Mnemom — Trust Ratings for AI Agents

put_protection_by_agent

DestructiveIdempotent

Publish or replace the protection manifest — Accepts YAML (text/yaml, application/yaml) or JSON. Body is the full UnifiedProtectionCard; server-side composition merges it across the platform → org → team → agent cascade and writes the canonical composed card. Requires Idempotency-Key. Hon...

Input Schema

TableJSON Schema

Name	Required	Description
`mode`	Yes	Screening mode for the protection pipeline. Required. `off` disables screening; `observe` records only; `nudge` warns; `enforce` blocks.
`agent_id`	Yes	The agent this card belongs to (e.g. `smolt-abc123`). Identifier only — never place an API key, a secret, an email address, or any other personal data in this field.
`thresholds`	No	Risk-score cutoffs, each in [0, 1] and ordered warn ≤ quarantine ≤ block. All three are required if this object is sent at all — omit the whole object to accept the composed defaults.
`card_version`	Yes	Card schema version. REQUIRED by the server-side validator. Current canonical value: `protection/2026-04-26`.
`screen_surfaces`	No	Which traffic surfaces are screened. Omit to accept the composed defaults.
`trusted_sources`	No	Sources exempt from screening. Enumerate specific hosts — wildcards are rejected, and a server-side deny-list (public LLM/DNS endpoints, 0.0.0.0/0, ::/0, link-local, multicast) is always applied.
`protected_surface`	No	The assets and operations this agent must protect. Omit to accept the composed default (empty surface).

Output Schema

TableJSON Schema

Name	Required	Description
`ok`	Yes	Always true on successful storage (errors return non-200 status).
`card_id`	Yes	Card ID (pc-{uuid}) of the stored protection card.
`issued_at`	Yes	ISO 8601 timestamp when the card was issued/stored.

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

Changed34 schema fields changedAug 5, 2026

removedInput schema / $defs

Removed value: -{
-  "CompositionMetadata": {
-    "description": "System-managed block describing which scope sources merged into the canonical card. Only returned when `?include_composition=true`.",
-    "properties": {
-      "canonical_id": {
-        "type": "string"
-      },
-      "composed_at": {
-        "format": "date-time",
-        "type": "string"
-      },
-      "exemptions_applied": {
-        "items": {
-          "type": "string"
-        },
-        "type": "array"
-      },
-      "scopes_applied": {
-        "items": {
-          "properties": {
-            "card_id": {
-              "type": "string"
-            },
-            "scope": {
-              "description": "`platform`, `org:<id>`, or `agent:<id>`.",
-              "type": "string"
-            },
-            "template_version": {
-              "type": "integer"
-            },
-            "version": {
-              "type": "integer"
-            }
-          },
-          "type": "object"
-        },
-        "type": "array"
-      },
-      "source_card_id": {
-        "type": "string"
-      },
-      "source_policy_id": {
-        "type": "string"
-      }
-    },
-    "type": "object"
-  },
-  "UnifiedProtectionCard": {
-    "description": "Unified protection card (ADR-037). Safe House thresholds + trusted-source policy for a single agent. Shape matches src/composition/types.ts::UnifiedProtectionCard (canonical) and what the runtime validator at src/composition/validate.ts accepts. The customer-facing docs at /concepts/protection-card and /specifications/protection-card-schema document this same shape.",
-    "properties": {
-      "_composition": {
-        "$ref": "#/$defs/CompositionMetadata"
-      },
-      "agent_id": {
-        "type": "string"
-      },
-      "card_id": {
-        "type": "string"
-      },
-      "card_version": {
-        "type": "string"
-      },
-      "content_hash": {
-        "description": "Response-only: content hash of the composed card (`sha256:<hex>`), injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-        "type": "string"
-      },
-      "expires_at": {
-        "format": "date-time",
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "extensions": {
-        "additionalProperties": true,
-        "description": "Free-form extension slot for non-canonical fields. Ignored by the composer; preserved on read for tooling that needs an audit-tail metadata bag.",
-        "type": "object"
-      },
-      "issued_at": {
-        "format": "date-time",
-        "type": "string"
-      },
-      "mode": {
-        "description": "Strictest-wins composition: enforce > nudge > observe > off.",
-        "enum": [
-          "off",
-          "observe",
-          "nudge",
-          "enforce"
-        ],
-        "type": "string"
-      },
-      "protected_surface": {
-        "description": "Org-declared protected surface policy (MNE-830). Strengthen-only UNION across platform → org → team → agent: each scope may add entries; none may remove. The composer always emits this block; callers omit it to inherit the composed floor. See ADR-037 §protected_surface.",
-        "properties": {
-          "assets": {
-            "description": "Protected assets. Intrinsic identity = `${kind}:${selector}` (normalized). Composer merges by identity, keeping the strictest entry per scope.",
-            "items": {
-              "properties": {
-                "kind": {
-                  "description": "Asset kind (e.g. `row`, `field`, `resource`, `table`).",
-                  "type": "string"
-                },
-                "label": {
-                  "description": "Human-facing display label (optional).",
-                  "type": "string"
-                },
-                "reason": {
-                  "description": "Why this asset is protected (optional).",
-                  "type": "string"
-                },
-                "selector": {
-                  "description": "Asset selector (e.g. `customer:critical-0000`, `replica_dsn`).",
-                  "type": "string"
-                },
-                "source_scope": {
-                  "description": "Composer-assigned provenance (`platform`, `org:<id>`, `team:<id>`, `agent:<id>`). Server-assigned — do not send on a PUT.",
-                  "type": "string"
-                }
-              },
-              "required": [
-                "kind",
-                "selector"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "escalation_required": {
-            "description": "Operations that require escalation before proceeding. Same intrinsic-identity + union rules as forbidden_operations (minus severity).",
-            "items": {
-              "properties": {
-                "applies_to": {
-                  "description": "Asset identities this escalation applies to. Empty/absent = GLOBAL.",
-                  "items": {
-                    "type": "string"
-                  },
-                  "type": "array"
-                },
-                "pattern": {
-                  "description": "Operation pattern requiring escalation.",
-                  "type": "string"
-                },
-                "reason": {
-                  "description": "Why escalation is required (optional).",
-                  "type": "string"
-                },
-                "source_scope": {
-                  "description": "Composer-assigned provenance. Server-assigned — do not send on a PUT.",
-                  "type": "string"
-                }
-              },
-              "required": [
-                "pattern"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "forbidden_operations": {
-            "description": "Operations that are unconditionally forbidden. Intrinsic identity = normalized `pattern`. Composer unions across scopes; on identity collision, severity → max.",
-            "items": {
-              "properties": {
-                "applies_to": {
-                  "description": "Asset identities (`${kind}:${selector}`) this operation applies to. Empty/absent means GLOBAL.",
-                  "items": {
-                    "type": "string"
-                  },
-                  "type": "array"
-                },
-                "pattern": {
-                  "description": "Operation pattern (e.g. `TRUNCATE`, `unscoped UPDATE/DELETE`, `exfiltrate:pii`).",
-                  "type": "string"
-                },
-                "reason": {
-                  "description": "Why this operation is forbidden (optional).",
-                  "type": "string"
-                },
-                "severity": {
-                  "description": "Severity level. Composer merges to strictest across scopes.",
-                  "enum": [
-                    "low",
-                    "medium",
-                    "high",
-                    "critical"
-                  ],
-                  "type": "string"
-                },
-                "source_scope": {
-                  "description": "Composer-assigned provenance. Server-assigned — do not send on a PUT.",
-                  "type": "string"
-                }
-              },
-              "required": [
-                "pattern"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          }
-        },
-        "type": "object"
-      },
-      "review": {
-        "description": "Review-hold policy (Safe House Review, Slice 2a — MNE-920 design). gate_on is the minimum verdict band per surface that escalates to a review-hold. Composition is strictest-wins; on_timeout defaults to 'reject' (fail-closed). reviewer.kind 'endpoint' is designed for MNE-1650 and not consumed yet.",
-        "properties": {
-          "enabled": {
-            "type": "boolean"
-          },
-          "gate_on": {
-            "properties": {
-              "incoming": {
-                "enum": [
-                  "off",
-                  "warn",
-                  "quarantine",
-                  "block"
-                ],
-                "type": "string"
-              },
-              "integrity": {
-                "enum": [
-                  "off",
-                  "review_needed",
-                  "boundary_violation"
-                ],
-                "type": "string"
-              },
-              "outgoing": {
-                "enum": [
-                  "off",
-                  "warn",
-                  "quarantine",
-                  "block"
-                ],
-                "type": "string"
-              },
-              "tool_calls": {
-                "enum": [
-                  "off",
-                  "warn",
-                  "quarantine",
-                  "block"
-                ],
-                "type": "string"
-              },
-              "tool_responses": {
-                "enum": [
-                  "off",
-                  "warn",
-                  "quarantine",
-                  "block"
-                ],
-                "type": "string"
-              }
-            },
-            "type": "object"
-          },
-          "notify": {
-            "properties": {
-              "sse": {
-                "type": "boolean"
-              },
-              "webhooks": {
-                "type": "boolean"
-              }
-            },
-            "type": "object"
-          },
-          "on_timeout": {
-            "enum": [
-              "reject",
-              "release"
-            ],
-            "type": "string"
-          },
-          "quarantine_notice": {
-            "maxLength": 2000,
-            "type": "string"
-          },
-          "reviewer": {
-            "properties": {
-              "endpoint_url": {
-                "format": "uri",
-                "type": "string"
-              },
-              "kind": {
-                "enum": [
-                  "builtin_opus",
-                  "endpoint"
-                ],
-                "type": "string"
-              }
-            },
-            "required": [
-              "kind"
-            ],
-            "type": "object"
-          },
-          "sla_seconds": {
-            "minimum": 1,
-            "type": "number"
-          }
-        },
-        "required": [
-          "enabled"
-        ],
-        "type": "object"
-      },
-      "screen_surfaces": {
-        "description": "Which request surfaces Safe House inspects. Composed across scopes by OR-per-field (any scope requiring inspection wins).",
-        "properties": {
-          "incoming": {
-            "description": "The user/principal prompt entering the agent.",
-            "type": "boolean"
-          },
-          "outgoing": {
-            "description": "The agent's response leaving the agent.",
-            "type": "boolean"
-          },
-          "tool_calls": {
-            "description": "Tool-use invocations the agent makes.",
-            "type": "boolean"
-          },
-          "tool_responses": {
-            "description": "Responses to tool calls returning to the agent.",
-            "type": "boolean"
-          }
-        },
-        "required": [
-          "incoming",
-          "outgoing",
-          "tool_calls",
-          "tool_responses"
-        ],
-        "type": "object"
-      },
-      "thresholds": {
-        "description": "Score bands. Must satisfy warn <= quarantine <= block; each value in [0, 1].",
-        "properties": {
-          "block": {
-            "maximum": 1,
-            "minimum": 0,
-            "type": "number"
-          },
-          "quarantine": {
-            "maximum": 1,
-            "minimum": 0,
-            "type": "number"
-          },
-          "warn": {
-            "maximum": 1,
-            "minimum": 0,
-            "type": "number"
-          }
-        },
-        "required": [
-          "warn",
-          "quarantine",
-          "block"
-        ],
-        "type": "object"
-      },
-      "trusted_sources": {
-        "description": "Sources for which detectors short-circuit (each match logged in the trace). Composed as platform->agent intersection (compliance ceiling) with org+agent union inside that ceiling — an agent cannot widen trust beyond what the platform allows.",
-        "properties": {
-          "agent_ids": {
-            "description": "Mnemom agent IDs (mnm-* / smolt-* prefixed).",
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "domains": {
-            "description": "DNS names or host:port entries.",
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "ip_ranges": {
-            "description": "IPv4 or IPv6 CIDR ranges.",
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          }
-        },
-        "required": [
-          "domains",
-          "agent_ids",
-          "ip_ranges"
-        ],
-        "type": "object"
-      },
-      "version": {
-        "description": "Response-only: monotonic card version, injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-        "type": "integer"
-      }
-    },
-    "required": [
-      "card_version",
-      "agent_id",
-      "mode",
-      "thresholds",
-      "screen_surfaces",
-      "trusted_sources"
-    ],
-    "type": "object"
-  }
-}

changedInput schema / properties / agent_id / description

Previous value: -"Agent identifier (e.g. smolt-abc123)"New value: +"The agent this card belongs to (e.g. `smolt-abc123`). Identifier only — never place an API key, a secret, an email address, or any other personal data in this field."

addedInput schema / properties / agent_id / maxLength
```
Added value: +64
```
addedInput schema / properties / agent_id / minLength
```
Added value: +3
```

addedInput schema / properties / agent_id / pattern

Added value: +"^[A-Za-z0-9][A-Za-z0-9_-]{1,62}[A-Za-z0-9]$"

removedInput schema / properties / body

Removed value: -{
-  "description": "Unified protection card (ADR-037). Safe House thresholds + trusted-source policy for a single agent. Shape matches src/composition/types.ts::UnifiedProtectionCard (canonical) and what the runtime validator at src/composition/validate.ts accepts. The customer-facing docs at /concepts/protection-card and /specifications/protection-card-schema document this same shape.",
-  "properties": {
-    "_composition": {
-      "$ref": "#/$defs/CompositionMetadata"
-    },
-    "agent_id": {
-      "type": "string"
-    },
-    "card_id": {
-      "type": "string"
-    },
-    "card_version": {
-      "type": "string"
-    },
-    "content_hash": {
-      "description": "Response-only: content hash of the composed card (`sha256:<hex>`), injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-      "type": "string"
-    },
-    "expires_at": {
-      "format": "date-time",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "extensions": {
-      "additionalProperties": true,
-      "description": "Free-form extension slot for non-canonical fields. Ignored by the composer; preserved on read for tooling that needs an audit-tail metadata bag.",
-      "type": "object"
-    },
-    "issued_at": {
-      "format": "date-time",
-      "type": "string"
-    },
-    "mode": {
-      "description": "Strictest-wins composition: enforce > nudge > observe > off.",
-      "enum": [
-        "off",
-        "observe",
-        "nudge",
-        "enforce"
-      ],
-      "type": "string"
-    },
-    "protected_surface": {
-      "description": "Org-declared protected surface policy (MNE-830). Strengthen-only UNION across platform → org → team → agent: each scope may add entries; none may remove. The composer always emits this block; callers omit it to inherit the composed floor. See ADR-037 §protected_surface.",
-      "properties": {
-        "assets": {
-          "description": "Protected assets. Intrinsic identity = `${kind}:${selector}` (normalized). Composer merges by identity, keeping the strictest entry per scope.",
-          "items": {
-            "properties": {
-              "kind": {
-                "description": "Asset kind (e.g. `row`, `field`, `resource`, `table`).",
-                "type": "string"
-              },
-              "label": {
-                "description": "Human-facing display label (optional).",
-                "type": "string"
-              },
-              "reason": {
-                "description": "Why this asset is protected (optional).",
-                "type": "string"
-              },
-              "selector": {
-                "description": "Asset selector (e.g. `customer:critical-0000`, `replica_dsn`).",
-                "type": "string"
-              },
-              "source_scope": {
-                "description": "Composer-assigned provenance (`platform`, `org:<id>`, `team:<id>`, `agent:<id>`). Server-assigned — do not send on a PUT.",
-                "type": "string"
-              }
-            },
-            "required": [
-              "kind",
-              "selector"
-            ],
-            "type": "object"
-          },
-          "type": "array"
-        },
-        "escalation_required": {
-          "description": "Operations that require escalation before proceeding. Same intrinsic-identity + union rules as forbidden_operations (minus severity).",
-          "items": {
-            "properties": {
-              "applies_to": {
-                "description": "Asset identities this escalation applies to. Empty/absent = GLOBAL.",
-                "items": {
-                  "type": "string"
-                },
-                "type": "array"
-              },
-              "pattern": {
-                "description": "Operation pattern requiring escalation.",
-                "type": "string"
-              },
-              "reason": {
-                "description": "Why escalation is required (optional).",
-                "type": "string"
-              },
-              "source_scope": {
-                "description": "Composer-assigned provenance. Server-assigned — do not send on a PUT.",
-                "type": "string"
-              }
-            },
-            "required": [
-              "pattern"
-            ],
-            "type": "object"
-          },
-          "type": "array"
-        },
-        "forbidden_operations": {
-          "description": "Operations that are unconditionally forbidden. Intrinsic identity = normalized `pattern`. Composer unions across scopes; on identity collision, severity → max.",
-          "items": {
-            "properties": {
-              "applies_to": {
-                "description": "Asset identities (`${kind}:${selector}`) this operation applies to. Empty/absent means GLOBAL.",
-                "items": {
-                  "type": "string"
-                },
-                "type": "array"
-              },
-              "pattern": {
-                "description": "Operation pattern (e.g. `TRUNCATE`, `unscoped UPDATE/DELETE`, `exfiltrate:pii`).",
-                "type": "string"
-              },
-              "reason": {
-                "description": "Why this operation is forbidden (optional).",
-                "type": "string"
-              },
-              "severity": {
-                "description": "Severity level. Composer merges to strictest across scopes.",
-                "enum": [
-                  "low",
-                  "medium",
-                  "high",
-                  "critical"
-                ],
-                "type": "string"
-              },
-              "source_scope": {
-                "description": "Composer-assigned provenance. Server-assigned — do not send on a PUT.",
-                "type": "string"
-              }
-            },
-            "required": [
-              "pattern"
-            ],
-            "type": "object"
-          },
-          "type": "array"
-        }
-      },
-      "type": "object"
-    },
-    "review": {
-      "description": "Review-hold policy (Safe House Review, Slice 2a — MNE-920 design). gate_on is the minimum verdict band per surface that escalates to a review-hold. Composition is strictest-wins; on_timeout defaults to 'reject' (fail-closed). reviewer.kind 'endpoint' is designed for MNE-1650 and not consumed yet.",
-      "properties": {
-        "enabled": {
-          "type": "boolean"
-        },
-        "gate_on": {
-          "properties": {
-            "incoming": {
-              "enum": [
-                "off",
-                "warn",
-                "quarantine",
-                "block"
-              ],
-              "type": "string"
-            },
-            "integrity": {
-              "enum": [
-                "off",
-                "review_needed",
-                "boundary_violation"
-              ],
-              "type": "string"
-            },
-            "outgoing": {
-              "enum": [
-                "off",
-                "warn",
-                "quarantine",
-                "block"
-              ],
-              "type": "string"
-            },
-            "tool_calls": {
-              "enum": [
-                "off",
-                "warn",
-                "quarantine",
-                "block"
-              ],
-              "type": "string"
-            },
-            "tool_responses": {
-              "enum": [
-                "off",
-                "warn",
-                "quarantine",
-                "block"
-              ],
-              "type": "string"
-            }
-          },
-          "type": "object"
-        },
-        "notify": {
-          "properties": {
-            "sse": {
-              "type": "boolean"
-            },
-            "webhooks": {
-              "type": "boolean"
-            }
-          },
-          "type": "object"
-        },
-        "on_timeout": {
-          "enum": [
-            "reject",
-            "release"
-          ],
-          "type": "string"
-        },
-        "quarantine_notice": {
-          "maxLength": 2000,
-          "type": "string"
-        },
-        "reviewer": {
-          "properties": {
-            "endpoint_url": {
-              "format": "uri",
-              "type": "string"
-            },
-            "kind": {
-              "enum": [
-                "builtin_opus",
-                "endpoint"
-              ],
-              "type": "string"
-            }
-          },
-          "required": [
-            "kind"
-          ],
-          "type": "object"
-        },
-        "sla_seconds": {
-          "minimum": 1,
-          "type": "number"
-        }
-      },
-      "required": [
-        "enabled"
-      ],
-      "type": "object"
-    },
-    "screen_surfaces": {
-      "description": "Which request surfaces Safe House inspects. Composed across scopes by OR-per-field (any scope requiring inspection wins).",
-      "properties": {
-        "incoming": {
-          "description": "The user/principal prompt entering the agent.",
-          "type": "boolean"
-        },
-        "outgoing": {
-          "description": "The agent's response leaving the agent.",
-          "type": "boolean"
-        },
-        "tool_calls": {
-          "description": "Tool-use invocations the agent makes.",
-          "type": "boolean"
-        },
-        "tool_responses": {
-          "description": "Responses to tool calls returning to the agent.",
-          "type": "boolean"
-        }
-      },
-      "required": [
-        "incoming",
-        "outgoing",
-        "tool_calls",
-        "tool_responses"
-      ],
-      "type": "object"
-    },
-    "thresholds": {
-      "description": "Score bands. Must satisfy warn <= quarantine <= block; each value in [0, 1].",
-      "properties": {
-        "block": {
-          "maximum": 1,
-          "minimum": 0,
-          "type": "number"
-        },
-        "quarantine": {
-          "maximum": 1,
-          "minimum": 0,
-          "type": "number"
-        },
-        "warn": {
-          "maximum": 1,
-          "minimum": 0,
-          "type": "number"
-        }
-      },
-      "required": [
-        "warn",
-        "quarantine",
-        "block"
-      ],
-      "type": "object"
-    },
-    "trusted_sources": {
-      "description": "Sources for which detectors short-circuit (each match logged in the trace). Composed as platform->agent intersection (compliance ceiling) with org+agent union inside that ceiling — an agent cannot widen trust beyond what the platform allows.",
-      "properties": {
-        "agent_ids": {
-          "description": "Mnemom agent IDs (mnm-* / smolt-* prefixed).",
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "domains": {
-          "description": "DNS names or host:port entries.",
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "ip_ranges": {
-          "description": "IPv4 or IPv6 CIDR ranges.",
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        }
-      },
-      "required": [
-        "domains",
-        "agent_ids",
-        "ip_ranges"
-      ],
-      "type": "object"
-    },
-    "version": {
-      "description": "Response-only: monotonic card version, injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-      "type": "integer"
-    }
-  },
-  "required": [
-    "card_version",
-    "agent_id",
-    "mode",
-    "thresholds",
-    "screen_surfaces",
-    "trusted_sources"
-  ],
-  "type": "object"
-}

addedInput schema / properties / card_version

Added value: +{
+  "description": "Card schema version. REQUIRED by the server-side validator. Current canonical value: `protection/2026-04-26`.",
+  "maxLength": 40,
+  "minLength": 3,
+  "pattern": "^[A-Za-z0-9][A-Za-z0-9._/-]{1,38}[A-Za-z0-9]$",
+  "type": "string"
+}

addedInput schema / properties / mode

Added value: +{
+  "description": "Screening mode for the protection pipeline. Required. `off` disables screening; `observe` records only; `nudge` warns; `enforce` blocks.",
+  "enum": [
+    "off",
+    "observe",
+    "nudge",
+    "enforce"
+  ],
+  "type": "string"
+}

addedInput schema / properties / protected_surface

Added value: +{
+  "additionalProperties": false,
+  "description": "The assets and operations this agent must protect. Omit to accept the composed default (empty surface).",
+  "properties": {
+    "assets": {
+      "description": "The assets under protection.",
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "kind": {
+            "description": "Asset class — e.g. \"repo\", \"database\", \"bucket\".",
+            "maxLength": 64,
+            "minLength": 1,
+            "type": "string"
+          },
+          "label": {
+            "description": "Short human-readable name for the asset.",
+            "maxLength": 120,
+            "minLength": 1,
+            "type": "string"
+          },
+          "reason": {
+            "description": "Why it is protected, in one short sentence. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          },
+          "selector": {
+            "description": "Which instance — e.g. \"mnemom/mnemom-api\". A resource identifier only: no credentials, no connection strings, no personal data.",
+            "maxLength": 256,
+            "minLength": 1,
+            "type": "string"
+          }
+        },
+        "required": [
+          "kind",
+          "selector"
+        ],
+        "type": "object"
+      },
+      "maxItems": 64,
+      "type": "array"
+    },
+    "escalation_required": {
+      "description": "Operations that require human approval before the agent may proceed.",
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "applies_to": {
+            "description": "Asset identities this entry applies to. Omit to apply to every protected asset.",
+            "items": {
+              "maxLength": 256,
+              "minLength": 1,
+              "type": "string"
+            },
+            "maxItems": 64,
+            "type": "array"
+          },
+          "pattern": {
+            "description": "Operation matcher — e.g. \"force_push\", \"drop_table*\". A short pattern, not a description.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          },
+          "reason": {
+            "description": "Why this entry exists, in one short sentence. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          }
+        },
+        "required": [
+          "pattern"
+        ],
+        "type": "object"
+      },
+      "maxItems": 64,
+      "type": "array"
+    },
+    "forbidden_operations": {
+      "description": "Operations the agent must never perform on the protected assets.",
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "applies_to": {
+            "description": "Asset identities this entry applies to. Omit to apply to every protected asset.",
+            "items": {
+              "maxLength": 256,
+              "minLength": 1,
+              "type": "string"
+            },
+            "maxItems": 64,
+            "type": "array"
+          },
+          "pattern": {
+            "description": "Operation matcher — e.g. \"force_push\", \"drop_table*\". A short pattern, not a description.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          },
+          "reason": {
+            "description": "Why this entry exists, in one short sentence. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          },
+          "severity": {
+            "description": "How serious a violation of this entry is.",
+            "enum": [
+              "low",
+              "medium",
+              "high",
+              "critical"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "pattern"
+        ],
+        "type": "object"
+      },
+      "maxItems": 64,
+      "type": "array"
+    }
+  },
+  "type": "object"
+}

addedInput schema / properties / screen_surfaces

Added value: +{
+  "additionalProperties": false,
+  "description": "Which traffic surfaces are screened. Omit to accept the composed defaults.",
+  "properties": {
+    "incoming": {
+      "description": "Screen prompts arriving at the agent.",
+      "type": "boolean"
+    },
+    "outgoing": {
+      "description": "Screen the agent's outbound messages.",
+      "type": "boolean"
+    },
+    "tool_calls": {
+      "description": "Screen the tool calls the agent makes.",
+      "type": "boolean"
+    },
+    "tool_responses": {
+      "description": "Screen tool responses returned to the agent.",
+      "type": "boolean"
+    }
+  },
+  "type": "object"
+}

addedInput schema / properties / thresholds

Added value: +{
+  "additionalProperties": false,
+  "description": "Risk-score cutoffs, each in [0, 1] and ordered warn ≤ quarantine ≤ block. All three are required if this object is sent at all — omit the whole object to accept the composed defaults.",
+  "properties": {
+    "block": {
+      "description": "Score at or above which the request is refused.",
+      "maximum": 1,
+      "minimum": 0,
+      "type": "number"
+    },
+    "quarantine": {
+      "description": "Score at or above which the request is held for review.",
+      "maximum": 1,
+      "minimum": 0,
+      "type": "number"
+    },
+    "warn": {
+      "description": "Score at or above which the request is flagged.",
+      "maximum": 1,
+      "minimum": 0,
+      "type": "number"
+    }
+  },
+  "required": [
+    "warn",
+    "quarantine",
+    "block"
+  ],
+  "type": "object"
+}

addedInput schema / properties / trusted_sources

Added value: +{
+  "additionalProperties": false,
+  "description": "Sources exempt from screening. Enumerate specific hosts — wildcards are rejected, and a server-side deny-list (public LLM/DNS endpoints, 0.0.0.0/0, ::/0, link-local, multicast) is always applied.",
+  "properties": {
+    "agent_ids": {
+      "description": "Trusted Mnemom agent IDs. Must be in canonical `mnm-*` form.",
+      "items": {
+        "maxLength": 64,
+        "minLength": 8,
+        "pattern": "^mnm-[A-Za-z0-9-]{4,}$",
+        "type": "string"
+      },
+      "maxItems": 64,
+      "type": "array"
+    },
+    "domains": {
+      "description": "Trusted DNS names, optionally with `:port`. No wildcards.",
+      "items": {
+        "maxLength": 253,
+        "minLength": 3,
+        "type": "string"
+      },
+      "maxItems": 64,
+      "type": "array"
+    },
+    "ip_ranges": {
+      "description": "Trusted CIDR ranges (e.g. `10.0.0.0/8`).",
+      "items": {
+        "maxLength": 43,
+        "minLength": 4,
+        "type": "string"
+      },
+      "maxItems": 64,
+      "type": "array"
+    }
+  },
+  "type": "object"
+}

changedInput schema / required

Previous value: -[
-  "agent_id"
-]New value: +[
+  "agent_id",
+  "card_version",
+  "mode"
+]

removedOutput schema / $defs

Removed value: -{
-  "CompositionMetadata": {
-    "description": "System-managed block describing which scope sources merged into the canonical card. Only returned when `?include_composition=true`.",
-    "properties": {
-      "canonical_id": {
-        "type": "string"
-      },
-      "composed_at": {
-        "format": "date-time",
-        "type": "string"
-      },
-      "exemptions_applied": {
-        "items": {
-          "type": "string"
-        },
-        "type": "array"
-      },
-      "scopes_applied": {
-        "items": {
-          "properties": {
-            "card_id": {
-              "type": "string"
-            },
-            "scope": {
-              "description": "`platform`, `org:<id>`, or `agent:<id>`.",
-              "type": "string"
-            },
-            "template_version": {
-              "type": "integer"
-            },
-            "version": {
-              "type": "integer"
-            }
-          },
-          "type": "object"
-        },
-        "type": "array"
-      },
-      "source_card_id": {
-        "type": "string"
-      },
-      "source_policy_id": {
-        "type": "string"
-      }
-    },
-    "type": "object"
-  },
-  "UnifiedProtectionCard": {
-    "description": "Unified protection card (ADR-037). Safe House thresholds + trusted-source policy for a single agent. Shape matches src/composition/types.ts::UnifiedProtectionCard (canonical) and what the runtime validator at src/composition/validate.ts accepts. The customer-facing docs at /concepts/protection-card and /specifications/protection-card-schema document this same shape.",
-    "properties": {
-      "_composition": {
-        "$ref": "#/$defs/CompositionMetadata"
-      },
-      "agent_id": {
-        "type": "string"
-      },
-      "card_id": {
-        "type": "string"
-      },
-      "card_version": {
-        "type": "string"
-      },
-      "content_hash": {
-        "description": "Response-only: content hash of the composed card (`sha256:<hex>`), injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-        "type": "string"
-      },
-      "expires_at": {
-        "format": "date-time",
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "extensions": {
-        "additionalProperties": true,
-        "description": "Free-form extension slot for non-canonical fields. Ignored by the composer; preserved on read for tooling that needs an audit-tail metadata bag.",
-        "type": "object"
-      },
-      "issued_at": {
-        "format": "date-time",
-        "type": "string"
-      },
-      "mode": {
-        "description": "Strictest-wins composition: enforce > nudge > observe > off.",
-        "enum": [
-          "off",
-          "observe",
-          "nudge",
-          "enforce"
-        ],
-        "type": "string"
-      },
-      "protected_surface": {
-        "description": "Org-declared protected surface policy (MNE-830). Strengthen-only UNION across platform → org → team → agent: each scope may add entries; none may remove. The composer always emits this block; callers omit it to inherit the composed floor. See ADR-037 §protected_surface.",
-        "properties": {
-          "assets": {
-            "description": "Protected assets. Intrinsic identity = `${kind}:${selector}` (normalized). Composer merges by identity, keeping the strictest entry per scope.",
-            "items": {
-              "properties": {
-                "kind": {
-                  "description": "Asset kind (e.g. `row`, `field`, `resource`, `table`).",
-                  "type": "string"
-                },
-                "label": {
-                  "description": "Human-facing display label (optional).",
-                  "type": "string"
-                },
-                "reason": {
-                  "description": "Why this asset is protected (optional).",
-                  "type": "string"
-                },
-                "selector": {
-                  "description": "Asset selector (e.g. `customer:critical-0000`, `replica_dsn`).",
-                  "type": "string"
-                },
-                "source_scope": {
-                  "description": "Composer-assigned provenance (`platform`, `org:<id>`, `team:<id>`, `agent:<id>`). Server-assigned — do not send on a PUT.",
-                  "type": "string"
-                }
-              },
-              "required": [
-                "kind",
-                "selector"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "escalation_required": {
-            "description": "Operations that require escalation before proceeding. Same intrinsic-identity + union rules as forbidden_operations (minus severity).",
-            "items": {
-              "properties": {
-                "applies_to": {
-                  "description": "Asset identities this escalation applies to. Empty/absent = GLOBAL.",
-                  "items": {
-                    "type": "string"
-                  },
-                  "type": "array"
-                },
-                "pattern": {
-                  "description": "Operation pattern requiring escalation.",
-                  "type": "string"
-                },
-                "reason": {
-                  "description": "Why escalation is required (optional).",
-                  "type": "string"
-                },
-                "source_scope": {
-                  "description": "Composer-assigned provenance. Server-assigned — do not send on a PUT.",
-                  "type": "string"
-                }
-              },
-              "required": [
-                "pattern"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "forbidden_operations": {
-            "description": "Operations that are unconditionally forbidden. Intrinsic identity = normalized `pattern`. Composer unions across scopes; on identity collision, severity → max.",
-            "items": {
-              "properties": {
-                "applies_to": {
-                  "description": "Asset identities (`${kind}:${selector}`) this operation applies to. Empty/absent means GLOBAL.",
-                  "items": {
-                    "type": "string"
-                  },
-                  "type": "array"
-                },
-                "pattern": {
-                  "description": "Operation pattern (e.g. `TRUNCATE`, `unscoped UPDATE/DELETE`, `exfiltrate:pii`).",
-                  "type": "string"
-                },
-                "reason": {
-                  "description": "Why this operation is forbidden (optional).",
-                  "type": "string"
-                },
-                "severity": {
-                  "description": "Severity level. Composer merges to strictest across scopes.",
-                  "enum": [
-                    "low",
-                    "medium",
-                    "high",
-                    "critical"
-                  ],
-                  "type": "string"
-                },
-                "source_scope": {
-                  "description": "Composer-assigned provenance. Server-assigned — do not send on a PUT.",
-                  "type": "string"
-                }
-              },
-              "required": [
-                "pattern"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          }
-        },
-        "type": "object"
-      },
-      "review": {
-        "description": "Review-hold policy (Safe House Review, Slice 2a — MNE-920 design). gate_on is the minimum verdict band per surface that escalates to a review-hold. Composition is strictest-wins; on_timeout defaults to 'reject' (fail-closed). reviewer.kind 'endpoint' is designed for MNE-1650 and not consumed yet.",
-        "properties": {
-          "enabled": {
-            "type": "boolean"
-          },
-          "gate_on": {
-            "properties": {
-              "incoming": {
-                "enum": [
-                  "off",
-                  "warn",
-                  "quarantine",
-                  "block"
-                ],
-                "type": "string"
-              },
-              "integrity": {
-                "enum": [
-                  "off",
-                  "review_needed",
-                  "boundary_violation"
-                ],
-                "type": "string"
-              },
-              "outgoing": {
-                "enum": [
-                  "off",
-                  "warn",
-                  "quarantine",
-                  "block"
-                ],
-                "type": "string"
-              },
-              "tool_calls": {
-                "enum": [
-                  "off",
-                  "warn",
-                  "quarantine",
-                  "block"
-                ],
-                "type": "string"
-              },
-              "tool_responses": {
-                "enum": [
-                  "off",
-                  "warn",
-                  "quarantine",
-                  "block"
-                ],
-                "type": "string"
-              }
-            },
-            "type": "object"
-          },
-          "notify": {
-            "properties": {
-              "sse": {
-                "type": "boolean"
-              },
-              "webhooks": {
-                "type": "boolean"
-              }
-            },
-            "type": "object"
-          },
-          "on_timeout": {
-            "enum": [
-              "reject",
-              "release"
-            ],
-            "type": "string"
-          },
-          "quarantine_notice": {
-            "maxLength": 2000,
-            "type": "string"
-          },
-          "reviewer": {
-            "properties": {
-              "endpoint_url": {
-                "format": "uri",
-                "type": "string"
-              },
-              "kind": {
-                "enum": [
-                  "builtin_opus",
-                  "endpoint"
-                ],
-                "type": "string"
-              }
-            },
-            "required": [
-              "kind"
-            ],
-            "type": "object"
-          },
-          "sla_seconds": {
-            "minimum": 1,
-            "type": "number"
-          }
-        },
-        "required": [
-          "enabled"
-        ],
-        "type": "object"
-      },
-      "screen_surfaces": {
-        "description": "Which request surfaces Safe House inspects. Composed across scopes by OR-per-field (any scope requiring inspection wins).",
-        "properties": {
-          "incoming": {
-            "description": "The user/principal prompt entering the agent.",
-            "type": "boolean"
-          },
-          "outgoing": {
-            "description": "The agent's response leaving the agent.",
-            "type": "boolean"
-          },
-          "tool_calls": {
-            "description": "Tool-use invocations the agent makes.",
-            "type": "boolean"
-          },
-          "tool_responses": {
-            "description": "Responses to tool calls returning to the agent.",
-            "type": "boolean"
-          }
-        },
-        "required": [
-          "incoming",
-          "outgoing",
-          "tool_calls",
-          "tool_responses"
-        ],
-        "type": "object"
-      },
-      "thresholds": {
-        "description": "Score bands. Must satisfy warn <= quarantine <= block; each value in [0, 1].",
-        "properties": {
-          "block": {
-            "maximum": 1,
-            "minimum": 0,
-            "type": "number"
-          },
-          "quarantine": {
-            "maximum": 1,
-            "minimum": 0,
-            "type": "number"
-          },
-          "warn": {
-            "maximum": 1,
-            "minimum": 0,
-            "type": "number"
-          }
-        },
-        "required": [
-          "warn",
-          "quarantine",
-          "block"
-        ],
-        "type": "object"
-      },
-      "trusted_sources": {
-        "description": "Sources for which detectors short-circuit (each match logged in the trace). Composed as platform->agent intersection (compliance ceiling) with org+agent union inside that ceiling — an agent cannot widen trust beyond what the platform allows.",
-        "properties": {
-          "agent_ids": {
-            "description": "Mnemom agent IDs (mnm-* / smolt-* prefixed).",
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "domains": {
-            "description": "DNS names or host:port entries.",
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "ip_ranges": {
-            "description": "IPv4 or IPv6 CIDR ranges.",
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          }
-        },
-        "required": [
-          "domains",
-          "agent_ids",
-          "ip_ranges"
-        ],
-        "type": "object"
-      },
-      "version": {
-        "description": "Response-only: monotonic card version, injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-        "type": "integer"
-      }
-    },
-    "required": [
-      "card_version",
-      "agent_id",
-      "mode",
-      "thresholds",
-      "screen_surfaces",
-      "trusted_sources"
-    ],
-    "type": "object"
-  }
-}

addedOutput schema / additionalProperties
```
Added value: +false
```

removedOutput schema / description

Removed value: -"Unified protection card (ADR-037). Safe House thresholds + trusted-source policy for a single agent. Shape matches src/composition/types.ts::UnifiedProtectionCard (canonical) and what the runtime validator at src/composition/validate.ts accepts. The customer-facing docs at /concepts/protection-card and /specifications/protection-card-schema document this same shape."

removedOutput schema / properties / _composition

Removed value: -{
-  "$ref": "#/$defs/CompositionMetadata"
-}

removedOutput schema / properties / agent_id
```
Removed value: -{
-  "type": "string"
-}
```

addedOutput schema / properties / card_id / description

Added value: +"Card ID (pc-{uuid}) of the stored protection card."

addedOutput schema / properties / card_id / pattern

Added value: +"^pc-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"

removedOutput schema / properties / card_version
```
Removed value: -{
-  "type": "string"
-}
```

removedOutput schema / properties / content_hash

Removed value: -{
-  "description": "Response-only: content hash of the composed card (`sha256:<hex>`), injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-  "type": "string"
-}

removedOutput schema / properties / expires_at

Removed value: -{
-  "format": "date-time",
-  "type": [
-    "string",
-    "null"
-  ]
-}

removedOutput schema / properties / extensions

Removed value: -{
-  "additionalProperties": true,
-  "description": "Free-form extension slot for non-canonical fields. Ignored by the composer; preserved on read for tooling that needs an audit-tail metadata bag.",
-  "type": "object"
-}

addedOutput schema / properties / issued_at / description

Added value: +"ISO 8601 timestamp when the card was issued/stored."

removedOutput schema / properties / mode

Removed value: -{
-  "description": "Strictest-wins composition: enforce > nudge > observe > off.",
-  "enum": [
-    "off",
-    "observe",
-    "nudge",
-    "enforce"
-  ],
-  "type": "string"
-}

addedOutput schema / properties / ok

Added value: +{
+  "const": true,
+  "description": "Always true on successful storage (errors return non-200 status).",
+  "type": "boolean"
+}

removedOutput schema / properties / protected_surface

Removed value: -{
-  "description": "Org-declared protected surface policy (MNE-830). Strengthen-only UNION across platform → org → team → agent: each scope may add entries; none may remove. The composer always emits this block; callers omit it to inherit the composed floor. See ADR-037 §protected_surface.",
-  "properties": {
-    "assets": {
-      "description": "Protected assets. Intrinsic identity = `${kind}:${selector}` (normalized). Composer merges by identity, keeping the strictest entry per scope.",
-      "items": {
-        "properties": {
-          "kind": {
-            "description": "Asset kind (e.g. `row`, `field`, `resource`, `table`).",
-            "type": "string"
-          },
-          "label": {
-            "description": "Human-facing display label (optional).",
-            "type": "string"
-          },
-          "reason": {
-            "description": "Why this asset is protected (optional).",
-            "type": "string"
-          },
-          "selector": {
-            "description": "Asset selector (e.g. `customer:critical-0000`, `replica_dsn`).",
-            "type": "string"
-          },
-          "source_scope": {
-            "description": "Composer-assigned provenance (`platform`, `org:<id>`, `team:<id>`, `agent:<id>`). Server-assigned — do not send on a PUT.",
-            "type": "string"
-          }
-        },
-        "required": [
-          "kind",
-          "selector"
-        ],
-        "type": "object"
-      },
-      "type": "array"
-    },
-    "escalation_required": {
-      "description": "Operations that require escalation before proceeding. Same intrinsic-identity + union rules as forbidden_operations (minus severity).",
-      "items": {
-        "properties": {
-          "applies_to": {
-            "description": "Asset identities this escalation applies to. Empty/absent = GLOBAL.",
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "pattern": {
-            "description": "Operation pattern requiring escalation.",
-            "type": "string"
-          },
-          "reason": {
-            "description": "Why escalation is required (optional).",
-            "type": "string"
-          },
-          "source_scope": {
-            "description": "Composer-assigned provenance. Server-assigned — do not send on a PUT.",
-            "type": "string"
-          }
-        },
-        "required": [
-          "pattern"
-        ],
-        "type": "object"
-      },
-      "type": "array"
-    },
-    "forbidden_operations": {
-      "description": "Operations that are unconditionally forbidden. Intrinsic identity = normalized `pattern`. Composer unions across scopes; on identity collision, severity → max.",
-      "items": {
-        "properties": {
-          "applies_to": {
-            "description": "Asset identities (`${kind}:${selector}`) this operation applies to. Empty/absent means GLOBAL.",
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "pattern": {
-            "description": "Operation pattern (e.g. `TRUNCATE`, `unscoped UPDATE/DELETE`, `exfiltrate:pii`).",
-            "type": "string"
-          },
-          "reason": {
-            "description": "Why this operation is forbidden (optional).",
-            "type": "string"
-          },
-          "severity": {
-            "description": "Severity level. Composer merges to strictest across scopes.",
-            "enum": [
-              "low",
-              "medium",
-              "high",
-              "critical"
-            ],
-            "type": "string"
-          },
-          "source_scope": {
-            "description": "Composer-assigned provenance. Server-assigned — do not send on a PUT.",
-            "type": "string"
-          }
-        },
-        "required": [
-          "pattern"
-        ],
-        "type": "object"
-      },
-      "type": "array"
-    }
-  },
-  "type": "object"
-}

removedOutput schema / properties / review

Removed value: -{
-  "description": "Review-hold policy (Safe House Review, Slice 2a — MNE-920 design). gate_on is the minimum verdict band per surface that escalates to a review-hold. Composition is strictest-wins; on_timeout defaults to 'reject' (fail-closed). reviewer.kind 'endpoint' is designed for MNE-1650 and not consumed yet.",
-  "properties": {
-    "enabled": {
-      "type": "boolean"
-    },
-    "gate_on": {
-      "properties": {
-        "incoming": {
-          "enum": [
-            "off",
-            "warn",
-            "quarantine",
-            "block"
-          ],
-          "type": "string"
-        },
-        "integrity": {
-          "enum": [
-            "off",
-            "review_needed",
-            "boundary_violation"
-          ],
-          "type": "string"
-        },
-        "outgoing": {
-          "enum": [
-            "off",
-            "warn",
-            "quarantine",
-            "block"
-          ],
-          "type": "string"
-        },
-        "tool_calls": {
-          "enum": [
-            "off",
-            "warn",
-            "quarantine",
-            "block"
-          ],
-          "type": "string"
-        },
-        "tool_responses": {
-          "enum": [
-            "off",
-            "warn",
-            "quarantine",
-            "block"
-          ],
-          "type": "string"
-        }
-      },
-      "type": "object"
-    },
-    "notify": {
-      "properties": {
-        "sse": {
-          "type": "boolean"
-        },
-        "webhooks": {
-          "type": "boolean"
-        }
-      },
-      "type": "object"
-    },
-    "on_timeout": {
-      "enum": [
-        "reject",
-        "release"
-      ],
-      "type": "string"
-    },
-    "quarantine_notice": {
-      "maxLength": 2000,
-      "type": "string"
-    },
-    "reviewer": {
-      "properties": {
-        "endpoint_url": {
-          "format": "uri",
-          "type": "string"
-        },
-        "kind": {
-          "enum": [
-            "builtin_opus",
-            "endpoint"
-          ],
-          "type": "string"
-        }
-      },
-      "required": [
-        "kind"
-      ],
-      "type": "object"
-    },
-    "sla_seconds": {
-      "minimum": 1,
-      "type": "number"
-    }
-  },
-  "required": [
-    "enabled"
-  ],
-  "type": "object"
-}

removedOutput schema / properties / screen_surfaces

Removed value: -{
-  "description": "Which request surfaces Safe House inspects. Composed across scopes by OR-per-field (any scope requiring inspection wins).",
-  "properties": {
-    "incoming": {
-      "description": "The user/principal prompt entering the agent.",
-      "type": "boolean"
-    },
-    "outgoing": {
-      "description": "The agent's response leaving the agent.",
-      "type": "boolean"
-    },
-    "tool_calls": {
-      "description": "Tool-use invocations the agent makes.",
-      "type": "boolean"
-    },
-    "tool_responses": {
-      "description": "Responses to tool calls returning to the agent.",
-      "type": "boolean"
-    }
-  },
-  "required": [
-    "incoming",
-    "outgoing",
-    "tool_calls",
-    "tool_responses"
-  ],
-  "type": "object"
-}

removedOutput schema / properties / thresholds

Removed value: -{
-  "description": "Score bands. Must satisfy warn <= quarantine <= block; each value in [0, 1].",
-  "properties": {
-    "block": {
-      "maximum": 1,
-      "minimum": 0,
-      "type": "number"
-    },
-    "quarantine": {
-      "maximum": 1,
-      "minimum": 0,
-      "type": "number"
-    },
-    "warn": {
-      "maximum": 1,
-      "minimum": 0,
-      "type": "number"
-    }
-  },
-  "required": [
-    "warn",
-    "quarantine",
-    "block"
-  ],
-  "type": "object"
-}

removedOutput schema / properties / trusted_sources

Removed value: -{
-  "description": "Sources for which detectors short-circuit (each match logged in the trace). Composed as platform->agent intersection (compliance ceiling) with org+agent union inside that ceiling — an agent cannot widen trust beyond what the platform allows.",
-  "properties": {
-    "agent_ids": {
-      "description": "Mnemom agent IDs (mnm-* / smolt-* prefixed).",
-      "items": {
-        "type": "string"
-      },
-      "type": "array"
-    },
-    "domains": {
-      "description": "DNS names or host:port entries.",
-      "items": {
-        "type": "string"
-      },
-      "type": "array"
-    },
-    "ip_ranges": {
-      "description": "IPv4 or IPv6 CIDR ranges.",
-      "items": {
-        "type": "string"
-      },
-      "type": "array"
-    }
-  },
-  "required": [
-    "domains",
-    "agent_ids",
-    "ip_ranges"
-  ],
-  "type": "object"
-}

removedOutput schema / properties / version

Removed value: -{
-  "description": "Response-only: monotonic card version, injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-  "type": "integer"
-}

changedOutput schema / required

Previous value: -[
-  "card_version",
-  "agent_id",
-  "mode",
-  "thresholds",
-  "screen_surfaces",
-  "trusted_sources"
-]New value: +[
+  "card_id",
+  "issued_at",
+  "ok"
+]

Changed4 schema fields changedJul 10, 2026

addedInput schema / $defs / UnifiedProtectionCard / properties / review

Added value: +{
+  "description": "Review-hold policy (Safe House Review, Slice 2a — MNE-920 design). gate_on is the minimum verdict band per surface that escalates to a review-hold. Composition is strictest-wins; on_timeout defaults to 'reject' (fail-closed). reviewer.kind 'endpoint' is designed for MNE-1650 and not consumed yet.",
+  "properties": {
+    "enabled": {
+      "type": "boolean"
+    },
+    "gate_on": {
+      "properties": {
+        "incoming": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "integrity": {
+          "enum": [
+            "off",
+            "review_needed",
+            "boundary_violation"
+          ],
+          "type": "string"
+        },
+        "outgoing": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "tool_calls": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "tool_responses": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "notify": {
+      "properties": {
+        "sse": {
+          "type": "boolean"
+        },
+        "webhooks": {
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "on_timeout": {
+      "enum": [
+        "reject",
+        "release"
+      ],
+      "type": "string"
+    },
+    "quarantine_notice": {
+      "maxLength": 2000,
+      "type": "string"
+    },
+    "reviewer": {
+      "properties": {
+        "endpoint_url": {
+          "format": "uri",
+          "type": "string"
+        },
+        "kind": {
+          "enum": [
+            "builtin_opus",
+            "endpoint"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "kind"
+      ],
+      "type": "object"
+    },
+    "sla_seconds": {
+      "minimum": 1,
+      "type": "number"
+    }
+  },
+  "required": [
+    "enabled"
+  ],
+  "type": "object"
+}

addedInput schema / properties / body / properties / review

Added value: +{
+  "description": "Review-hold policy (Safe House Review, Slice 2a — MNE-920 design). gate_on is the minimum verdict band per surface that escalates to a review-hold. Composition is strictest-wins; on_timeout defaults to 'reject' (fail-closed). reviewer.kind 'endpoint' is designed for MNE-1650 and not consumed yet.",
+  "properties": {
+    "enabled": {
+      "type": "boolean"
+    },
+    "gate_on": {
+      "properties": {
+        "incoming": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "integrity": {
+          "enum": [
+            "off",
+            "review_needed",
+            "boundary_violation"
+          ],
+          "type": "string"
+        },
+        "outgoing": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "tool_calls": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "tool_responses": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "notify": {
+      "properties": {
+        "sse": {
+          "type": "boolean"
+        },
+        "webhooks": {
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "on_timeout": {
+      "enum": [
+        "reject",
+        "release"
+      ],
+      "type": "string"
+    },
+    "quarantine_notice": {
+      "maxLength": 2000,
+      "type": "string"
+    },
+    "reviewer": {
+      "properties": {
+        "endpoint_url": {
+          "format": "uri",
+          "type": "string"
+        },
+        "kind": {
+          "enum": [
+            "builtin_opus",
+            "endpoint"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "kind"
+      ],
+      "type": "object"
+    },
+    "sla_seconds": {
+      "minimum": 1,
+      "type": "number"
+    }
+  },
+  "required": [
+    "enabled"
+  ],
+  "type": "object"
+}

addedOutput schema / $defs / UnifiedProtectionCard / properties / review

Added value: +{
+  "description": "Review-hold policy (Safe House Review, Slice 2a — MNE-920 design). gate_on is the minimum verdict band per surface that escalates to a review-hold. Composition is strictest-wins; on_timeout defaults to 'reject' (fail-closed). reviewer.kind 'endpoint' is designed for MNE-1650 and not consumed yet.",
+  "properties": {
+    "enabled": {
+      "type": "boolean"
+    },
+    "gate_on": {
+      "properties": {
+        "incoming": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "integrity": {
+          "enum": [
+            "off",
+            "review_needed",
+            "boundary_violation"
+          ],
+          "type": "string"
+        },
+        "outgoing": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "tool_calls": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "tool_responses": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "notify": {
+      "properties": {
+        "sse": {
+          "type": "boolean"
+        },
+        "webhooks": {
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "on_timeout": {
+      "enum": [
+        "reject",
+        "release"
+      ],
+      "type": "string"
+    },
+    "quarantine_notice": {
+      "maxLength": 2000,
+      "type": "string"
+    },
+    "reviewer": {
+      "properties": {
+        "endpoint_url": {
+          "format": "uri",
+          "type": "string"
+        },
+        "kind": {
+          "enum": [
+            "builtin_opus",
+            "endpoint"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "kind"
+      ],
+      "type": "object"
+    },
+    "sla_seconds": {
+      "minimum": 1,
+      "type": "number"
+    }
+  },
+  "required": [
+    "enabled"
+  ],
+  "type": "object"
+}

addedOutput schema / properties / review

Added value: +{
+  "description": "Review-hold policy (Safe House Review, Slice 2a — MNE-920 design). gate_on is the minimum verdict band per surface that escalates to a review-hold. Composition is strictest-wins; on_timeout defaults to 'reject' (fail-closed). reviewer.kind 'endpoint' is designed for MNE-1650 and not consumed yet.",
+  "properties": {
+    "enabled": {
+      "type": "boolean"
+    },
+    "gate_on": {
+      "properties": {
+        "incoming": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "integrity": {
+          "enum": [
+            "off",
+            "review_needed",
+            "boundary_violation"
+          ],
+          "type": "string"
+        },
+        "outgoing": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "tool_calls": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "tool_responses": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "notify": {
+      "properties": {
+        "sse": {
+          "type": "boolean"
+        },
+        "webhooks": {
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "on_timeout": {
+      "enum": [
+        "reject",
+        "release"
+      ],
+      "type": "string"
+    },
+    "quarantine_notice": {
+      "maxLength": 2000,
+      "type": "string"
+    },
+    "reviewer": {
+      "properties": {
+        "endpoint_url": {
+          "format": "uri",
+          "type": "string"
+        },
+        "kind": {
+          "enum": [
+            "builtin_opus",
+            "endpoint"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "kind"
+      ],
+      "type": "object"
+    },
+    "sla_seconds": {
+      "minimum": 1,
+      "type": "number"
+    }
+  },
+  "required": [
+    "enabled"
+  ],
+  "type": "object"
+}

AddedJun 23, 2026

TDQS

A3.9/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds meaningful behavioral context beyond annotations: it specifies accepted input formats (YAML/JSON), requires the full UnifiedProtectionCard, explains the server-side merge across platform→org→team→agent cascade, and mentions the Idempotency-Key requirement. This complements the annotations (destructiveHint, idempotentHint) without contradicting them, though the truncated ending leaves some details unstated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single dense sentence that front-loads the core action ('Publish or replace') and then efficiently packs key details: formats, body requirement, composition behavior, and idempotency requirement. It is appropriately concise for the complexity, though the truncated 'Hon...' leaves an incomplete thought and the sentence is slightly overloaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the high complexity (7 parameters, nested objects, output schema), the description covers essential aspects: purpose, input format, body structure, composition semantics, and idempotency requirement. The output schema handles return-value documentation. Missing details like error cases or permission requirements are not expected at this level, but a bit more explicit guidance on usage vs alternatives would strengthen it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds high-level context (body is the full card, composed server-side), but does not detail individual parameters beyond what the schema already provides. It adequately reinforces the 'full card' notion but does not deeply enhance parameter-level understanding.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb+resource pair ('Publish or replace the protection manifest') and clearly distinguishes itself from sibling tools like preview_compose_protection_by_agent (which previews instead of writing) and put_alignment_by_agent (which handles alignment, not protection). It also explains the composition cascade, making the tool's responsibility unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use it: it is the write path for protection cards, as opposed to preview_* siblings. However, it does not explicitly state 'use this instead of preview' or list any exclusions or alternative conditions. The guidance is inferred from tool names and the description's wording, not explicitly stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Mnemom — Trust Ratings for AI Agents tools Inspect

Try in Browser

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.1/5.0

Disambiguation5/5

Each tool targets a distinct operation: identity claiming, lookup, reputation retrieval/badge, scanning, verification, alignment/protection management, and feedback. No significant overlap exists.

Naming Consistency5/5

All tools follow a consistent verb_noun pattern using snake_case (e.g., claim_agent, get_reputation, verify_scan). Even complex names like preview_compose_alignment_by_agent adhere to the pattern.

Tool Count4/5

With 16 tools, the set is slightly heavy but still well-scoped for the domain of AI agent trust ratings. Each tool serves a clear purpose, and no tool feels redundant.

Completeness4/5

The surface covers core workflows: agent identity, reputation, alignment/protection, scanning, verification, and feedback. Minor gaps like agent updates or deletion might exist, but the core lifecycle is complete.

put_protection_by_agent

Input Schema

Output Schema

Schema Changelog

TDQS

Glama MCP Gateway

TDQS

Resources