

Destructive · High knitbrain_team_clear This tool deletes team-wide shared data with permanent effect. Execute · High knitbrain_run This is an orchestrator/executor that classifies tasks, proposes agents, and issues directives that control downstream agent behavior and execution. Execute · High knitbrain_run_loop This tool executes arbitrary verification commands (verify_cmd) as a control loop, which constitutes Execute-category behavior. Execute · Medium knitbrain_self_check The description indicates this tool executes an internal diagnostic or validation process ('runs the brain').

15 of Knitbrain's 36 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Knitbrain

PolicyLayer is an MCP gateway — it sits between your AI agents and Knitbrain, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "knitbrain_team_clear": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "knitbrain_compose_skill": {
    "limits": [
      {
        "counter": "knitbrain_compose_skill_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "knitbrain_brain_search": {
    "limits": [
      {
        "counter": "knitbrain_brain_search_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Knitbrain — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON KNITBRAIN →

Instant setup, no code required.

FULL CATALOGUE

All 36 Knitbrain tools

DESTRUCTIVE 1 tools

Destructive knitbrain_team_clear Clear the shared team board (recall originals are retained until tiered out).

EXECUTE 3 tools

Execute knitbrain_run THE feedback/orchestrator tool — call FIRST when the user states a task. Classifies it (small→big), finds-or-d Execute knitbrain_run_loop Autonomous goal loop (ONE cycle per call). Runs your verify_cmd as the REAL hard gate, tracks iteration across Execute knitbrain_self_check Self gap-check (keystone): runs the brain

WRITE 11 tools

Write knitbrain_compose_skill Compose a NEW project-tailored skill for a task in the USER Write knitbrain_create_agent Generate a project-specific subagent (.claude/agents/<name>.md) with 4 guardrails: file scope, allowed-tools, Write knitbrain_learning_outcome Close the loop on a recalled learning: report whether it actually HELPED on this task (a concrete outcome, not Write knitbrain_optimize Compress a payload (JSON / code / prose) into a token-cheap skeleton. The exact original is stored locally and Write knitbrain_record_false_positive The classifier got it wrong? Record it: claimed tier vs what the task actually was. After 3 same-direction rep Write knitbrain_record_learning Record a non-obvious project learning (summary + lesson + tags) for future sessions. Write knitbrain_save_handoff Save session handoff state so the next session can resume. Write knitbrain_skill_outcome Close the loop on a skill: report whether it actually WORKED after using it (a test passing, a bug fixed — a c Write knitbrain_skill_save Persist a refined skill playbook (telegraphic). Same name updates the skill — skills compound across tasks. Write knitbrain_team_post Post a finding to the shared team board (stored compressed; full original recoverable). Write knitbrain_wiki_ingest Ingest a synthesized note into the compounding wiki-brain: writes/updates a terse page, rebuilds the index, ap

READ 21 tools

Read knitbrain_brain_search Unified brain recall (gap 8): fan a query across ALL typed stores — learnings (BM25), the wiki, and the knowle Read knitbrain_classify_task Classify a task into a tier (inquiry/trivial/standard/complex) with phases + plan-mode signal. Follow the retu Read knitbrain_context_meter Token-window meter: how full the context is, tokens saved by optimization, and whether it Read knitbrain_get_learning Fetch the full lesson for a learning id (from knitbrain_search_learnings). Read knitbrain_load_session Load the prior handoff + top recent learnings to resume work. Resets the context meter for the new session. Read knitbrain_metrics Compression telemetry: recall-store tier counts + per-kind retrieval rates (TOIN self-tuning). Read knitbrain_onboard The front door: onboard a project into the brain. Call with NO args first — it scans the repo + imports this p Read knitbrain_ping Health check — returns pong and the server version. Read knitbrain_propose_agents Auto-detect project-specific agent proposals from the knowledge graph (domains + guardrails). Review/edit, the Read knitbrain_query_dependents Which files import the given file (blast radius before editing). Read knitbrain_query_exports What a file exports. Read knitbrain_query_imports What a file imports (module specifiers + names). Read knitbrain_read Read a project file OPTIMIZED: returns a structure-preserving skeleton (signatures/schema kept, bulk elided) + Read knitbrain_retrieve Retrieve the exact original bytes for a ⟨recall:hash⟩ handle produced by compression. Use when a skeleton isn Read knitbrain_scan Scan the project and (re)build the import/export knowledge graph. Read knitbrain_search_learnings Search project learnings; returns ranked headlines (id + summary). Call knitbrain_get_learning for a full less Read knitbrain_team_board Read the shared team board — compressed skeletons of every posting (cheap to scan; fetch full with knitbrain_t Read knitbrain_team_get Fetch the full original of a board posting by id. Read knitbrain_verify_claim Hard claim-check (anti-hallucination): parse a stated codebase fact and check it against the knowledge graph. Read knitbrain_wiki_lint Health-check the wiki-brain: flags claim contradictions across pages (incl. stale claims superseded over time) Read knitbrain_wiki_query Query the wiki-brain: returns the index catalog + recent log so you can drill into the relevant pages (read th

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about Knitbrain

Can an AI agent delete data through the Knitbrain MCP server? +

Yes. The Knitbrain server exposes 1 destructive tools including knitbrain_team_clear. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Knitbrain? +

The Knitbrain server has 11 write tools including knitbrain_compose_skill, knitbrain_create_agent, knitbrain_learning_outcome. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Knitbrain.

How many tools does the Knitbrain MCP server expose? +

36 tools across 4 categories: Destructive, Execute, Read, Write. 21 are read-only. 15 can modify, create, or delete data.

How do I enforce a policy on Knitbrain? +

Register the Knitbrain MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Knitbrain tool call.

Deterministic rules across all 36 Knitbrain tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON KNITBRAIN →

Instant setup, no code required.

36 Knitbrain tools catalogued and risk-classified — across an index of 43,000+ MCP servers.