Skip to main content
Glama

Mnemom — Trust Ratings for AI Agents

by io.github.mnemom

preview_compose_protection_by_agent

Read-onlyIdempotent

Preview composed protection (dry run) — Composes the cascade against a hypothetical body at the agent layer and returns conflicts + the composed view. No DB writes. Used by the dashboard editor for live conflict markers.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
modeYesScreening mode for the protection pipeline. Required. `off` disables screening; `observe` records only; `nudge` warns; `enforce` blocks.
agent_idYesThe agent this card belongs to (e.g. `smolt-abc123`). Identifier only — never place an API key, a secret, an email address, or any other personal data in this field.
thresholdsNoRisk-score cutoffs, each in [0, 1] and ordered warn ≤ quarantine ≤ block. All three are required if this object is sent at all — omit the whole object to accept the composed defaults.
card_versionYesCard schema version. REQUIRED by the server-side validator. Current canonical value: `protection/2026-04-26`.
screen_surfacesNoWhich traffic surfaces are screened. Omit to accept the composed defaults.
trusted_sourcesNoSources exempt from screening. Enumerate specific hosts — wildcards are rejected, and a server-side deny-list (public LLM/DNS endpoints, 0.0.0.0/0, ::/0, link-local, multicast) is always applied.
protected_surfaceNoThe assets and operations this agent must protect. Omit to accept the composed default (empty surface).

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
okYesTrue when composition succeeded (no blocking conflicts).
summaryYesOne-line human-readable summary of composition status.
full_reportNoOptional pointer to the full /v1 conflict report (method + path).
conflicts_countYesTotal number of conflicts detected (0 = none).
composition_validYesTrue when the composed card is valid.

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. Changed32 schema fields changed
    • removedInput schema / $defs
      Removed value: -{
-  "CompositionMetadata": {
-    "description": "System-managed block describing which scope sources merged into the canonical card. Only returned when `?include_composition=true`.",
-    "properties": {
-      "canonical_id": {
-        "type": "string"
-      },
-      "composed_at": {
-        "format": "date-time",
-        "type": "string"
-      },
-      "exemptions_applied": {
-        "items": {
-          "type": "string"
-        },
-        "type": "array"
-      },
-      "scopes_applied": {
-        "items": {
-          "properties": {
-            "card_id": {
-              "type": "string"
-            },
-            "scope": {
-              "description": "`platform`, `org:<id>`, or `agent:<id>`.",
-              "type": "string"
-            },
-            "template_version": {
-              "type": "integer"
-            },
-            "version": {
-              "type": "integer"
-            }
-          },
-          "type": "object"
-        },
-        "type": "array"
-      },
-      "source_card_id": {
-        "type": "string"
-      },
-      "source_policy_id": {
-        "type": "string"
-      }
-    },
-    "type": "object"
-  },
-  "UnifiedProtectionCard": {
-    "description": "Unified protection card (ADR-037). Safe House thresholds + trusted-source policy for a single agent. Shape matches src/composition/types.ts::UnifiedProtectionCard (canonical) and what the runtime validator at src/composition/validate.ts accepts. The customer-facing docs at /concepts/protection-card and /specifications/protection-card-schema document this same shape.",
-    "properties": {
-      "_composition": {
-        "$ref": "#/$defs/CompositionMetadata"
-      },
-      "agent_id": {
-        "type": "string"
-      },
-      "card_id": {
-        "type": "string"
-      },
-      "card_version": {
-        "type": "string"
-      },
-      "content_hash": {
-        "description": "Response-only: content hash of the composed card (`sha256:<hex>`), injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-        "type": "string"
-      },
-      "expires_at": {
-        "format": "date-time",
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "extensions": {
-        "additionalProperties": true,
-        "description": "Free-form extension slot for non-canonical fields. Ignored by the composer; preserved on read for tooling that needs an audit-tail metadata bag.",
-        "type": "object"
-      },
-      "issued_at": {
-        "format": "date-time",
-        "type": "string"
-      },
-      "mode": {
-        "description": "Strictest-wins composition: enforce > nudge > observe > off.",
-        "enum": [
-          "off",
-          "observe",
-          "nudge",
-          "enforce"
-        ],
-        "type": "string"
-      },
-      "protected_surface": {
-        "description": "Org-declared protected surface policy (MNE-830). Strengthen-only UNION across platform → org → team → agent: each scope may add entries; none may remove. The composer always emits this block; callers omit it to inherit the composed floor. See ADR-037 §protected_surface.",
-        "properties": {
-          "assets": {
-            "description": "Protected assets. Intrinsic identity = `${kind}:${selector}` (normalized). Composer merges by identity, keeping the strictest entry per scope.",
-            "items": {
-              "properties": {
-                "kind": {
-                  "description": "Asset kind (e.g. `row`, `field`, `resource`, `table`).",
-                  "type": "string"
-                },
-                "label": {
-                  "description": "Human-facing display label (optional).",
-                  "type": "string"
-                },
-                "reason": {
-                  "description": "Why this asset is protected (optional).",
-                  "type": "string"
-                },
-                "selector": {
-                  "description": "Asset selector (e.g. `customer:critical-0000`, `replica_dsn`).",
-                  "type": "string"
-                },
-                "source_scope": {
-                  "description": "Composer-assigned provenance (`platform`, `org:<id>`, `team:<id>`, `agent:<id>`). Server-assigned — do not send on a PUT.",
-                  "type": "string"
-                }
-              },
-              "required": [
-                "kind",
-                "selector"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "escalation_required": {
-            "description": "Operations that require escalation before proceeding. Same intrinsic-identity + union rules as forbidden_operations (minus severity).",
-            "items": {
-              "properties": {
-                "applies_to": {
-                  "description": "Asset identities this escalation applies to. Empty/absent = GLOBAL.",
-                  "items": {
-                    "type": "string"
-                  },
-                  "type": "array"
-                },
-                "pattern": {
-                  "description": "Operation pattern requiring escalation.",
-                  "type": "string"
-                },
-                "reason": {
-                  "description": "Why escalation is required (optional).",
-                  "type": "string"
-                },
-                "source_scope": {
-                  "description": "Composer-assigned provenance. Server-assigned — do not send on a PUT.",
-                  "type": "string"
-                }
-              },
-              "required": [
-                "pattern"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "forbidden_operations": {
-            "description": "Operations that are unconditionally forbidden. Intrinsic identity = normalized `pattern`. Composer unions across scopes; on identity collision, severity → max.",
-            "items": {
-              "properties": {
-                "applies_to": {
-                  "description": "Asset identities (`${kind}:${selector}`) this operation applies to. Empty/absent means GLOBAL.",
-                  "items": {
-                    "type": "string"
-                  },
-                  "type": "array"
-                },
-                "pattern": {
-                  "description": "Operation pattern (e.g. `TRUNCATE`, `unscoped UPDATE/DELETE`, `exfiltrate:pii`).",
-                  "type": "string"
-                },
-                "reason": {
-                  "description": "Why this operation is forbidden (optional).",
-                  "type": "string"
-                },
-                "severity": {
-                  "description": "Severity level. Composer merges to strictest across scopes.",
-                  "enum": [
-                    "low",
-                    "medium",
-                    "high",
-                    "critical"
-                  ],
-                  "type": "string"
-                },
-                "source_scope": {
-                  "description": "Composer-assigned provenance. Server-assigned — do not send on a PUT.",
-                  "type": "string"
-                }
-              },
-              "required": [
-                "pattern"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          }
-        },
-        "type": "object"
-      },
-      "review": {
-        "description": "Review-hold policy (Safe House Review, Slice 2a — MNE-920 design). gate_on is the minimum verdict band per surface that escalates to a review-hold. Composition is strictest-wins; on_timeout defaults to 'reject' (fail-closed). reviewer.kind 'endpoint' is designed for MNE-1650 and not consumed yet.",
-        "properties": {
-          "enabled": {
-            "type": "boolean"
-          },
-          "gate_on": {
-            "properties": {
-              "incoming": {
-                "enum": [
-                  "off",
-                  "warn",
-                  "quarantine",
-                  "block"
-                ],
-                "type": "string"
-              },
-              "integrity": {
-                "enum": [
-                  "off",
-                  "review_needed",
-                  "boundary_violation"
-                ],
-                "type": "string"
-              },
-              "outgoing": {
-                "enum": [
-                  "off",
-                  "warn",
-                  "quarantine",
-                  "block"
-                ],
-                "type": "string"
-              },
-              "tool_calls": {
-                "enum": [
-                  "off",
-                  "warn",
-                  "quarantine",
-                  "block"
-                ],
-                "type": "string"
-              },
-              "tool_responses": {
-                "enum": [
-                  "off",
-                  "warn",
-                  "quarantine",
-                  "block"
-                ],
-                "type": "string"
-              }
-            },
-            "type": "object"
-          },
-          "notify": {
-            "properties": {
-              "sse": {
-                "type": "boolean"
-              },
-              "webhooks": {
-                "type": "boolean"
-              }
-            },
-            "type": "object"
-          },
-          "on_timeout": {
-            "enum": [
-              "reject",
-              "release"
-            ],
-            "type": "string"
-          },
-          "quarantine_notice": {
-            "maxLength": 2000,
-            "type": "string"
-          },
-          "reviewer": {
-            "properties": {
-              "endpoint_url": {
-                "format": "uri",
-                "type": "string"
-              },
-              "kind": {
-                "enum": [
-                  "builtin_opus",
-                  "endpoint"
-                ],
-                "type": "string"
-              }
-            },
-            "required": [
-              "kind"
-            ],
-            "type": "object"
-          },
-          "sla_seconds": {
-            "minimum": 1,
-            "type": "number"
-          }
-        },
-        "required": [
-          "enabled"
-        ],
-        "type": "object"
-      },
-      "screen_surfaces": {
-        "description": "Which request surfaces Safe House inspects. Composed across scopes by OR-per-field (any scope requiring inspection wins).",
-        "properties": {
-          "incoming": {
-            "description": "The user/principal prompt entering the agent.",
-            "type": "boolean"
-          },
-          "outgoing": {
-            "description": "The agent's response leaving the agent.",
-            "type": "boolean"
-          },
-          "tool_calls": {
-            "description": "Tool-use invocations the agent makes.",
-            "type": "boolean"
-          },
-          "tool_responses": {
-            "description": "Responses to tool calls returning to the agent.",
-            "type": "boolean"
-          }
-        },
-        "required": [
-          "incoming",
-          "outgoing",
-          "tool_calls",
-          "tool_responses"
-        ],
-        "type": "object"
-      },
-      "thresholds": {
-        "description": "Score bands. Must satisfy warn <= quarantine <= block; each value in [0, 1].",
-        "properties": {
-          "block": {
-            "maximum": 1,
-            "minimum": 0,
-            "type": "number"
-          },
-          "quarantine": {
-            "maximum": 1,
-            "minimum": 0,
-            "type": "number"
-          },
-          "warn": {
-            "maximum": 1,
-            "minimum": 0,
-            "type": "number"
-          }
-        },
-        "required": [
-          "warn",
-          "quarantine",
-          "block"
-        ],
-        "type": "object"
-      },
-      "trusted_sources": {
-        "description": "Sources for which detectors short-circuit (each match logged in the trace). Composed as platform->agent intersection (compliance ceiling) with org+agent union inside that ceiling — an agent cannot widen trust beyond what the platform allows.",
-        "properties": {
-          "agent_ids": {
-            "description": "Mnemom agent IDs (mnm-* / smolt-* prefixed).",
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "domains": {
-            "description": "DNS names or host:port entries.",
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "ip_ranges": {
-            "description": "IPv4 or IPv6 CIDR ranges.",
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          }
-        },
-        "required": [
-          "domains",
-          "agent_ids",
-          "ip_ranges"
-        ],
-        "type": "object"
-      },
-      "version": {
-        "description": "Response-only: monotonic card version, injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-        "type": "integer"
-      }
-    },
-    "required": [
-      "card_version",
-      "agent_id",
-      "mode",
-      "thresholds",
-      "screen_surfaces",
-      "trusted_sources"
-    ],
-    "type": "object"
-  }
-}
    • changedInput schema / properties / agent_id / description
      Previous value: -"Agent identifier (e.g. smolt-abc123)"New value: +"The agent this card belongs to (e.g. `smolt-abc123`). Identifier only — never place an API key, a secret, an email address, or any other personal data in this field."
    • addedInput schema / properties / agent_id / maxLength
      Added value: +64
    • addedInput schema / properties / agent_id / minLength
      Added value: +3
    • addedInput schema / properties / agent_id / pattern
      Added value: +"^[A-Za-z0-9][A-Za-z0-9_-]{1,62}[A-Za-z0-9]$"
    • removedInput schema / properties / body
      Removed value: -{
-  "description": "Unified protection card (ADR-037). Safe House thresholds + trusted-source policy for a single agent. Shape matches src/composition/types.ts::UnifiedProtectionCard (canonical) and what the runtime validator at src/composition/validate.ts accepts. The customer-facing docs at /concepts/protection-card and /specifications/protection-card-schema document this same shape.",
-  "properties": {
-    "_composition": {
-      "$ref": "#/$defs/CompositionMetadata"
-    },
-    "agent_id": {
-      "type": "string"
-    },
-    "card_id": {
-      "type": "string"
-    },
-    "card_version": {
-      "type": "string"
-    },
-    "content_hash": {
-      "description": "Response-only: content hash of the composed card (`sha256:<hex>`), injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-      "type": "string"
-    },
-    "expires_at": {
-      "format": "date-time",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "extensions": {
-      "additionalProperties": true,
-      "description": "Free-form extension slot for non-canonical fields. Ignored by the composer; preserved on read for tooling that needs an audit-tail metadata bag.",
-      "type": "object"
-    },
-    "issued_at": {
-      "format": "date-time",
-      "type": "string"
-    },
-    "mode": {
-      "description": "Strictest-wins composition: enforce > nudge > observe > off.",
-      "enum": [
-        "off",
-        "observe",
-        "nudge",
-        "enforce"
-      ],
-      "type": "string"
-    },
-    "protected_surface": {
-      "description": "Org-declared protected surface policy (MNE-830). Strengthen-only UNION across platform → org → team → agent: each scope may add entries; none may remove. The composer always emits this block; callers omit it to inherit the composed floor. See ADR-037 §protected_surface.",
-      "properties": {
-        "assets": {
-          "description": "Protected assets. Intrinsic identity = `${kind}:${selector}` (normalized). Composer merges by identity, keeping the strictest entry per scope.",
-          "items": {
-            "properties": {
-              "kind": {
-                "description": "Asset kind (e.g. `row`, `field`, `resource`, `table`).",
-                "type": "string"
-              },
-              "label": {
-                "description": "Human-facing display label (optional).",
-                "type": "string"
-              },
-              "reason": {
-                "description": "Why this asset is protected (optional).",
-                "type": "string"
-              },
-              "selector": {
-                "description": "Asset selector (e.g. `customer:critical-0000`, `replica_dsn`).",
-                "type": "string"
-              },
-              "source_scope": {
-                "description": "Composer-assigned provenance (`platform`, `org:<id>`, `team:<id>`, `agent:<id>`). Server-assigned — do not send on a PUT.",
-                "type": "string"
-              }
-            },
-            "required": [
-              "kind",
-              "selector"
-            ],
-            "type": "object"
-          },
-          "type": "array"
-        },
-        "escalation_required": {
-          "description": "Operations that require escalation before proceeding. Same intrinsic-identity + union rules as forbidden_operations (minus severity).",
-          "items": {
-            "properties": {
-              "applies_to": {
-                "description": "Asset identities this escalation applies to. Empty/absent = GLOBAL.",
-                "items": {
-                  "type": "string"
-                },
-                "type": "array"
-              },
-              "pattern": {
-                "description": "Operation pattern requiring escalation.",
-                "type": "string"
-              },
-              "reason": {
-                "description": "Why escalation is required (optional).",
-                "type": "string"
-              },
-              "source_scope": {
-                "description": "Composer-assigned provenance. Server-assigned — do not send on a PUT.",
-                "type": "string"
-              }
-            },
-            "required": [
-              "pattern"
-            ],
-            "type": "object"
-          },
-          "type": "array"
-        },
-        "forbidden_operations": {
-          "description": "Operations that are unconditionally forbidden. Intrinsic identity = normalized `pattern`. Composer unions across scopes; on identity collision, severity → max.",
-          "items": {
-            "properties": {
-              "applies_to": {
-                "description": "Asset identities (`${kind}:${selector}`) this operation applies to. Empty/absent means GLOBAL.",
-                "items": {
-                  "type": "string"
-                },
-                "type": "array"
-              },
-              "pattern": {
-                "description": "Operation pattern (e.g. `TRUNCATE`, `unscoped UPDATE/DELETE`, `exfiltrate:pii`).",
-                "type": "string"
-              },
-              "reason": {
-                "description": "Why this operation is forbidden (optional).",
-                "type": "string"
-              },
-              "severity": {
-                "description": "Severity level. Composer merges to strictest across scopes.",
-                "enum": [
-                  "low",
-                  "medium",
-                  "high",
-                  "critical"
-                ],
-                "type": "string"
-              },
-              "source_scope": {
-                "description": "Composer-assigned provenance. Server-assigned — do not send on a PUT.",
-                "type": "string"
-              }
-            },
-            "required": [
-              "pattern"
-            ],
-            "type": "object"
-          },
-          "type": "array"
-        }
-      },
-      "type": "object"
-    },
-    "review": {
-      "description": "Review-hold policy (Safe House Review, Slice 2a — MNE-920 design). gate_on is the minimum verdict band per surface that escalates to a review-hold. Composition is strictest-wins; on_timeout defaults to 'reject' (fail-closed). reviewer.kind 'endpoint' is designed for MNE-1650 and not consumed yet.",
-      "properties": {
-        "enabled": {
-          "type": "boolean"
-        },
-        "gate_on": {
-          "properties": {
-            "incoming": {
-              "enum": [
-                "off",
-                "warn",
-                "quarantine",
-                "block"
-              ],
-              "type": "string"
-            },
-            "integrity": {
-              "enum": [
-                "off",
-                "review_needed",
-                "boundary_violation"
-              ],
-              "type": "string"
-            },
-            "outgoing": {
-              "enum": [
-                "off",
-                "warn",
-                "quarantine",
-                "block"
-              ],
-              "type": "string"
-            },
-            "tool_calls": {
-              "enum": [
-                "off",
-                "warn",
-                "quarantine",
-                "block"
-              ],
-              "type": "string"
-            },
-            "tool_responses": {
-              "enum": [
-                "off",
-                "warn",
-                "quarantine",
-                "block"
-              ],
-              "type": "string"
-            }
-          },
-          "type": "object"
-        },
-        "notify": {
-          "properties": {
-            "sse": {
-              "type": "boolean"
-            },
-            "webhooks": {
-              "type": "boolean"
-            }
-          },
-          "type": "object"
-        },
-        "on_timeout": {
-          "enum": [
-            "reject",
-            "release"
-          ],
-          "type": "string"
-        },
-        "quarantine_notice": {
-          "maxLength": 2000,
-          "type": "string"
-        },
-        "reviewer": {
-          "properties": {
-            "endpoint_url": {
-              "format": "uri",
-              "type": "string"
-            },
-            "kind": {
-              "enum": [
-                "builtin_opus",
-                "endpoint"
-              ],
-              "type": "string"
-            }
-          },
-          "required": [
-            "kind"
-          ],
-          "type": "object"
-        },
-        "sla_seconds": {
-          "minimum": 1,
-          "type": "number"
-        }
-      },
-      "required": [
-        "enabled"
-      ],
-      "type": "object"
-    },
-    "screen_surfaces": {
-      "description": "Which request surfaces Safe House inspects. Composed across scopes by OR-per-field (any scope requiring inspection wins).",
-      "properties": {
-        "incoming": {
-          "description": "The user/principal prompt entering the agent.",
-          "type": "boolean"
-        },
-        "outgoing": {
-          "description": "The agent's response leaving the agent.",
-          "type": "boolean"
-        },
-        "tool_calls": {
-          "description": "Tool-use invocations the agent makes.",
-          "type": "boolean"
-        },
-        "tool_responses": {
-          "description": "Responses to tool calls returning to the agent.",
-          "type": "boolean"
-        }
-      },
-      "required": [
-        "incoming",
-        "outgoing",
-        "tool_calls",
-        "tool_responses"
-      ],
-      "type": "object"
-    },
-    "thresholds": {
-      "description": "Score bands. Must satisfy warn <= quarantine <= block; each value in [0, 1].",
-      "properties": {
-        "block": {
-          "maximum": 1,
-          "minimum": 0,
-          "type": "number"
-        },
-        "quarantine": {
-          "maximum": 1,
-          "minimum": 0,
-          "type": "number"
-        },
-        "warn": {
-          "maximum": 1,
-          "minimum": 0,
-          "type": "number"
-        }
-      },
-      "required": [
-        "warn",
-        "quarantine",
-        "block"
-      ],
-      "type": "object"
-    },
-    "trusted_sources": {
-      "description": "Sources for which detectors short-circuit (each match logged in the trace). Composed as platform->agent intersection (compliance ceiling) with org+agent union inside that ceiling — an agent cannot widen trust beyond what the platform allows.",
-      "properties": {
-        "agent_ids": {
-          "description": "Mnemom agent IDs (mnm-* / smolt-* prefixed).",
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "domains": {
-          "description": "DNS names or host:port entries.",
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "ip_ranges": {
-          "description": "IPv4 or IPv6 CIDR ranges.",
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        }
-      },
-      "required": [
-        "domains",
-        "agent_ids",
-        "ip_ranges"
-      ],
-      "type": "object"
-    },
-    "version": {
-      "description": "Response-only: monotonic card version, injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-      "type": "integer"
-    }
-  },
-  "required": [
-    "card_version",
-    "agent_id",
-    "mode",
-    "thresholds",
-    "screen_surfaces",
-    "trusted_sources"
-  ],
-  "type": "object"
-}
    • addedInput schema / properties / card_version
      Added value: +{
+  "description": "Card schema version. REQUIRED by the server-side validator. Current canonical value: `protection/2026-04-26`.",
+  "maxLength": 40,
+  "minLength": 3,
+  "pattern": "^[A-Za-z0-9][A-Za-z0-9._/-]{1,38}[A-Za-z0-9]$",
+  "type": "string"
+}
    • addedInput schema / properties / mode
      Added value: +{
+  "description": "Screening mode for the protection pipeline. Required. `off` disables screening; `observe` records only; `nudge` warns; `enforce` blocks.",
+  "enum": [
+    "off",
+    "observe",
+    "nudge",
+    "enforce"
+  ],
+  "type": "string"
+}
    • addedInput schema / properties / protected_surface
      Added value: +{
+  "additionalProperties": false,
+  "description": "The assets and operations this agent must protect. Omit to accept the composed default (empty surface).",
+  "properties": {
+    "assets": {
+      "description": "The assets under protection.",
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "kind": {
+            "description": "Asset class — e.g. \"repo\", \"database\", \"bucket\".",
+            "maxLength": 64,
+            "minLength": 1,
+            "type": "string"
+          },
+          "label": {
+            "description": "Short human-readable name for the asset.",
+            "maxLength": 120,
+            "minLength": 1,
+            "type": "string"
+          },
+          "reason": {
+            "description": "Why it is protected, in one short sentence. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          },
+          "selector": {
+            "description": "Which instance — e.g. \"mnemom/mnemom-api\". A resource identifier only: no credentials, no connection strings, no personal data.",
+            "maxLength": 256,
+            "minLength": 1,
+            "type": "string"
+          }
+        },
+        "required": [
+          "kind",
+          "selector"
+        ],
+        "type": "object"
+      },
+      "maxItems": 64,
+      "type": "array"
+    },
+    "escalation_required": {
+      "description": "Operations that require human approval before the agent may proceed.",
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "applies_to": {
+            "description": "Asset identities this entry applies to. Omit to apply to every protected asset.",
+            "items": {
+              "maxLength": 256,
+              "minLength": 1,
+              "type": "string"
+            },
+            "maxItems": 64,
+            "type": "array"
+          },
+          "pattern": {
+            "description": "Operation matcher — e.g. \"force_push\", \"drop_table*\". A short pattern, not a description.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          },
+          "reason": {
+            "description": "Why this entry exists, in one short sentence. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          }
+        },
+        "required": [
+          "pattern"
+        ],
+        "type": "object"
+      },
+      "maxItems": 64,
+      "type": "array"
+    },
+    "forbidden_operations": {
+      "description": "Operations the agent must never perform on the protected assets.",
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "applies_to": {
+            "description": "Asset identities this entry applies to. Omit to apply to every protected asset.",
+            "items": {
+              "maxLength": 256,
+              "minLength": 1,
+              "type": "string"
+            },
+            "maxItems": 64,
+            "type": "array"
+          },
+          "pattern": {
+            "description": "Operation matcher — e.g. \"force_push\", \"drop_table*\". A short pattern, not a description.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          },
+          "reason": {
+            "description": "Why this entry exists, in one short sentence. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          },
+          "severity": {
+            "description": "How serious a violation of this entry is.",
+            "enum": [
+              "low",
+              "medium",
+              "high",
+              "critical"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "pattern"
+        ],
+        "type": "object"
+      },
+      "maxItems": 64,
+      "type": "array"
+    }
+  },
+  "type": "object"
+}
    • addedInput schema / properties / screen_surfaces
      Added value: +{
+  "additionalProperties": false,
+  "description": "Which traffic surfaces are screened. Omit to accept the composed defaults.",
+  "properties": {
+    "incoming": {
+      "description": "Screen prompts arriving at the agent.",
+      "type": "boolean"
+    },
+    "outgoing": {
+      "description": "Screen the agent's outbound messages.",
+      "type": "boolean"
+    },
+    "tool_calls": {
+      "description": "Screen the tool calls the agent makes.",
+      "type": "boolean"
+    },
+    "tool_responses": {
+      "description": "Screen tool responses returned to the agent.",
+      "type": "boolean"
+    }
+  },
+  "type": "object"
+}
    • addedInput schema / properties / thresholds
      Added value: +{
+  "additionalProperties": false,
+  "description": "Risk-score cutoffs, each in [0, 1] and ordered warn ≤ quarantine ≤ block. All three are required if this object is sent at all — omit the whole object to accept the composed defaults.",
+  "properties": {
+    "block": {
+      "description": "Score at or above which the request is refused.",
+      "maximum": 1,
+      "minimum": 0,
+      "type": "number"
+    },
+    "quarantine": {
+      "description": "Score at or above which the request is held for review.",
+      "maximum": 1,
+      "minimum": 0,
+      "type": "number"
+    },
+    "warn": {
+      "description": "Score at or above which the request is flagged.",
+      "maximum": 1,
+      "minimum": 0,
+      "type": "number"
+    }
+  },
+  "required": [
+    "warn",
+    "quarantine",
+    "block"
+  ],
+  "type": "object"
+}
    • addedInput schema / properties / trusted_sources
      Added value: +{
+  "additionalProperties": false,
+  "description": "Sources exempt from screening. Enumerate specific hosts — wildcards are rejected, and a server-side deny-list (public LLM/DNS endpoints, 0.0.0.0/0, ::/0, link-local, multicast) is always applied.",
+  "properties": {
+    "agent_ids": {
+      "description": "Trusted Mnemom agent IDs. Must be in canonical `mnm-*` form.",
+      "items": {
+        "maxLength": 64,
+        "minLength": 8,
+        "pattern": "^mnm-[A-Za-z0-9-]{4,}$",
+        "type": "string"
+      },
+      "maxItems": 64,
+      "type": "array"
+    },
+    "domains": {
+      "description": "Trusted DNS names, optionally with `:port`. No wildcards.",
+      "items": {
+        "maxLength": 253,
+        "minLength": 3,
+        "type": "string"
+      },
+      "maxItems": 64,
+      "type": "array"
+    },
+    "ip_ranges": {
+      "description": "Trusted CIDR ranges (e.g. `10.0.0.0/8`).",
+      "items": {
+        "maxLength": 43,
+        "minLength": 4,
+        "type": "string"
+      },
+      "maxItems": 64,
+      "type": "array"
+    }
+  },
+  "type": "object"
+}
    • changedInput schema / required
      Previous value: -[
-  "agent_id"
-]New value: +[
+  "agent_id",
+  "card_version",
+  "mode"
+]
    • addedOutput schema / properties / composition_valid
      Added value: +{
+  "description": "True when the composed card is valid.",
+  "type": "boolean"
+}
    • removedOutput schema / properties / conflicts
      Removed value: -{
-  "additionalProperties": false,
-  "properties": {
-    "by_reason": {
-      "additionalProperties": {
-        "type": "integer"
-      },
-      "type": "object"
-    },
-    "not_shown": {
-      "description": "Conflicts beyond the inline top-N (present only when > top-N).",
-      "type": "integer"
-    },
-    "overrides": {
-      "items": {
-        "additionalProperties": false,
-        "properties": {
-          "field": {},
-          "from": {},
-          "reason": {},
-          "to": {},
-          "won_by": {}
-        },
-        "type": "object"
-      },
-      "type": "array"
-    },
-    "total": {
-      "type": "integer"
-    }
-  },
-  "required": [
-    "total",
-    "by_reason",
-    "overrides"
-  ],
-  "type": "object"
-}
    • addedOutput schema / properties / conflicts_count
      Added value: +{
+  "description": "Total number of conflicts detected (0 = none).",
+  "type": "integer"
+}
    • removedOutput schema / properties / effective
      Removed value: -{
-  "additionalProperties": false,
-  "properties": {
-    "mode": {
-      "type": "string"
-    },
-    "screen_surfaces": {},
-    "thresholds": {},
-    "trusted_sources_counts": {
-      "additionalProperties": false,
-      "properties": {
-        "agent_ids": {
-          "type": "integer"
-        },
-        "domains": {
-          "type": "integer"
-        },
-        "ip_ranges": {
-          "type": "integer"
-        }
-      },
-      "required": [
-        "domains",
-        "agent_ids",
-        "ip_ranges"
-      ],
-      "type": "object"
-    }
-  },
-  "required": [
-    "trusted_sources_counts"
-  ],
-  "type": "object"
-}
    • removedOutput schema / properties / full_report / additionalProperties
      Removed value: -false
    • addedOutput schema / properties / full_report / description
      Added value: +"Optional pointer to the full /v1 conflict report (method + path)."
    • addedOutput schema / properties / full_report / oneOf
      Added value: +[
+  {
+    "type": "null"
+  },
+  {
+    "additionalProperties": false,
+    "properties": {
+      "method": {
+        "type": "string"
+      },
+      "note": {
+        "type": "string"
+      },
+      "path": {
+        "type": "string"
+      }
+    },
+    "required": [
+      "method",
+      "path",
+      "note"
+    ],
+    "type": "object"
+  }
+]
    • removedOutput schema / properties / full_report / properties
      Removed value: -{
-  "method": {
-    "type": "string"
-  },
-  "note": {
-    "type": "string"
-  },
-  "path": {
-    "type": "string"
-  }
-}
    • removedOutput schema / properties / full_report / required
      Removed value: -[
-  "method",
-  "path",
-  "note"
-]
    • removedOutput schema / properties / full_report / type
      Removed value: -"object"
    • addedOutput schema / properties / ok / description
      Added value: +"True when composition succeeded (no blocking conflicts)."
    • addedOutput schema / properties / summary / description
      Added value: +"One-line human-readable summary of composition status."
    • removedOutput schema / properties / summary / enum
      Removed value: -[
-  true
-]
    • changedOutput schema / properties / summary / type
      Previous value: -"boolean"New value: +"string"
    • removedOutput schema / properties / tool
      Removed value: -{
-  "enum": [
-    "preview_compose_protection_by_agent"
-  ],
-  "type": "string"
-}
    • removedOutput schema / properties / what_changed
      Removed value: -{
-  "type": "string"
-}
    • removedOutput schema / properties / what_to_do_next
      Removed value: -{
-  "type": "string"
-}
    • removedOutput schema / properties / what_would_break
      Removed value: -{
-  "type": "string"
-}
    • changedOutput schema / required
      Previous value: -[
-  "summary",
-  "tool",
-  "ok",
-  "effective",
-  "conflicts",
-  "what_changed",
-  "what_would_break",
-  "what_to_do_next",
-  "full_report"
-]New value: +[
+  "ok",
+  "composition_valid",
+  "conflicts_count",
+  "summary"
+]
  2. Changed2 schema fields changed
    • addedInput schema / $defs / UnifiedProtectionCard / properties / review
      Added value: +{
+  "description": "Review-hold policy (Safe House Review, Slice 2a — MNE-920 design). gate_on is the minimum verdict band per surface that escalates to a review-hold. Composition is strictest-wins; on_timeout defaults to 'reject' (fail-closed). reviewer.kind 'endpoint' is designed for MNE-1650 and not consumed yet.",
+  "properties": {
+    "enabled": {
+      "type": "boolean"
+    },
+    "gate_on": {
+      "properties": {
+        "incoming": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "integrity": {
+          "enum": [
+            "off",
+            "review_needed",
+            "boundary_violation"
+          ],
+          "type": "string"
+        },
+        "outgoing": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "tool_calls": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "tool_responses": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "notify": {
+      "properties": {
+        "sse": {
+          "type": "boolean"
+        },
+        "webhooks": {
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "on_timeout": {
+      "enum": [
+        "reject",
+        "release"
+      ],
+      "type": "string"
+    },
+    "quarantine_notice": {
+      "maxLength": 2000,
+      "type": "string"
+    },
+    "reviewer": {
+      "properties": {
+        "endpoint_url": {
+          "format": "uri",
+          "type": "string"
+        },
+        "kind": {
+          "enum": [
+            "builtin_opus",
+            "endpoint"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "kind"
+      ],
+      "type": "object"
+    },
+    "sla_seconds": {
+      "minimum": 1,
+      "type": "number"
+    }
+  },
+  "required": [
+    "enabled"
+  ],
+  "type": "object"
+}
    • addedInput schema / properties / body / properties / review
      Added value: +{
+  "description": "Review-hold policy (Safe House Review, Slice 2a — MNE-920 design). gate_on is the minimum verdict band per surface that escalates to a review-hold. Composition is strictest-wins; on_timeout defaults to 'reject' (fail-closed). reviewer.kind 'endpoint' is designed for MNE-1650 and not consumed yet.",
+  "properties": {
+    "enabled": {
+      "type": "boolean"
+    },
+    "gate_on": {
+      "properties": {
+        "incoming": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "integrity": {
+          "enum": [
+            "off",
+            "review_needed",
+            "boundary_violation"
+          ],
+          "type": "string"
+        },
+        "outgoing": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "tool_calls": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "tool_responses": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "notify": {
+      "properties": {
+        "sse": {
+          "type": "boolean"
+        },
+        "webhooks": {
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "on_timeout": {
+      "enum": [
+        "reject",
+        "release"
+      ],
+      "type": "string"
+    },
+    "quarantine_notice": {
+      "maxLength": 2000,
+      "type": "string"
+    },
+    "reviewer": {
+      "properties": {
+        "endpoint_url": {
+          "format": "uri",
+          "type": "string"
+        },
+        "kind": {
+          "enum": [
+            "builtin_opus",
+            "endpoint"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "kind"
+      ],
+      "type": "object"
+    },
+    "sla_seconds": {
+      "minimum": 1,
+      "type": "number"
+    }
+  },
+  "required": [
+    "enabled"
+  ],
+  "type": "object"
+}
  3. Added

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds valuable behavioral context beyond these: it explains the tool performs a dry run against a hypothetical body, returns conflicts plus the composed view, and explicitly confirms no database writes. This aligns with annotations and enriches understanding without contradicting them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the core purpose ('Preview composed protection (dry run)') and immediately conveys key traits ('No DB writes', returns conflicts + composed view, dashboard editor use). Every word earns its place with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (7 params, nested objects, output schema), the description covers the high-level behavior, safety profile, and intended usage. It does not need to explain return values because an output schema exists. It could have elaborated on what a 'hypothetical body' is, but the annotations, schema, and output schema collectively fill the gaps, making it sufficiently complete for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description does not add specific parameter-level semantics beyond what the schema provides, and it does mention 'hypothetical body' but does not map that to individual parameters. However, the schema descriptions are already rich, so no significant gap exists.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Preview composed protection (dry run)') and resource ('protection'), and clearly states the tool composes the cascade against a hypothetical body and returns conflicts + composed view. It also distinguishes itself from siblings by emphasizing 'No DB writes' and the dashboard editor use case, differentiating it from preview_compose_alignment_by_agent and put_protection_by_agent.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description specifies a clear use case: 'Used by the dashboard editor for live conflict markers.' It also implies a dry-run/no-persistence context with 'No DB writes,' which suggests when not to use it (i.e., when persistence is needed), though it does not explicitly name put_protection_by_agent as the alternative. This is clear context but lacks explicit exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Mnemom — Trust Ratings for AI Agents toolsInspect
Try in Browser
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.1/5.0
Disambiguation5/5

Each tool targets a distinct operation: identity claiming, lookup, reputation retrieval/badge, scanning, verification, alignment/protection management, and feedback. No significant overlap exists.

Naming Consistency5/5

All tools follow a consistent verb_noun pattern using snake_case (e.g., claim_agent, get_reputation, verify_scan). Even complex names like preview_compose_alignment_by_agent adhere to the pattern.

Tool Count4/5

With 16 tools, the set is slightly heavy but still well-scoped for the domain of AI agent trust ratings. Each tool serves a clear purpose, and no tool feels redundant.

Completeness4/5

The surface covers core workflows: agent identity, reputation, alignment/protection, scanning, verification, and feedback. Minor gaps like agent updates or deletion might exist, but the core lifecycle is complete.

Resources