// SCAN REPORT

Lockstep

43 tools. 29 can modify or destroy data without limits.

4 destructive tools with no built-in limits. Policy required.

Last updated: 30 Jun 2026

29 can modify or destroy data

14 read-only

43 tools total

Community server · catalogue entry verified 30/06/2026

How to control Lockstep ↓

TOOL MAP

What Lockstep exposes to your agents

Read (14) Write / Execute (25) Destructive / Financial (4)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous Lockstep tools

Destructive · High discussion_cleanup Although the primary action (archiving) is reversible, the tool explicitly permits deletion of archived discussions, which is irreversible and cannot be undone. Destructive · High implementer_reset Reset operations that affect 'all implementers' in a collaborative development system are destructive because they cannot be easily undone and would eliminate current state without backup or rollback capability. Destructive · High session_reset The tool irreversibly deletes or overwrites data: it clears all tasks, locks, notes, and archives discussions in a coordination session. Destructive · High worktree_cleanup Cleaning up worktrees involves removing git worktrees and their associated working directories.

29 of Lockstep's 43 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Lockstep

PolicyLayer is an MCP gateway — it sits between your AI agents and Lockstep, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "discussion_cleanup": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "artifact_write": {
    "limits": [
      {
        "counter": "artifact_write_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "artifact_read": {
    "limits": [
      {
        "counter": "artifact_read_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Lockstep — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON LOCKSTEP →

Instant setup, no code required.

FULL CATALOGUE

All 43 Lockstep tools

DESTRUCTIVE 4 tools

Destructive discussion_cleanup Archive old resolved discussions and optionally delete old archived ones. Use for maintenance. Destructive implementer_reset Reset all implementers to Destructive session_reset PLANNER ONLY: Reset the coordination session for a fresh start. Clears all tasks, locks, notes, and archives d Destructive worktree_cleanup Clean up orphaned worktrees that no longer have active implementers. Call this during maintenance.

EXECUTE 5 tools

Execute command_run Run a shell command Execute dashboard_open Open the lockstep dashboard in a browser. Call this to monitor progress visually. Execute launch_implementer Launch a new implementer agent (Claude or Codex) in a new terminal window. The planner uses this to spawn work Execute tool_install Install a tool using a package manager Execute worktree_merge Merge an implementer

WRITE 20 tools

Write artifact_write Write an artifact file Write coordination_init Initialize coordination session. Call this first to set up your role (planner or implementer). Returns guidanc Write discussion_archive Archive a resolved discussion. Archived discussions can be deleted later. Write discussion_reply Reply to an existing discussion thread. Write discussion_resolve Resolve a discussion with a final decision. Creates an auditable record of the decision. Write discussion_start Start a new discussion thread. Use this when you need input from other agents or want to discuss an architectu Write file_write Write a file Write lock_acquire Acquire a named lock Write lock_release Release a lock Write log_append Append a log entry Write note_append Append a note Write project_context_set Store project context (description, goals, tech stack, acceptance criteria, tests, implementation plan). Calle Write project_status_set Set the project status. Use Write task_approve PLANNER ONLY: Approve a task that is in review status, marking it done Write task_approve_batch PLANNER ONLY: Approve multiple tasks at once. More efficient than approving one by one. Write task_claim Claim a task and set status to in_progress Write task_create Create a task. Complexity determines review requirements: simple=no review, medium=verify on completion, compl Write task_request_changes PLANNER ONLY: Request changes on a task in review, sending it back to in_progress Write task_submit_for_review Submit a completed task for planner review (required for complex/critical tasks, recommended for medium) Write task_update Update a task

READ 14 tools

Read artifact_read Read an artifact file Read discussion_get Get a discussion thread with all its messages. Read discussion_inbox Check for discussions waiting on you. Call this between tasks to see if anyone needs your input. Read discussion_list List discussions. Use this to check for discussions waiting on you. Read file_read Read a file Read implementer_list List all registered implementers and their status. Read lock_list List locks with optional filters Read note_list List recent notes Read project_context_get Get stored project context. Returns the project description, goals, and other context set by the planner. Read status_get Get coordinator config and state summary Read task_list List tasks with optional filters. For active work, defaults to excluding done tasks to reduce response size. U Read task_summary Get task counts by status. Lighter than task_list - use when you just need to know how many tasks are in each Read worktree_list List all active lockstep worktrees in the project. Read worktree_status Get the status of a worktree including commits ahead/behind main, modified files, and untracked files. Use thi

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about Lockstep

Can an AI agent delete data through the Lockstep MCP server? +

Yes. The Lockstep server exposes 4 destructive tools including discussion_cleanup, implementer_reset, session_reset. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Lockstep? +

The Lockstep server has 20 write tools including artifact_write, coordination_init, discussion_archive. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Lockstep.

How many tools does the Lockstep MCP server expose? +

43 tools across 4 categories: Destructive, Execute, Read, Write. 14 are read-only. 29 can modify, create, or delete data.

How do I enforce a policy on Lockstep? +

Register the Lockstep MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Lockstep tool call.

Deterministic rules across all 43 Lockstep tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON LOCKSTEP →

Instant setup, no code required.

43 Lockstep tools catalogued and risk-classified — across an index of 43,000+ MCP servers.