DCL Trust Oracle
The DCL Trust Oracle is a cryptographically secured AI audit layer that evaluates LLM outputs for policy compliance, safety, quality, and data leakage, storing only metadata in a tamper-evident chain. Services are metered via x402 micropayments (USDC on Base).
Capabilities
Pre-Action Evaluation:
dcl_evaluate_fast($0.01): Quick policy check.dcl_evaluate_strict($0.05): Deep analysis with higher confidence.dcl_evaluate_jailbreak($0.02): Detects prompt injection and role-hijacking.dcl_evaluate_safety($0.01): Baseline screening for harmful patterns.dcl_evaluate_quality($0.03): Content quality and drift check.dcl_evaluate_batch($0.10): Bulk evaluation of up to 20 items.
Post-Action Detection:
dcl_evaluate_secrets($0.02): Scans for credentials (API keys, JWTs, private keys, DB URLs, etc.).dcl_evaluate_pii($0.02): Detects personal data (emails, phone numbers, credit cards, IPs, passport numbers, etc.) with Luhn validation.
Session Management:
dcl_pipeline_start($0.05): Start a long-running audit session for continuous drift tracking (modes: NORMAL, WARNING, ESCALATION, BLOCK).
Audit & Forensics:
dcl_audit_decode($0.10): Retrieve basic audit record by transaction hash.dcl_audit_decode_deep($0.50): Deep forensic audit with chain integrity and drift context.
Integration: Available as an MCP server and an HTTP REST API for flexible AI agent integration.
Policy Customization: Use built-in policies or define custom policies inline.
Free Utilities: Non-metered endpoints for service health, policy listing, and audit chain status/export.
Tamper-Evident Storage: Raw content is never stored; only SHA-256 hashes and metadata are recorded in an SQLite-backed chain, ensuring verifiable integrity.
DCL Trust Oracle
Don't trust the agent. Trust the proof.
Autonomous AI agents now take actions with real consequences — financial, legal, reputational. Most of them are black boxes: no record of what was decided, why, or whether that decision was tampered with afterward.
DCL Trust Oracle closes that gap. Every agent output is evaluated against policy in real time and sealed into a tamper-evident hash chain — a deterministic, cryptographically verifiable record of what happened and when. Edit any past entry and the entire chain invalidates. No one — not even Fronesis Labs — has to be trusted for the record to hold up.
What It Does
DCL Trust Oracle provides deterministic policy evaluation for LLM outputs with a tamper-evident audit chain. The system stores only cryptographic hashes and decision metadata — never raw content — enabling verifiable, post-action forensic analysis across distributed AI agents.
Available two ways:
REST API (
webhook_server.py) — direct HTTP integration.MCP Server (
mcp_server.py) — native Model Context Protocol integration for AI agents. Live athttps://mcp.fronesislabs.com/mcp(streamable-http). Also listed on Smithery (remote URL → same production endpoint; seesmithery.yaml) and the official MCP Registry.
Both servers share the same evaluation logic and tamper-evident chain
(dcl_core.py), and are priced identically.
Related MCP server: Mcp-Omega-Brain
Quick Start
REST API
pip install -r requirements.txt
python webhook_server.pyServer runs on http://localhost:8080
MCP Server
Production (hosted):
https://mcp.fronesislabs.com/mcpStreamable HTTP transport — point any MCP client here directly, no setup required.
Local development:
pip install -r requirements.txt
python mcp_server.pyServer runs on http://localhost:8081 (streamable-http transport)
Tools & Endpoints
Pre-Action Evaluation
Catch a bad output before it reaches a user, a wallet, or downstream system.
REST Endpoint | MCP Tool | Price | Description |
|
| $0.01 | Fast policy check for low-risk outputs. Returns tamper-evident |
|
| $0.05 | Deep analysis for high-stakes outputs with higher confidence thresholds. |
|
| $0.02 | Instruction adherence check — detects prompt injection patterns and role-hijacking attempts. |
|
| $0.01 | Baseline screening for known harmful text patterns. Optimized for high throughput. |
|
| $0.03 | Content quality & drift check — evaluates format adherence and contextual drift. |
|
| $0.10 | Bulk processing — up to 200 items per MCP call (REST default |
Session Management
REST Endpoint | MCP Tool | Price | Description |
|
| $0.05 | Initializes a long-running audit session for continuous drift tracking. Returns |
Post-Action Forensics
When something did go wrong, reconstruct exactly what happened.
REST Endpoint | MCP Tool | Price | Description |
|
| $0.10 | Basic post-action audit — returns verdict, confidence, agent_id, reason by |
|
| $0.50 | Deep forensic audit — includes drift context, tamper-evidence indices, environmental metadata. |
Post-Action Scans
REST Endpoint | MCP Tool | Price | Description |
|
| $0.02 | Secret & credential leak scan. |
|
| $0.02 | PII detection scan. |
Crypto & Trading Compliance (MCP only)
These tools are exposed on the live MCP server only (no REST routes in webhook_server.py).
MCP Tool | Price | Description |
| $0.02 | Crypto-specific jailbreak & injection detection. |
| $0.02 | Wallet secret guardian. |
| $0.02 | Trade decision verifier. |
| $0.03 | MEV & market-abuse compliance screen. |
| $0.03 | Market signal fabrication screen. |
| $0.02 | Output sanitizer — final gate. |
| $0.01 | Leibniz Layer crypto commit — seal a decision to the audit chain. |
Utility (free, REST only)
Endpoint | Description |
| Service status and chain length |
| List of built-in policy names |
| Chain integrity, drift mode, drift score |
| Full chain export with integrity verification |
Example Response
{
"verdict": "COMMIT",
"confidence": 0.95,
"reason": "All policy checks passed",
"tx_hash": "0x7a8f3b2c...",
"chain_index": 42,
"input_hash": "0x9d4e1f...",
"policy_version": "1.0.0",
"timestamp": 1721635200.123,
"pipeline_id": "abc123",
"drift_mode": "NORMAL",
"drift_score": 0.15
}Verifying the Chain Yourself
You don't have to take the server's word for it. tx_hash is recomputed
from the record's own fields, not just linked to the previous row — so
anyone can independently confirm a record wasn't edited after the fact,
without calling back into this server. See
@fronesis-labs/dcl-sdk (TS/JS)
or dcl-core (Python) for the
free, offline verification libraries.
Metering & Settlement
Every paid call above is metered and settled automatically per request, via
the x402 protocol (USDC on Base) —
no subscription, no API-key provisioning, no invoicing overhead. This is
what makes per-call pricing practical at agent scale (an autonomous system
can make thousands of evaluation calls a day). The REST API is x402-gated
via fastapi-x402; the MCP server via paymcp in Mode.X402, which pays
automatically for x402-aware clients and falls back to a guided payment
link for clients without a wallet configured. Both settle to the same
wallet, and neither has a bypass path — an unpaid call simply gets no
verdict.
License
Apache License 2.0 — see LICENSE.
Available Tools
18 toolsdcl_audit_decodeBasic Audit DecodeARead-onlyIdempotentInspect
POST-ACTION Basic Audit ($0.10). Retrieves a record from the tamper-evident chain by tx_hash.
| Name | Required | Description | Default |
|---|---|---|---|
| tx_hash | Yes | Transaction hash of the audit chain record to retrieve. | |
| payment_id | No | Optional payment identifier returned by a previous call when payment is required |
Output Schema
| Name | Required | Description |
|---|---|---|
| error | No | Set if tx_hash was not found; other fields are omitted. |
| reason | No | Explanation recorded for the verdict. |
| tx_hash | No | Hash of the audit chain record. |
| verdict | No | COMMIT or NO_COMMIT. |
| agent_id | No | Identifier of the agent tied to this record. |
| prev_hash | No | Hash of the preceding record in the chain. |
| seal_text | No | Human-readable Leibniz Layer verification seal. |
| task_type | No | Task type tag recorded with this entry. |
| timestamp | No | Unix timestamp when the record was created. |
| confidence | No | Confidence score recorded for the verdict. |
| verify_url | No | Public URL to independently verify this seal. |
| chain_index | No | Sequential index of the record in the chain. |
| chain_integrity | No | True if the full chain verifies as intact. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds helpful behavioral context beyond annotations, including a cost of $0.10 and the tamper-evident nature of the chain. It aligns with the readOnlyHint and idempotentHint annotations, reinforcing that this is a safe, read-only operation. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that conveys the tool's purpose, cost, and key identifier with no unnecessary words. It is highly concise and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple lookup tool with comprehensive annotations, full schema coverage, and an output schema, the description is adequate. It lacks explicit notes on error handling or payment_id usage, but these are covered by the schema and contextual signals, making the overall package reasonably complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already provides complete descriptions for both tx_hash and payment_id, achieving 100% coverage. The description adds no additional parameter detail, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action (retrieves a record) and a specific resource (tamper-evident chain) keyed by tx_hash. The 'Basic' label implicitly distinguishes it from the 'deep' sibling tool, making the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not explicitly state when to use this tool versus dcl_audit_decode_deep. The term 'Basic' implies a simpler audit, but no clear when/when-not guidance or alternative is provided. The schema's payment_id hint gives minor workflow context, but the description itself lacks usage direction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dcl_audit_decode_deepDeep Forensic Audit DecodeBRead-onlyIdempotentInspect
POST-ACTION Deep Forensic Audit ($0.50). Extended output with drift_context and full chain integrity verification.
| Name | Required | Description | Default |
|---|---|---|---|
| tx_hash | Yes | Transaction hash of the audit chain record to retrieve. | |
| payment_id | No | Optional payment identifier returned by a previous call when payment is required |
Output Schema
| Name | Required | Description |
|---|---|---|
| error | No | Set if tx_hash was not found; other fields are omitted. |
| reason | No | Explanation recorded for the verdict. |
| tx_hash | No | Hash of the audit chain record. |
| verdict | No | COMMIT or NO_COMMIT. |
| agent_id | No | Identifier of the agent tied to this record. |
| prev_hash | No | Hash of the preceding record in the chain. |
| seal_text | No | Human-readable Leibniz Layer verification seal. |
| task_type | No | Task type tag recorded with this entry. |
| timestamp | No | Unix timestamp when the record was created. |
| confidence | No | Confidence score recorded for the verdict. |
| verify_url | No | Public URL to independently verify this seal. |
| chain_index | No | Sequential index of the record in the chain. |
| drift_context | No | Extended forensic metadata captured at evaluation time. |
| tamper_reason | No | Why chain_integrity is False — a broken prev_hash link or an edited row whose stored tx_hash no longer matches its recomputed content hash. |
| chain_integrity | No | True if the full chain verifies as intact. |
| tampered_at_index | No | Index where chain integrity broke, if any tampering was detected. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, and non-destructive behavior, so the description adds value by disclosing the $0.50 cost, extended output fields, and full chain integrity verification. This gives the agent useful operational context beyond the structured safety hints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, front-loaded with the tool's purpose, and includes cost and key output features in one sentence. It avoids redundancy, though it sacrifices some contextual guidance that could make it more complete.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the presence of an output schema and complete annotations, the description provides additional useful context like cost and extended verification. However, it lacks a comparison with the dcl_audit_decode sibling and doesn't explain what drift_context is, leaving some contextual gaps for an agent deciding between similar tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, with both parameters already described clearly. The description adds no additional parameter-level semantics; it only mentions cost and output characteristics. Since the schema handles the parameter meaning, a baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies this as a deep forensic audit decode for post-action review, with extended output including drift_context and full chain integrity verification. It distinguishes itself from the sibling dcl_audit_decode by the word 'Deep' and the mention of extended output, though it doesn't explicitly contrast the two.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance is provided for when to use this tool versus alternatives like dcl_audit_decode. The phrase 'POST-ACTION' implies a usage context, but there is no clear statement of when to choose this deep variant or any exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dcl_commitLeibniz Layer Crypto CommitAInspect
FINAL-STEP Leibniz Layer Crypto Commit ($0.01). Writes a trading/agent decision to the append-only Leibniz Layer audit chain and returns a Merkle-proof-style receipt: tx_hash (proof of this specific commit), chain_hash (the previous commit's hash, linking this one into the chain), and chain_depth (this commit's position in the chain). Unlike the evaluate_* tools, this call has no pass/fail verdict of its own — it always succeeds and simply seals the decision. Passing prior_checks is optional but recommended: it records which earlier pipeline steps (firewall/wallet/trade/MEV) this specific commit is downstream of, in one auditable record. Always run this LAST, after every other crypto-suite check has passed.
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | Yes | Identifier of the agent whose decision is being committed. | |
| decision | Yes | The final trading/agent decision text to commit to the audit chain. | |
| payment_id | No | Optional payment identifier returned by a previous call when payment is required | |
| prior_checks | No | Optional dict of tx_hashes from earlier pipeline steps (e.g. {'prompt_firewall_tx_hash': ..., 'trade_verifier_tx_hash': ..., 'mev_compliance_tx_hash': ...}), linking this commit to the specific checks that passed before it. |
Output Schema
| Name | Required | Description |
|---|---|---|
| tx_hash | Yes | Tamper-evident proof of this specific commit. |
| timestamp | Yes | Unix timestamp when this record was sealed. |
| chain_hash | Yes | Hash of the previous commit in the append-only chain that this one links to. |
| input_hash | Yes | Hash of the committed decision text (raw content is never stored). |
| chain_depth | Yes | This commit's position (index) in the chain. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond annotations, the description discloses that the tool 'always succeeds', is append-only, costs $0.01, and returns a specific receipt format. It also explains the chain-linking behavior, which is not covered by annotations. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
While fairly long, every sentence adds value: purpose, return fields, comparison to evaluate_*, prior_checks explanation, and usage ordering. It is front-loaded with 'FINAL-STEP' and efficiently structured without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers purpose, return values, parameter semantics, and usage, making it complete for a commit tool. Output schema exists, so it doesn't need to explain returns, but it does anyway, and it addresses the tool's role in the pipeline. No significant gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3. The description adds extra meaning to prior_checks by explaining it records downstream pipeline steps with examples, which goes beyond the schema. It doesn't add much for agent_id/decision, but the extra prior_checks detail justifies a 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description starts with 'FINAL-STEP' and clearly states the tool 'Writes a trading/agent decision to the append-only Leibniz Layer audit chain' and returns a Merkle-proof-style receipt. It explicitly differentiates from evaluate_* tools by noting it has no pass/fail verdict, distinguishing it from siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says 'Always run this LAST, after every other crypto-suite check has passed', providing clear when-to-use guidance. Also contrasts with evaluate_* tools, and recommends passing prior_checks, giving a clear usage pattern.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dcl_evaluate_batchBatch EvaluationAInspect
PRE-ACTION Bulk Processing ($0.10). Evaluates a list of items in one call; each item is a dict shaped {"response": str, "policy"?: str}, where policy defaults to "default" if omitted and may be any built-in policy name (default, strict, anti_jailbreak, safety, content_quality). Each item gets its own independent COMMIT/NO_COMMIT verdict via the same logic as the matching single-item evaluate_* tool; results are returned in input order under results, plus a shared batch_id. There is currently no enforced size limit on items in this tool. Use this instead of multiple single-item evaluate_* calls when checking several responses — optionally against different policies — in one priced call rather than paying per item separately.
| Name | Required | Description | Default |
|---|---|---|---|
| items | Yes | List of items to evaluate, each shaped like {'response': str, 'policy'?: str}. | |
| agent_id | Yes | Identifier of the agent that produced the responses. | |
| payment_id | No | Optional payment identifier returned by a previous call when payment is required |
Output Schema
| Name | Required | Description |
|---|---|---|
| count | Yes | Number of items evaluated in this batch. |
| results | Yes | Per-item evaluation results, in input order. |
| agent_id | Yes | Identifier of the agent whose responses were evaluated. |
| batch_id | Yes | Unique identifier for this batch run. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With annotations providing no meaningful hints (all false), the description carries the full burden and delivers: pricing ($0.10), independent COMMIT/NO_COMMIT verdicts per item, same logic as single-item tools, results returned in input order, a shared batch_id, and no enforced size limit. This is comprehensive behavioral disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single dense paragraph but every sentence earns its place: cost, behavior, item format, policy defaults, return format, and usage recommendation. It is efficiently front-loaded with the pricing and primary action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (batch evaluation, mixed policies, paid action), the description covers all necessary context: how items are structured, which policies are supported, independent verdicts, return format, and cost. It is fully self-sufficient even with the output schema present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Although schema coverage is 100%, the description enriches parameter understanding by detailing the item structure, the default policy value, and listing allowed policy names (default, strict, anti_jailbreak, safety, content_quality). It also clarifies the output shape (results and batch_id), going well beyond the schema's basic descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Evaluates a list of items in one call' with a specific verb and resource. It also distinguishes itself from siblings by explicitly positioning it as the batch alternative to multiple single-item evaluate_* calls.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit guidance is provided: 'Use this instead of multiple single-item evaluate_* calls when checking several responses — optionally against different policies — in one priced call.' This clearly states when to use the tool and contrasts it with alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dcl_evaluate_fastFast Pre-Action AuditAInspect
FAST Pre-Action Audit ($0.01). Runs the response through the server's "default" policy: a substring check against 3 forbidden phrases ("ignore previous instructions", "jailbreak", "bypass safety") with a 0.7 minimum-confidence threshold. Each forbidden match found costs 0.4 confidence; if confidence falls below 0.7, or any match is found, the verdict is NO_COMMIT and reason lists which phrase triggered it. Otherwise COMMIT. Use this as the default low-cost first-pass gate before a risky agent action; switch to dcl_evaluate_strict for a broader, higher-bar check, or to dcl_evaluate_jailbreak / dcl_evaluate_safety / dcl_evaluate_quality for a narrower, single-topic check instead of the general-purpose default policy.
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | Yes | Identifier of the agent that produced the response. | |
| response | Yes | The agent or LLM response text to audit. | |
| payment_id | No | Optional payment identifier returned by a previous call when payment is required |
Output Schema
| Name | Required | Description |
|---|---|---|
| reason | Yes | Human-readable explanation of why the verdict was reached. |
| tx_hash | Yes | Hash of this record in the tamper-evident audit chain. |
| verdict | Yes | COMMIT if the response passed policy checks, otherwise NO_COMMIT. |
| seal_text | Yes | Human-readable Leibniz Layer verification seal. |
| timestamp | Yes | Unix timestamp when this record was sealed. |
| confidence | Yes | Confidence score of the verdict, from 0.0 to 1.0. |
| drift_mode | Yes | Current drift status: NORMAL, WARNING, ESCALATION, or BLOCK. |
| input_hash | Yes | Hash of the evaluated response (raw content is never stored). |
| verify_url | Yes | Public URL to independently verify this seal. |
| chain_index | Yes | Sequential index of this record in the audit chain. |
| drift_score | Yes | Z-score measuring deviation of the recent commit rate from baseline. |
| policy_version | Yes | Version of the policy that was applied. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Discloses behavioral details far beyond annotations: $0.01 cost, exact substring phrases, 0.7 confidence threshold, 0.4 confidence penalty, NO_COMMIT/COMMIT verdict logic, and reason field behavior. Annotations provide no safety hints, so the description carries the burden and does so thoroughly.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences: cost + policy, algorithm mechanics, usage guidance. Dense and front-loaded with the most critical information ($0.01) first. No filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, return values need not be explained. The description covers cost, policy details, threshold behavior, verdict logic, and use-case alternatives, making it complete for a simple evaluation tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline 3 applies. The description adds policy context but does not add new parameter-level meaning beyond the schema's existing descriptions for response, agent_id, and payment_id.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb (runs through audit) and resource (server's default policy), with exact forbidden phrases and threshold. It clearly distinguishes from siblings by naming alternatives like dcl_evaluate_strict and dcl_evaluate_jailbreak.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit guidance is given: use as default low-cost first-pass gate before risky actions; switch to strict for broader check or to jailbreak/safety/quality for narrower single-topic checks. This provides when/when-not with named alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dcl_evaluate_jailbreakJailbreak Detection CheckAInspect
PRE-ACTION Instruction Adherence Check ($0.02). Runs the "anti_jailbreak" policy: a substring check against 6 forbidden phrases ("ignore previous instructions", "jailbreak", "bypass safety", "pretend you are", "act as if", "DAN") with a 0.8 minimum-confidence threshold — each match costs 0.4 confidence. Returns COMMIT if no phrase matches and confidence stays at or above 0.8, otherwise NO_COMMIT with reason listing the matched phrase(s). Use this as a targeted, cheaper check when the concern is specifically prompt-injection / persona-hijack risk; use dcl_evaluate_strict instead when you also want safety- and default-policy phrases covered in the same call.
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | Yes | Identifier of the agent that produced the response. | |
| response | Yes | The agent or LLM response text to check for jailbreak attempts. | |
| payment_id | No | Optional payment identifier returned by a previous call when payment is required |
Output Schema
| Name | Required | Description |
|---|---|---|
| reason | Yes | Human-readable explanation of why the verdict was reached. |
| tx_hash | Yes | Hash of this record in the tamper-evident audit chain. |
| verdict | Yes | COMMIT if the response passed policy checks, otherwise NO_COMMIT. |
| seal_text | Yes | Human-readable Leibniz Layer verification seal. |
| timestamp | Yes | Unix timestamp when this record was sealed. |
| confidence | Yes | Confidence score of the verdict, from 0.0 to 1.0. |
| drift_mode | Yes | Current drift status: NORMAL, WARNING, ESCALATION, or BLOCK. |
| input_hash | Yes | Hash of the evaluated response (raw content is never stored). |
| verify_url | Yes | Public URL to independently verify this seal. |
| chain_index | Yes | Sequential index of this record in the audit chain. |
| drift_score | Yes | Z-score measuring deviation of the recent commit rate from baseline. |
| policy_version | Yes | Version of the policy that was applied. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description reveals behavioral details beyond annotations: the cost ($0.02), the exact algorithm (substring check, 0.8 confidence threshold, 0.4 confidence penalty per match), and the return format (COMMIT/NO_COMMIT with reason listing matched phrases). This gives substantial context that annotations do not provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and well-structured, packing cost, algorithm, return behavior, and usage guidance into two sentences with no unnecessary words. It is dense but highly readable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the output schema exists, the description does not need to explain return values in detail. It covers all essential aspects: purpose, cost, algorithm, when to use, and how it differs from alternatives. No gaps remain.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already has 100% description coverage for all three parameters, so the baseline is 3. The description does not add parameter-specific semantics beyond what the schema provides; it focuses on the algorithm and use case rather than on the parameters themselves.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool runs an 'anti_jailbreak' policy with substring checks against 6 forbidden phrases and returns COMMIT or NO_COMMIT. It distinguishes itself from dcl_evaluate_strict, specifying the exact scope (prompt-injection/persona-hijack) and differentiating from sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly provides usage guidance: use this targeted, cheaper check for prompt-injection/persona-hijack risk, and use dcl_evaluate_strict when broader safety/default-policy coverage is needed. This clearly states when to use this tool versus the alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dcl_evaluate_jailbreak_cryptoCrypto Jailbreak & Injection DetectionAInspect
PRE-ACTION Crypto Jailbreak & Injection Detection ($0.02). Crypto-specialized instruction-override/jailbreak/injection screen: standard role-switch and instruction-override patterns, plus crypto-specific drain-wallet injection (e.g. "transfer all funds to...", fake "test transaction" requesting full balance) and unlimited-approval injection (e.g. type(uint256).max, "approve unlimited allowance", skip-slippage-confirmation framing). Any match returns NO_COMMIT with reason and findings naming the matched category/categories; run this FIRST in the DCL crypto pipeline, before wallet/trade/MEV checks, since it screens the input itself rather than a decision built on top of it.
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | Yes | Identifier of the agent that produced or received the text. | |
| response | Yes | The incoming prompt or agent response to screen for crypto-specialized jailbreak/injection attempts. | |
| payment_id | No | Optional payment identifier returned by a previous call when payment is required |
Output Schema
| Name | Required | Description |
|---|---|---|
| reason | Yes | Human-readable explanation of the verdict. |
| tx_hash | Yes | Hash of this record in the tamper-evident audit chain. |
| verdict | Yes | COMMIT if no injection pattern matched, otherwise NO_COMMIT. |
| findings | Yes | All matched patterns. Empty list if verdict is COMMIT. |
| confidence | Yes | Confidence score of the verdict, from 0.0 to 1.0. |
| input_hash | Yes | Hash of the screened text (raw content is never stored). |
| chain_index | Yes | Sequential index of this record in the audit chain. |
| policy_version | Yes | Version of the crypto jailbreak policy that was applied. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Despite annotations carrying no safety hints, the description discloses substantial behavioral traits: it is pre-action, costs $0.02, returns NO_COMMIT with 'reason' and 'findings' naming matched categories, and screens raw input rather than derived decisions. This goes well beyond what annotations alone convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense but every sentence delivers critical value: purpose, concrete patterns, return behavior, and pipeline ordering. It is front-loaded with the pre-action caveat and cost, and the length is justified by the specificity of the examples.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity, the description fully covers what it does, when to use it, what it returns, and how it fits into the DCL pipeline. The presence of an output schema reduces the need to specify return structure, but the description already mentions key return fields.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with parameter descriptions already covering agent_id, response, and payment_id. The tool description does not add further parameter-level detail, but none is needed because the schema is fully self-documenting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('screen') and resource ('crypto-specialized instruction-override/jailbreak/injection'), clearly distinguishing it from the sibling 'dcl_evaluate_jailbreak' by emphasizing the crypto-specific angle. It names concrete pattern categories (drain-wallet, unlimited-approval), leaving no ambiguity about the tool's function.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly instructs to 'run this FIRST in the DCL crypto pipeline, before wallet/trade/MEV checks' and explains why: it screens the input itself rather than a decision built atop it. This provides clear when-to-use guidance and implicitly excludes use after downstream checks have been built.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dcl_evaluate_mevMEV & Market-Abuse Compliance ScreenAInspect
POST-ACTION MEV & Market-Abuse Compliance Screen ($0.03). Text-level screen (not a mempool/transaction analyzer) for front-running/sandwich-attack language, wash trading/layering/spoofing, KYC/AML red flags (mixers, structuring, obscuring fund origin), and pump-and-dump/rug-pull language. Any critical-severity finding, or two or more major-severity findings, returns NO_COMMIT; a single major-severity finding is also returned as NO_COMMIT but with a distinctly higher confidence (~0.55 vs ~0.05-0.2 for harder violations) so downstream callers can tell a soft single flag apart from a hard multi-finding block. Each finding includes an illustrative regulatory_reference tag (MiFID II, FCA, or an EU AI Act article).
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | Yes | Identifier of the agent that produced the response. | |
| response | Yes | The agent or LLM response text describing or proposing an on-chain/trading action, to screen for MEV and market-abuse language. | |
| payment_id | No | Optional payment identifier returned by a previous call when payment is required |
Output Schema
| Name | Required | Description |
|---|---|---|
| tx_hash | Yes | Hash of this record in the tamper-evident audit chain. |
| verdict | Yes | COMMIT if the response passed the MEV/compliance screen, otherwise NO_COMMIT. |
| findings | Yes | All matched patterns. Empty list if verdict is COMMIT. |
| timestamp | Yes | Unix timestamp when this record was sealed. |
| confidence | Yes | Confidence score of the verdict, from 0.0 to 1.0. |
| input_hash | Yes | Hash of the screened text (raw content is never stored). |
| chain_index | Yes | Sequential index of this record in the audit chain. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations are minimal (all false), so the description carries the burden of behavioral disclosure. It adds valuable context: cost ($0.03), decision thresholds (NO_COMMIT for critical or 2+ major findings), confidence nuances (~0.55 vs ~0.05-0.2), and the inclusion of regulatory_reference tags. This goes beyond the annotations and provides meaningful operational detail.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is detailed yet tightly packed with actionable information. Every sentence contributes unique value: scope, cost, decision logic, confidence semantics, and regulatory tags. It is front-loaded with the tool name and cost, making it easy to scan.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a compliance-screening tool with nuanced decision logic, the description is remarkably complete. It covers scope, exclusions, cost, severity thresholds, confidence interpretation, and output tags. Since an output schema exists, the absence of explicit return-value descriptions is acceptable. The description fully equips an agent to decide when and how to invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all three parameters. The description does not add significant parameter-level detail beyond what is already in the schema, but it does clarify the purpose of the 'response' parameter (screen for MEV/market-abuse language). This is baseline adequate with high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('screen') and resource ('MEV & Market-Abuse') and clearly distinguishes itself from sibling evaluation tools by focusing on market-abuse language. It also specifies the tool's text-level scope, immediately differentiating it from transaction-level analyzers.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context on when to use the tool (post-action screening of agent responses proposing on-chain/trading actions) and explicitly states what it is not ('not a mempool/transaction analyzer'). However, it does not name alternative sibling tools, so it misses the full 'alternatives' criterion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dcl_evaluate_output_sanitizerOutput Sanitizer — Final GateAInspect
FINAL-GATE Output Sanitizer ($0.02). Post-processing checkpoint that strips secrets/credentials, PII, crypto material (seed phrases, private keys, wallet addresses), internal network details (private IPs, MAC addresses, .internal/.local/.corp hostnames), and unsafe shell/SQL/path-traversal fragments from a raw model response — plus a narrow, high-precision safety net for direct self-harm-instruction-seeking and targeted-harassment phrasing (not a general toxicity classifier). Returns a single sanitized_output with every match replaced by [REDACTED]; use that instead of the original whenever verdict is NO_COMMIT. Run this as the LAST gate before a response reaches its destination — after dcl_evaluate_jailbreak_crypto/other input-side checks have already run, and immediately before dcl_commit seals the final decision. Internally re-uses the same detection tables as dcl_evaluate_secrets/dcl_evaluate_pii for the secrets/PII categories, so results stay consistent with those tools.
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | Yes | Identifier of the agent that produced the response. | |
| response | Yes | The raw LLM/agent response to sanitize before it is delivered to a user, downstream agent, or external system. | |
| payment_id | No | Optional payment identifier returned by a previous call when payment is required |
Output Schema
| Name | Required | Description |
|---|---|---|
| tx_hash | Yes | Hash of this record in the tamper-evident audit chain. |
| verdict | Yes | COMMIT if the response was clean, otherwise NO_COMMIT. |
| findings | Yes | All matches found, with position/severity/category detail. Empty list if verdict is COMMIT. |
| timestamp | Yes | Unix timestamp when this record was sealed. |
| confidence | Yes | Confidence score of the verdict, from 0.0 to 1.0. |
| input_hash | Yes | Hash of the sanitized text (raw content is never stored). |
| risk_score | Yes | 0.0-1.0 composite severity score. |
| violations | Yes | Distinct finding types matched (e.g. ['api_key', 'internal_ip']). Empty list if verdict is COMMIT. |
| chain_index | Yes | Sequential index of this record in the audit chain. |
| redaction_count | Yes | Total number of items redacted. |
| sanitized_output | No | Input text with every match replaced by [REDACTED]. Null if verdict is COMMIT. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations are sparse (readOnlyHint=false, destructiveHint=false). The description adds valuable behavior: cost ($0.02), consistent internal reuse of detection tables, return of sanitized_output with [REDACTED], and the narrow safety-net scope. However, it does not clarify whether the trait readOnlyHint=false implies any side effects or payment behavior beyond the optional payment_id, leaving a small gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One dense paragraph, front-loaded with the core purpose, then specific categories, output format, and usage ordering. Every sentence adds unique information with no fluff or redundancy, perfectly sized for the tool's complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers purpose, usage sequence, relationship to sibling tools, cost, output structure, and the consistency mechanism with other evaluators. Given the presence of an output schema and annotations, this is fully complete for an agent to select and invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and each parameter (response, agent_id, payment_id) has its own clear description. The tool description does not introduce new parameter-specific meanings beyond emphasizing the 'raw model response' for `response`, which is already captured in the schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('strips') and resource ('raw model response'), enumerates exact categories (secrets, PII, crypto material, internal network details, unsafe fragments), and clearly differentiates from siblings by framing itself as the 'FINAL-GATE' and referencing input-side checks and dcl_commit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says when to use: 'Run this as the LAST gate before a response reaches its destination', after input-side checks and immediately before dcl_commit. It also names the alternative tools (dcl_evaluate_jailbreak_crypto, dcl_evaluate_secrets, dcl_evaluate_pii) and provides a substitution rule for NO_COMMIT verdicts.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dcl_evaluate_piiPII Detection ScanAInspect
POST-ACTION PII Detection Scan ($0.02). Regex-based scan across 8 personal-data categories, with a Luhn checksum on card numbers to reduce false positives. Any finding results in NO_COMMIT.
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | Yes | Identifier of the agent that produced the response. | |
| response | Yes | The text to scan for personal data: emails, phone numbers, national IDs, bank cards, IBANs, crypto addresses, IP addresses, passport numbers. | |
| payment_id | No | Optional payment identifier returned by a previous call when payment is required |
Output Schema
| Name | Required | Description |
|---|---|---|
| tx_hash | Yes | Hash of this record in the tamper-evident audit chain. |
| verdict | Yes | COMMIT if nothing was found, otherwise NO_COMMIT. |
| findings | Yes | All matches found. Empty list if verdict is COMMIT. |
| seal_text | Yes | Human-readable Leibniz Layer verification seal. |
| timestamp | Yes | Unix timestamp when this record was sealed. |
| input_hash | Yes | Hash of the scanned text (raw content is never stored). |
| risk_score | Yes | 0.0-1.0 risk score based on number and severity of findings. |
| verify_url | Yes | Public URL to independently verify this seal. |
| chain_index | Yes | Sequential index of this record in the audit chain. |
| detection_count | Yes | Number of findings. |
| categories_clear | Yes | Categories with no findings. |
| categories_checked | Yes | All checklist categories that were scanned. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only state readOnlyHint=false, destructiveHint=false, providing no safety profile. The description compensates fully by disclosing the cost ($0.02), method (regex-based, Luhn checksum), and critical behavioral consequence (any finding results in NO_COMMIT). This adds substantial context beyond annotations and no contradiction exists.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, each earning its place: states the purpose/cost, explains the scan mechanics and false-positive reduction, and reveals the key outcome (NO_COMMIT). Front-loaded with the tool's function, no wasted language.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the presence of a true output schema and moderate complexity, the description is largely complete: it covers purpose, cost, mechanism, and outcome. It could be more explicit about the expected workflow (e.g., when exactly to call it relative to other actions), but the 'POST-ACTION' and NO_COMMIT signals convey the essential context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with all three parameters (agent_id, response, payment_id) already described clearly. The description adds no additional parameter-specific meaning beyond what the schema provides, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear purpose with a specific verb ('Detection Scan') and resource ('PII'), and explicitly names the scope: scanning across 8 personal-data categories. It distinguishes itself from siblings by focusing on PII and mentions a unique method (Luhn checksum) and outcome (NO_COMMIT).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The 'POST-ACTION' prefix implies when to use, and the NO_COMMIT outcome suggests it blocks commits, but there is no explicit statement of when to use versus alternatives or exclusions. No mention of other sibling tools or criteria for choosing this over dcl_evaluate_secrets or dcl_evaluate_safety.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dcl_evaluate_qualityContent Quality & Drift CheckAInspect
PRE-ACTION Content Quality & Drift Check ($0.03). Runs the "content_quality" policy: flags 12 absolutist or unverifiable-claim phrases (e.g. "guaranteed returns", "100% accurate", "studies show", "without a doubt") with a 0.85 minimum-confidence threshold — the highest bar of any single-policy tool. Returns NO_COMMIT if any phrase matches or confidence falls below 0.85, with reason listing the matched phrase(s). Use this to catch overconfident or unsubstantiated claims in generated content — a different concern from jailbreak or safety phrasing — e.g. before publishing agent-written copy or reports.
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | Yes | Identifier of the agent that produced the response. | |
| response | Yes | The agent or LLM response text to check for quality and drift. | |
| payment_id | No | Optional payment identifier returned by a previous call when payment is required |
Output Schema
| Name | Required | Description |
|---|---|---|
| reason | Yes | Human-readable explanation of why the verdict was reached. |
| tx_hash | Yes | Hash of this record in the tamper-evident audit chain. |
| verdict | Yes | COMMIT if the response passed policy checks, otherwise NO_COMMIT. |
| seal_text | Yes | Human-readable Leibniz Layer verification seal. |
| timestamp | Yes | Unix timestamp when this record was sealed. |
| confidence | Yes | Confidence score of the verdict, from 0.0 to 1.0. |
| drift_mode | Yes | Current drift status: NORMAL, WARNING, ESCALATION, or BLOCK. |
| input_hash | Yes | Hash of the evaluated response (raw content is never stored). |
| verify_url | Yes | Public URL to independently verify this seal. |
| chain_index | Yes | Sequential index of this record in the audit chain. |
| drift_score | Yes | Z-score measuring deviation of the recent commit rate from baseline. |
| policy_version | Yes | Version of the policy that was applied. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only indicate non-read-only status and non-destructiveness. The description adds valuable behavior context: cost ($0.03), minimum-confidence threshold (0.85), return behavior (NO_COMMIT with matched phrases), and the 'PRE-ACTION' nature. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is four sentences but each one adds essential information: what it does, how it works, what it returns, and when to use it. It is front-loaded with the tool's name and cost, and contains no redundant or filler text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the presence of an output schema and complete parameter schema, the description covers all necessary decision-informing aspects: cost, threshold, policy specifics, output behavior, and usage context. It is fully sufficient for an agent to select and invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema descriptions cover all three parameters fully (100% coverage), so the description isn't required to explain them. It adds no parameter-specific semantics beyond what the schema already states, but the baseline of 3 is appropriate for complete schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: it runs the 'content_quality' policy and flags 12 specific types of overconfident or unverifiable phrases. It also explicitly distinguishes itself from jailbreak/safety tools, making its purpose unambiguous relative to siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit when-to-use guidance: 'before publishing agent-written copy or reports' to catch unsubstantiated claims. It also differentiates from alternatives by noting this is 'a different concern from jailbreak or safety phrasing,' effectively covering exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dcl_evaluate_safetyBaseline Safety CheckAInspect
PRE-ACTION Baseline Safety Check ($0.01). Runs the "safety" policy: flags 2 forbidden disclaimers ("I cannot be held responsible", "no guarantees") and additionally REQUIRES the substring "AI" to appear somewhere in the response — missing it costs 0.2 confidence even with no forbidden phrase present. Minimum confidence is 0.75. Returns NO_COMMIT if confidence drops below 0.75, with reason naming the forbidden phrase found or the missing required pattern. Use this when you specifically need to confirm an AI-disclosure marker is present and the two disclaimer phrases are absent — not as a general-purpose safety net; for broader coverage use dcl_evaluate_fast or dcl_evaluate_strict instead.
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | Yes | Identifier of the agent that produced the response. | |
| response | Yes | The agent or LLM response text to check for safety violations. | |
| payment_id | No | Optional payment identifier returned by a previous call when payment is required |
Output Schema
| Name | Required | Description |
|---|---|---|
| reason | Yes | Human-readable explanation of why the verdict was reached. |
| tx_hash | Yes | Hash of this record in the tamper-evident audit chain. |
| verdict | Yes | COMMIT if the response passed policy checks, otherwise NO_COMMIT. |
| seal_text | Yes | Human-readable Leibniz Layer verification seal. |
| timestamp | Yes | Unix timestamp when this record was sealed. |
| confidence | Yes | Confidence score of the verdict, from 0.0 to 1.0. |
| drift_mode | Yes | Current drift status: NORMAL, WARNING, ESCALATION, or BLOCK. |
| input_hash | Yes | Hash of the evaluated response (raw content is never stored). |
| verify_url | Yes | Public URL to independently verify this seal. |
| chain_index | Yes | Sequential index of this record in the audit chain. |
| drift_score | Yes | Z-score measuring deviation of the recent commit rate from baseline. |
| policy_version | Yes | Version of the policy that was applied. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses many behavioral details beyond the annotations, including the cost ($0.01), the exact policy thresholds, the 0.2 confidence penalty for missing 'AI', the minimum confidence of 0.75, and the NO_COMMIT return behavior with a reason. This far exceeds the bare annotation hints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense but every sentence adds value. It front-loads the essential purpose and cost, then details the policy, thresholds, return behavior, and usage guidance without any fluff. Despite being long, it is efficiently structured and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity, the description fully covers the evaluation criteria, confidence calculation, return values, and usage boundaries. The output schema exists and would explain return format, but the description still clarifies the NO_COMMIT condition and reason, making it complete for an agent to invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already provides 100% description coverage for all parameters, so the baseline is 3. The description adds meaningful context by explaining how the 'response' text is evaluated against the safety policy and how confidence is calculated, enriching the parameter semantics beyond simple field descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: runs the 'safety' policy, flags two forbidden disclaimers, requires the substring 'AI', and returns NO_COMMIT when confidence drops below 0.75. It also distinguishes from siblings by explicitly noting it is not a general-purpose safety net and pointing to dcl_evaluate_fast or dcl_evaluate_strict for broader coverage.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit when-to-use guidance: 'Use this when you specifically need to confirm an AI-disclosure marker is present and the two disclaimer phrases are absent.' It also names alternatives for broader coverage, providing clear context and exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dcl_evaluate_secretsSecret & Credential Leak ScanAInspect
POST-ACTION Secret & Credential Leak Scan ($0.02). Regex-based scan across 8 categories (API keys, cloud credentials, tokens/JWTs, private keys, DB URLs, connection strings, env assignments, webhook secrets, internal endpoints with auth). Any finding results in NO_COMMIT.
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | Yes | Identifier of the agent that produced the response. | |
| response | Yes | The text to scan for exposed API keys, tokens, private keys, DB URLs, and other credentials. | |
| payment_id | No | Optional payment identifier returned by a previous call when payment is required |
Output Schema
| Name | Required | Description |
|---|---|---|
| tx_hash | Yes | Hash of this record in the tamper-evident audit chain. |
| verdict | Yes | COMMIT if nothing was found, otherwise NO_COMMIT. |
| findings | Yes | All matches found. Empty list if verdict is COMMIT. |
| seal_text | Yes | Human-readable Leibniz Layer verification seal. |
| timestamp | Yes | Unix timestamp when this record was sealed. |
| input_hash | Yes | Hash of the scanned text (raw content is never stored). |
| risk_score | Yes | 0.0-1.0 risk score based on number and severity of findings. |
| verify_url | Yes | Public URL to independently verify this seal. |
| chain_index | Yes | Sequential index of this record in the audit chain. |
| detection_count | Yes | Number of findings. |
| categories_clear | Yes | Categories with no findings. |
| categories_checked | Yes | All checklist categories that were scanned. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses the regex-based approach, the eight categories, the $0.02 cost, and the critical consequence that any finding produces NO_COMMIT. This goes beyond annotations and provides useful behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, information-dense sentence. It front-loads the action and cost, and includes a comprehensive list of categories without unnecessary elaboration.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema and complete parameter descriptions, the description covers the tool's purpose, scope, and a key outcome. It is sufficient for this scan tool, though it lacks explicit cross-referencing to sibling tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Since the schema already provides 100% parameter descriptions, the description does not need to add param details. It does not, but the schema fully covers the semantics, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool as a secret and credential leak scan, listing eight specific categories it checks. It distinguishes itself from sibling evaluation tools (like dcl_evaluate_pii) by focusing on credentials and adding the NO_COMMIT consequence.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The 'POST-ACTION' label indicates when the tool should be used, and the scan categories imply the type of content to check. However, it does not explicitly name alternatives or state when not to use it, so it misses a full usage guide.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dcl_evaluate_signalMarket Signal Fabrication ScreenAInspect
POST-ACTION Market Signal Fabrication Screen ($0.03). Pattern-based heuristic on the output text alone (no source price feed) — flags guaranteed-price-prediction language ("will definitely hit $X"), absolute-certainty claims ("100% certain", "cannot go down"), a fabricated-price flag when a specific dollar figure co-occurs with a guaranteed-outcome claim, and an invented-token flag when a "$TICKER" cashtag doesn't match a small set of well-known symbols (false positives are possible for legitimate lesser-known tickers — this is a heuristic pre-check, not ground truth). For a full claim-by-claim check against an actual price-feed snapshot, use the local grounding workflow instead of this live tool. Verdict/confidence collapsing follows the same rule as dcl_evaluate_mev: any critical finding or 2+ major findings is a hard NO_COMMIT; exactly one major finding is a softer NO_COMMIT at ~0.55 confidence.
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | Yes | Identifier of the agent that produced the response. | |
| response | Yes | The market signal, analysis, or price-prediction text to screen. | |
| payment_id | No | Optional payment identifier returned by a previous call when payment is required |
Output Schema
| Name | Required | Description |
|---|---|---|
| reason | Yes | Human-readable explanation of the verdict. |
| tx_hash | Yes | Hash of this record in the tamper-evident audit chain. |
| verdict | Yes | COMMIT if no fabrication/overconfidence pattern matched, otherwise NO_COMMIT. |
| findings | Yes | All matched patterns. Empty list if verdict is COMMIT. |
| timestamp | Yes | Unix timestamp when this record was sealed. |
| confidence | Yes | Confidence score of the verdict, from 0.0 to 1.0. |
| input_hash | Yes | Hash of the screened text (raw content is never stored). |
| chain_index | Yes | Sequential index of this record in the audit chain. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With annotations all false, the description carries the full burden and does so admirably. It discloses cost ($0.03), reliance on output text alone (no price feed), the specific heuristic patterns, false-positive potential, non-authoritative status, and the verdict/confidence collapsing rule referencing dcl_evaluate_mev. This goes well beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Though lengthy, every sentence is purposeful: it opens with the tool's name and cost, details the heuristic flags, provides a limitation/caveat, offers an alternative, and explains the verdict rule. It is front-loaded and well-organized, no fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the tool's purpose, behavior, limitations, alternatives, and verdict logic. An output schema exists to handle return structures. It even cross-references a sibling tool for the collapsing rule, providing comprehensive context for an AI agent to correctly select and invoke the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already provides 100% parameter descriptions (agent_id, response, payment_id), so the baseline is 3. The description adds some context about payment ($0.03) and POST-ACTION orientation, but does not significantly enhance parameter-level meaning beyond what the schema already states.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific verb+resource: 'Market Signal Fabrication Screen' with a precise pattern-based heuristic that flags guaranteed-price-prediction language, absolute-certainty claims, fabricated-price flags, and invented-token flags. It distinguishes itself from sibling evaluators by name and by referencing the local grounding workflow and dcl_evaluate_mev.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when not to use it ('For a full claim-by-claim check against an actual price-feed snapshot, use the local grounding workflow instead of this live tool') and labels it as a 'heuristic pre-check, not ground truth.' It implies when to use (POST-ACTION, quick screen) but does not enumerate all positive use cases.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dcl_evaluate_strictStrict Pre-Action AuditAInspect
STRICT Pre-Action Audit ($0.05). Runs the response against a broader, higher-bar "strict" policy: the union of all forbidden phrases from the default, anti-jailbreak, and safety policies (8 phrases total), with a 0.85 minimum-confidence threshold instead of the default policy's 0.7. Each matched phrase costs 0.4 confidence; if confidence falls below 0.85, or any phrase matches, the verdict is NO_COMMIT with reason listing every match found. Use this instead of dcl_evaluate_fast when the cost of a false COMMIT is high — e.g. before an irreversible or high-stakes agent action — since it catches jailbreak- and safety-adjacent phrasing that the plain default policy would miss.
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | Yes | Identifier of the agent that produced the response. | |
| response | Yes | The agent or LLM response text to audit. | |
| payment_id | No | Optional payment identifier returned by a previous call when payment is required |
Output Schema
| Name | Required | Description |
|---|---|---|
| reason | Yes | Human-readable explanation of why the verdict was reached. |
| tx_hash | Yes | Hash of this record in the tamper-evident audit chain. |
| verdict | Yes | COMMIT if the response passed policy checks, otherwise NO_COMMIT. |
| seal_text | Yes | Human-readable Leibniz Layer verification seal. |
| timestamp | Yes | Unix timestamp when this record was sealed. |
| confidence | Yes | Confidence score of the verdict, from 0.0 to 1.0. |
| drift_mode | Yes | Current drift status: NORMAL, WARNING, ESCALATION, or BLOCK. |
| input_hash | Yes | Hash of the evaluated response (raw content is never stored). |
| verify_url | Yes | Public URL to independently verify this seal. |
| chain_index | Yes | Sequential index of this record in the audit chain. |
| drift_score | Yes | Z-score measuring deviation of the recent commit rate from baseline. |
| policy_version | Yes | Version of the policy that was applied. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses detailed behavior beyond the neutral annotations: the $0.05 cost, the union of forbidden phrases from three policies, the 0.85 confidence threshold, the 0.4 confidence deduction per matched phrase, and the exact NO_COMMIT condition. It also mentions the `reason` field listing matches, giving full behavioral transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and every sentence adds value: cost, policy details, thresholds, verdict logic, and usage guidance. It is front-loaded with the tool's name and cost, and contains no filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the output schema exists, the description fully covers the tool's behavior, including the verdict conditions and the `reason` field. It provides enough context for an agent to invoke the tool correctly and interpret likely results, without needing to infer missing details.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema descriptions cover all three parameters (response, agent_id, payment_id) with 100% coverage, so the schema already provides the needed meaning. The description does not add parameter-specific details beyond what the schema states, matching the baseline for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: it runs an audit of a response against a broader strict policy, specifying exact thresholds (0.85 vs 0.7) and the verdict outcome. It explicitly differentiates from sibling tool dcl_evaluate_fast, making the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly tells when to use this tool instead of dcl_evaluate_fast: when the cost of a false COMMIT is high (e.g., irreversible or high-stakes actions). It provides a clear alternative and a rationale, fulfilling the when/when-not guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dcl_evaluate_tradeTrade Decision VerifierAInspect
PRE-ACTION Trade Decision Verifier ($0.02). Screens trade-decision language for guaranteed-return claims, zero-risk/"can't lose" framing, and unqualified "buy/sell X now" directives — any match is NO_COMMIT. If no unsafe language is found, COMMIT additionally requires the word "risk" to appear anywhere in the text as a minimum disclosure marker; its absence alone triggers NO_COMMIT with reason noting the missing disclosure. Produces an immutable trade_receipt (tx_hash/chain_hash/chain_depth) distinct from the top-level audit hash, for downstream systems that specifically need a trade-shaped receipt object.
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | Yes | Identifier of the agent that produced the response. | |
| response | Yes | The trade decision or recommendation text to screen. | |
| payment_id | No | Optional payment identifier returned by a previous call when payment is required |
Output Schema
| Name | Required | Description |
|---|---|---|
| reason | Yes | Human-readable explanation of the verdict. |
| verdict | Yes | COMMIT if the trade decision's language passed the screen, otherwise NO_COMMIT. |
| findings | Yes | All matched patterns. Empty list if verdict is COMMIT. |
| timestamp | Yes | Unix timestamp when this record was sealed. |
| confidence | Yes | Confidence score of the verdict, from 0.0 to 1.0. |
| input_hash | Yes | Hash of the screened text (raw content is never stored). |
| trade_receipt | Yes | Immutable receipt for this trade-verification record. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description goes far beyond the all-false annotations, disclosing cost ($0.02), the exact decision logic, the requirement for 'risk' as a disclosure marker, the output of an immutable trade_receipt, and its distinction from the top-level audit hash. This is rich behavioral transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is information-dense and well-structured. It leads with the tool's purpose, then details the decision rules and output, with no filler. Every sentence contributes distinct value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the existence of an output schema and the tool's moderate complexity, the description covers all essential aspects: what is screened, the decision criteria, the receipt output, and the cost. It is complete for an agent to select and invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds extra meaning by explicitly linking the response parameter to trade-decision language and by noting the $0.02 cost, which clarifies when the optional payment_id may be required.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Screens') and resource ('trade-decision language') and clearly enumerates the unsafe patterns it detects. It distinguishes itself from sibling evaluation tools by focusing on trade decisions and the resulting NO_COMMIT/COMMIT decision.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly indicates when to use the tool (for screening trade-decision language) and provides detailed behavioral conditions. However, it does not explicitly name alternatives or state when not to use it compared to sibling evaluators, though the trade-specific focus makes the context clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dcl_evaluate_walletWallet Secret GuardianAInspect
POST-ACTION Wallet Secret Guardian ($0.02). Scans for BIP-39 seed phrases (12 or 24 consecutive wordlist words), raw hex or WIF-format private keys, Ethereum/Bitcoin wallet addresses, and API keys/bearer tokens appearing near wallet/custody/signing terminology. Any finding results in NO_COMMIT — wallet secrets have no safe threshold, unlike other DCL evaluators. Returns a sanitized_output with all matches redacted (null if nothing was found) and a masked redacted_sample per finding — the real value is never returned or stored server-side.
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | Yes | Identifier of the agent that produced the response. | |
| response | Yes | The text to scan for seed phrases, private keys, wallet addresses, and wallet-context API credentials. | |
| payment_id | No | Optional payment identifier returned by a previous call when payment is required |
Output Schema
| Name | Required | Description |
|---|---|---|
| reason | Yes | Human-readable explanation of the verdict. |
| tx_hash | Yes | Hash of this record in the tamper-evident audit chain. |
| verdict | Yes | COMMIT if nothing was found, otherwise NO_COMMIT. Wallet secrets have no safe threshold. |
| findings | Yes | All matches found. Empty list if verdict is COMMIT. |
| timestamp | Yes | Unix timestamp when this record was sealed. |
| confidence | Yes | Confidence score of the verdict, from 0.0 to 1.0. |
| input_hash | Yes | Hash of the scanned text (raw content is never stored). |
| risk_score | Yes | 0.0-1.0 risk score based on number and severity of findings. |
| chain_index | Yes | Sequential index of this record in the audit chain. |
| policy_version | Yes | Version of the wallet-guardian policy that was applied. |
| sanitized_output | No | Input text with all matches redacted. Null if verdict is COMMIT. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations provide no safety hints, so the description carries the full burden. It discloses that any finding results in NO_COMMIT, that a sanitized_output and masked redacted_sample are returned, and that the real value is never returned or stored server-side. This is highly transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences long, starts with the tool's purpose, and packs essential details (scan targets, outcome, return behavior) without redundancy. The inclusion of the price is a minor but useful addition, and every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is complete for a content-scanning tool: it explains the tool's role, what it detects, the consequence of detection (NO_COMMIT), and the return format. An output schema exists, and the description covers the key return fields, making it sufficiently comprehensive.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for all three parameters, and the description does not add additional parameter-specific meaning beyond what the schema already provides. The baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states the tool scans for BIP-39 seed phrases, private keys, wallet addresses, and API keys near wallet terminology. It also distinguishes itself from other DCL evaluators by noting that wallet secrets have no safe threshold, making the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly indicates the tool is for post-action evaluation and emphasizes its role as a strict guardrail for wallet secrets. However, it does not explicitly name alternative tools like dcl_evaluate_secrets or state when not to use this tool, so it lacks explicit exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dcl_pipeline_startStart Pipeline SessionAInspect
SESSION Management ($0.05). Generates a new pipeline_id and returns session metadata (scope, expiry, initial drift_mode) for organizing a series of related checks under one identifier. Note: this call does not currently link the returned pipeline_id to later evaluate_* calls — there is no server-side session state that ties subsequent audits back to it; it is an identifier/timestamp issuer, not an active tracking session. Use this to obtain a shared reference ID for your own client-side grouping of a multi-step audit sequence; do not rely on it to automatically aggregate drift across calls.
| Name | Required | Description | Default |
|---|---|---|---|
| scope | No | Scope label for the session. | default |
| agent_id | Yes | Identifier of the agent that owns this session. | |
| payment_id | No | Optional payment identifier returned by a previous call when payment is required | |
| ttl_seconds | No | Session time-to-live, in seconds. |
Output Schema
| Name | Required | Description |
|---|---|---|
| scope | Yes | Scope label for the session. |
| agent_id | Yes | Identifier of the agent that owns this session. |
| drift_mode | Yes | Drift status at session start (always NORMAL for a new session). |
| expires_at | Yes | Unix timestamp when the session expires. |
| pipeline_id | Yes | Unique identifier for the newly opened pipeline session. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description goes far beyond the annotations (which are all false) by disclosing the critical limitation that the returned pipeline_id is not linked to later evaluate_* calls and that there is no server-side session state. It also adds the cost ($0.05) and clarifies it is an identifier/timestamp issuer, not an active tracking session. This is exceptional behavioral transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured: the cost and core purpose are front-loaded, followed by the critical limitation and usage guidance. Every sentence adds value, and the length is appropriate given the need to correct a likely misconception about session linkage.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity (simple ID generator) and the presence of an output schema, the description fully covers what the tool does, its limitations, and the intended usage. It is complete enough for an agent to decide when and how to use it without additional information.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the parameters are already fully documented. The description adds no param-specific details beyond what the schema provides, such as how to use scope or ttl_seconds. It does mention 'scope, expiry, initial drift_mode' as part of the returned metadata, but this is output context, not parameter semantics. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool generates a new pipeline_id and returns session metadata for grouping related checks. It explicitly distinguishes itself from the sibling evaluate_* tools by framing this as a session/pipeline starter, not an evaluation tool. The verb 'generates' and the resource 'pipeline_id' are specific and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit when-to-use guidance: 'Use this to obtain a shared reference ID for your own client-side grouping of a multi-step audit sequence.' It also provides a clear when-not: 'do not rely on it to automatically aggregate drift across calls.' It does not name alternative tools, but the context makes the appropriate use clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
2 tool updates
v2.3.0- Changed
dcl_audit_decode_deep1 field changed- added
Output schema / properties / tamper_reasonAdded value: +{ + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ], + "default": null, + "description": "Why chain_integrity is False — a broken prev_hash link or an edited row whose stored tx_hash no longer matches its recomputed content hash.", + "title": "Tamper Reason" +}
- Added
dcl_evaluate_output_sanitizer
6 tool updates
v2.2.0- Added
dcl_commit - Added
dcl_evaluate_jailbreak_crypto - Added
dcl_evaluate_mev - Added
dcl_evaluate_signal - Added
dcl_evaluate_trade - Added
dcl_evaluate_wallet
11 tool updates
v1.0.0- First observed
dcl_audit_decode - First observed
dcl_audit_decode_deep - First observed
dcl_evaluate_batch - First observed
dcl_evaluate_fast - First observed
dcl_evaluate_jailbreak - First observed
dcl_evaluate_pii - First observed
dcl_evaluate_quality - First observed
dcl_evaluate_safety - First observed
dcl_evaluate_secrets - First observed
dcl_evaluate_strict - First observed
dcl_pipeline_start
TDQS
Most tools have clearly distinct purposes, with detailed descriptions differentiating the many evaluate_* policies. However, the overlap between fast/strict and jailbreak/jailbreak_crypto could cause misselection without careful reading.
The dcl_ prefix and snake_case are consistent, and the verb-object pattern (evaluate_*, audit_*, commit) is mostly followed. Deviations include dcl_evaluate_output_sanitizer, which is a misnomer (it sanitizes, not evaluates), and dcl_pipeline_start, which doesn't follow the clean verb-object pattern.
At 18 tools, the set is larger than typical, but the server's broad scope (pre-action checks, post-action scans, crypto-specific screens, commit/receipts) justifies the count. It feels slightly heavy but not excessive.
The surface covers the full audit lifecycle: pre-action evaluation, post-action scanning, sanitization, commit, and audit retrieval. The main gap is dcl_pipeline_start, which is explicitly a stub with no server-side session linking, and there's no standalone chain-integrity verification tool (only mentioned within deep audit).
Maintenance
Related MCP Connectors
MCP-native Trust Infrastructure for AI Agents. Persistent encrypted memory with Trust Quotient.
Pre-execution governance for AI agents. Deterministic PASS/FAIL/REVIEW verdicts, replayable proof.
Compliance MCP for AI agents: sanctions & KYT screening on 50+ chains, stablecoin-freeze, oracle.
Runtime AI governance: decision gates, human approval, hash-chained audit, compliance mapping.
Related MCP Servers
- FlicenseNot gradedqualityDmaintenanceOn-chain trust verification for AI agent tools. Agents query skill attestations, audit levels, and risk scores before running third-party MCP servers, so you know what's safe before you execute.1-
- AlicenseAqualityCmaintenanceAI agent provenance, trust, and auditability layer. VERITAS multi-gate scoring, Cortex approval gates, S.E.A.L. hash-chain audit ledger, and semantic RAG with cryptographic provenance tracking for every decision an agent makes.275MIT
- AlicenseNot gradedqualityDmaintenanceCryptographic proof of every AI decision. An immutable, verifiable audit trail MCP server.1MIT
- AlicenseNot gradedqualityCmaintenanceMCP server providing immutable audit logging, policy enforcement, and compliance reporting for AI agent workflows, enabling regulatory compliance and chain integrity verification.MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/Fronesis-Labs/dcl-webhook'
If you have feedback or need assistance with the MCP directory API, please join our Discord server