Measured product evidence

Agent API handshake and 54-tool discovery

Measured 22 August 2026 · Signed Cadre 1.0.0-rc.18 · Standalone Claude plugin v1.0.1

We connected the separately published Claude plugin to the signed and Apple-notarized public Cadre build, initialized the local Model Context Protocol connection, enumerated every advertised tool and measured repeated read-only calls. The raw observations and the frozen collector used to produce them are public below.

Version boundary: this historical signed rc.18 build advertised 54 tools. The current Cadre Agent API exposes 57 tools; its current 57-tool reference is separate from this dated measurement.

Result

The complete ordered list of the 54 tools advertised by rc.18, all 25 latency samples and SHA-256 values for the dated collector and each of the plugin's eight files are in the raw JSON record. The current 57-tool reference documents today's operations and identifies whether each mutates the project.

The record and measurements are released under CC0 1.0 so they can be cited and independently checked.

Test environment

• Hardware: Apple M2 Max Mac14,5 with 32 GB memory.
• Operating system: macOS 15.6.1 on arm64.
• Local runtime: Node.js v26.7.0 selected by the plugin's launcher.
• Application state: no project open, export idle, live licensing service on the free plan.
• Cloud boundary: MCP transport was observed on loopback and no model was invoked. The test did not instrument unrelated network activity.

Method

1. Download the versioned public Cadre 1.0.0-rc.18 DMG and Cadre-Claude-Plugin-v1.0.1.zip; require their pinned byte counts and SHA-256 values, then require every extracted plugin file to match its ZIP entry before executing it.
2. Mount that exact disk image read-only. Verify the mounted and running apps with macOS codesign, verify the mounted app with Gatekeeper and stapler, then require their identifiers, team, version and CDHash to match the pinned release. Confirm that the connection-file PID owns the running app and every observed listener endpoint is loopback-only.
3. Bind the released plugin bridge to the exact connection file validated above, require that record to remain unchanged throughout measurement, negotiate MCP, call tools/list and count the returned safety annotations.
4. Call get_app_state five times as warm-up, then 25 times sequentially using a monotonic clock. The reported latency includes the plugin bridge's connection-file and process-liveness checks.
5. Write only sanitized facts: no bearer token, port, process id, account email, home-directory path or project data enters the evidence record.

Reproduce it

With Cadre open, Node.js 22, 24 or 26 available and the plugin ZIP extracted, download the versioned collector and run:

node collect-agent-api-evidence-2026-08-22.mjs \
  --plugin-root /path/to/cadre-video-editor-plugin \
  --archive /path/to/Cadre-Claude-Plugin-v1.0.1.zip \
  --dmg /path/to/CADRE.dmg \
  --app /Volumes/Cadre\ 1.0.0-rc.18-arm64/Cadre.app \
  --running-app /Applications/Cadre.app

The collector fails before starting the plugin unless the pinned artifact hashes, extracted ZIP contents, read-only DMG mount, running-app identity, signatures, notarization, listener ownership, loopback bind and file permissions match. After connecting, it refuses to print a sanitized JSON record unless the pinned versions, protocol and exact 54-tool name hash also match.

What this does not prove

This is a compatibility and local-transport test, not a customer-outcome claim. It does not exercise recording, editing mutations, caption generation, export or model reasoning quality. The free-plan run deliberately did not invoke the paid export path. The latency sample describes this Mac at this time and should not be generalized to other hardware or workloads.

Corrections or reproducibility reports can be sent to jack@cadre.cam. See the current build verification for the downloadable application's artifact identity.