AI 代理工具
RoutineKit 0.2 Packages Successful MCP Tool Sequences into Reviewable, Replayable Tools
RoutineKit, an independent open-source project, can turn a successful sequence of agent tool calls into a named tool with typed inputs, then replay it with new parameters. It preserves human approval and host safeguards, but currently supports only linear workflows and local stdio MCP—not general-purpose agent recording.
RoutineKit 0.2.0 attempts to turn tool workflows that an agent has successfully completed into deterministic, reusable components. Users first select and review the tool calls, bind variable scalar parameters to typed inputs, and then save the workflow as a named `routine_saved_*` tool. Subsequent replays require only new inputs, without having the model derive each step again. This can reduce token costs for routine operations, file processing, or data-movement workflows, while also limiting path drift caused by the model replanning each run.
The new release adds explicitly configured local stdio MCP connections, tool allowlists, connection review, and success conditions based on returned fields. Saved tools are registered only within the originating agent’s scope and can be rediscovered by clients through MCP tool-list change notifications. Workflows can also be exported as ZIP archives containing `SKILL.md` and `routine.json`. The built-in MCP Apps workbench provides input forms and binding validation, but it has so far been validated only in a browser with the AppBridge SDK; those results should not be generalized to all desktop hosts.
The security boundaries are especially important. Every execution still requires fresh human approval, and exported files do not carry credentials, existing permissions, or the original recorded outputs. However, executables configured as MCP servers still run with the user’s privileges and are not contained within an operating-system sandbox. The stop function is guaranteed to handle only processes launched directly by RoutineKit; it cannot guarantee cleanup of descendant processes or reversal of side effects that have already occurred.
The project says it runs 28 unit and integration tests plus nine browser E2E tests across Node 22 and 24, Windows, macOS, and Linux. However, it currently shows almost no signs of adoption and has not undergone an independent security audit. Engineering teams should watch whether it can add branching, loops, transformations, HTTP MCP, and verifiable tool-version pinning while preserving the boundary that “recording does not equal authorization.”