AgentVeil Protocol
The AgentVeil Protocol server enables trust enforcement and reputation management for autonomous AI agents through decentralized identity and peer attestations.
Agent Registration & Identity: Register new AI agents with W3C DID (did:key) identities and auto-generated Ed25519 cryptographic keys
Reputation Management: Check reputation scores (0–1) with confidence metrics and detailed interpretation for any agent
Peer Attestations: Submit positive/negative/neutral ratings for other agents with confidence weights, cryptographic signatures, and interaction context; retrieve full attestation history
Agent Discovery: Search for agents by capabilities, LLM provider, or minimum reputation score; publish or update capability cards for discovery
Audit & Transparency: Verify the integrity of the immutable hash-chained audit log and access detailed audit trails for any agent
Agent Information: Get public info about agents including display names, verification status, and capabilities; view your own configured agent's DID and registration status
Protocol Monitoring: Access network-wide statistics including total agents, attestations, verified agents, escrows, and activity metrics
Security & Integrations: Ed25519 signature authentication, input validation, and sybil resistance; integrates with frameworks like CrewAI, LangGraph, AutoGen, and OpenAI for automated trust decisions
AgentVeil
The risk isn't what AI says. It's what AI does.
AgentVeil is an independent action-control layer for AI agents and MCP tools. It works alongside agent runtimes such as Cursor, Claude Code, Codex, Gemini CLI, and Hermes CLI: attempt, decision, controlled path when available, local proof.
Quick Start · The Loop · Connectors · Evidence · Scope · Design Basis · Docs
pip install agentveil-mcp-proxyPackages: agentveil-mcp-proxy · agentveil | Website: agentveil.dev | Package source: packages/agentveil-mcp-proxy/
Agent action boundary: AI runtimes execute agents. AgentVeil mediates configured action paths around them. When a native or risky action hits the boundary, AgentVeil decides allow, approval required, redirect guidance toward a controlled path, or hard-block. Routed MCP calls follow the same decision model and record bounded local evidence.
AgentVeil is not machine-wide control. Actions outside configured AgentVeil boundaries are not classified or logged.
Visual overview: request → AgentVeil boundary → redirect / approval / hard-block → local proof.
Data handling: AgentVeil is designed to keep raw MCP arguments local by default and to record bounded metadata and hashes for evidence. See Data Handling.
The AgentVeil Loop
AgentVeil is one product loop, not a pile of separate components:
Step | What happens |
Attempt | Agent tries a native mutation or routed MCP action in a configured project |
Decision | AgentVeil returns allow, approval required, redirect, or hard-block |
Controlled path | When one is available, redirect guidance tells the agent to retry through the managed MCP route |
Proof | Bounded local evidence records the decision; inspect it with |
Approval fixes actions that need human review. Redirect tells the agent to retry through the controlled MCP route when one is available. Hard-block means approval will not help for that action. Local proof is available now through the CLI—not a future dashboard page.
Related MCP server: BasedAgents
What AgentVeil Adds
AgentVeil is not an AI agent and does not replace an agent runtime. It adds a control layer around actions that are configured to pass through AgentVeil.
Layer | Agent runtime / framework | AgentVeil adds |
Execution | Runs the agent and exposes tools | Mediates configured action paths before execution |
Approval | May prompt per tool call, depending on runtime | Adds policy-aware approval for routed writes and mutations |
Risk classification | Runtime-specific, if present | Shared read / write / destructive / unknown classification |
Sandbox boundary | Runtime-specific | Project or downstream sandbox limits for routed actions |
Evidence | Usually chat or runtime logs | Bounded local records with request ids, decisions, and hashes |
Cross-runtime consistency | Per runtime | Same core control semantics where actions are routed through AgentVeil |
Quick Start
Use AgentVeil with a supported project connector, or run the Core MCP Proxy directly.
Cursor project connector
pip install agentveil-mcp-proxy
agentveil-mcp-proxy setup cursor --choose-folderChoose the project folder you want to protect, then reopen / reload Cursor for that project.
After setup, in the configured project:
supported native risky agent actions can be blocked before execution;
the agent receives redirect guidance toward the AgentVeil MCP route;
routed MCP writes can require approval;
AgentVeil records bounded local evidence for decisions and outcomes.
Some Cursor versions may require enabling the managed agentveil-mcp-proxy MCP server once in Tools & MCPs after reload.
Claude Code project connector
pip install agentveil-mcp-proxy
agentveil-mcp-proxy setup claude-code --choose-folder --yesChoose the project folder you want to protect, then reopen / reload Claude Code for that project.
After setup, in the configured project:
supported native Claude Code mutation tools are checked by a project-local hook;
risky native mutations are blocked with redirect guidance toward the controlled MCP route;
AgentVeil MCP writes go through the proxy approval path;
bounded evidence is written locally.
Codex project connector
pip install agentveil-mcp-proxy
agentveil-mcp-proxy setup codex --choose-folder --yesChoose the project folder you want to protect, then open / restart Codex for
that project. Codex asks you to trust the AgentVeil project hook once; until
the hook fires and evidence is observed, setup status --client codex remains
advisory, not protected.
After setup and hook trust, in the configured project:
supported native Codex mutation tools are checked by a project-local hook;
risky native mutations are blocked with redirect guidance toward the controlled MCP route;
AgentVeil MCP writes go through the proxy approval path;
bounded evidence is written locally.
Gemini CLI project connector
pip install agentveil-mcp-proxy
agentveil-mcp-proxy setup gemini-cli --choose-folder --yesChoose the project folder you want to protect, then open / restart Gemini CLI for that project. Gemini CLI asks you to trust the project folder before it loads local settings, hooks, and MCP servers.
After setup and folder trust, in the configured project:
supported native Gemini CLI mutation tools are checked by a project-local hook;
risky native mutations are blocked with redirect guidance toward the controlled MCP route;
AgentVeil MCP writes go through the proxy approval path;
bounded evidence is written locally.
Hermes CLI controlled MCP profile
Hermes CLI is launched through AgentVeil rather than installed as a persistent project hook:
pip install agentveil-mcp-proxy
agentveil-mcp-proxy launch --profile hermes-cli --choose-folder -- \
hermes chat -q "Create a project note"The launcher configures a project-local Hermes home, routes Hermes to the AgentVeil MCP tools, and keeps local proof/evidence in the selected project.
In this profile:
Hermes project work is routed through the AgentVeil MCP route;
routed reads, writes, approval, sandbox boundaries, redirect guidance, and local proof use the shared AgentVeil control layer;
native Hermes tools are limited by profile settings, but AgentVeil does not claim host-wide control of Hermes or the machine.
Core MCP Proxy path
For lower-level MCP routing without an IDE connector:
pip install agentveil-mcp-proxy
agentveil-mcp-proxy init --quickstart-filesystem ./sandbox
agentveil-mcp-proxy doctor --full
agentveil-mcp-proxy runThis starts the core route: MCP tool calls explicitly pointed at agentveil-mcp-proxy.
Verify your setup works
After installing a project connector, walk the current shipped path in that project:
Ask the agent to read project context. Routed reads such as
list_workspace,read_file,get_file_info, andinstruction_surface_statusshould allow.Ask the agent to create or edit a file, for example:
Create avp-test.txt with the text helloThe configured connector should stop the native mutation with redirect guidance; the agent should then use the controlled MCP route, where risky writes require approval. 3. Open the approval page when prompted and review the bounded proof details. 4. Inspect local proof from the CLI:
agentveil-mcp-proxy events show --lastThe default human output should include lines like
decision=approval_required and tool=write_file without dumping raw JSON.
Use --json when you need structured fields.
Connectors Available Today
AgentVeil is built around action-control boundaries. Cursor, Claude Code, Codex, and Gemini CLI are supported project hook connectors. Hermes CLI is available as a controlled MCP launch profile. The Core MCP Proxy is runtime-agnostic for MCP clients that are explicitly configured to call it.
Surface | Mechanism | What it adds | Status |
Cursor project connector | Project-local hooks + MCP route | Native mutation block + redirect guidance, routed MCP approval/evidence | Available |
Claude Code project connector | Project-local | Native mutation block + redirect guidance, routed MCP approval/evidence | Available |
Codex project connector | Project-local | Native mutation block after one-time hook trust, redirect guidance, routed MCP approval/evidence | Available |
Gemini CLI project connector | Project-local | Native mutation block after one-time folder trust, redirect guidance, routed MCP approval/evidence | Available |
Hermes CLI profile | AgentVeil launcher + project-local Hermes MCP route | Routed MCP approval/evidence, sandbox boundaries, redirect guidance inside the AgentVeil route | Available |
Core MCP Proxy | MCP transport boundary | Routed MCP policy, approval, redirect / policy-stop outcomes, bounded evidence | Available |
The Python SDK also includes framework examples and optional helper modules for CrewAI, LangGraph, AutoGen, PydanticAI, OpenAI, Gemini, and AWS Bedrock. Those examples are not the same as a project connector: they show how agent workflows can use AgentVeil primitives, while connector coverage still depends on what is configured and routed through AgentVeil.
Future connectors can follow the same model: configure a boundary, route risky actions through controlled tools, and record evidence.
Compatibility
Current connector checks have been run with:
Surface | Checked version |
Cursor | 3.6.31 |
Claude Code | 2.1.126 |
Codex | interactive TUI hook trust path |
Gemini CLI | 0.49.0 folder trust path |
Hermes CLI | live controlled MCP route path |
Python package metadata | Python 3.10-3.13 |
Other versions may work, but are not listed here until verified.
What AgentVeil Controls
AgentVeil has two public action-control surfaces:
Project connectors
configured per project/workspace;
install managed local hooks and MCP route config;
block supported native risky agent mutation tools;
return redirect guidance toward AgentVeil MCP tools;
use MCP Proxy approval and evidence for routed tool calls.
Core MCP Proxy
wraps downstream MCP servers;
classifies routed MCP tool calls;
returns allow / approval_required / redirect / policy-stop outcomes;
records bounded local evidence.
What AgentVeil Does Not Control
AgentVeil does not claim machine-wide control.
It does not control:
your whole machine;
every Cursor / Claude / Codex / Gemini / Hermes chat globally;
every autonomous agent runtime globally;
direct human terminal commands outside configured AgentVeil paths;
IDE actions outside supported agent tool surfaces;
MCP servers not routed through AgentVeil;
disabled, removed, or bypassed hooks;
unsupported client modes that skip hooks.
Actions outside configured AgentVeil boundaries are not classified or logged.
Bounded Evidence
AgentVeil records bounded local evidence for controlled actions, so you can review what an agent requested, whether it was allowed, given redirect guidance, sent for approval, returned a hard-block decision, and whether the controlled path completed.
Inspect recent decisions:
agentveil-mcp-proxy events show --last
agentveil-mcp-proxy events show --last --jsonExample evidence shape:
{
"tool": "write_file",
"decision": "approval_required",
"approval": "approved",
"target_reached": true,
"payload_hash": "sha256:...",
"timestamp": "2026-06-25T..."
}Evidence is designed for audit and incident review:
what the agent requested;
what policy decided;
whether approval was required;
whether the action executed;
hashes and bounded metadata instead of raw prompts or full payloads by default.
This is useful for AI-agent governance, compliance review, and debugging unsafe automation.
Handling False Positives
AgentVeil is designed to fail closed for risky actions. If a supported agent action is blocked unexpectedly, inspect local decision evidence before changing the setup.
Start with:
agentveil-mcp-proxy events show --last
agentveil-mcp-proxy setup status --jsonFor routed MCP actions, approval and policy behavior are documented in:
If a connector is not right for a project, remove only the managed AgentVeil entries for that project instead of editing client config by hand.
Preview managed removal:
agentveil-mcp-proxy setup remove cursor
agentveil-mcp-proxy setup remove claude-code
agentveil-mcp-proxy setup remove codex
agentveil-mcp-proxy setup remove gemini-cliApply removal after review:
agentveil-mcp-proxy setup remove cursor --yes
agentveil-mcp-proxy setup remove claude-code --yes
agentveil-mcp-proxy setup remove codex --yes
agentveil-mcp-proxy setup remove gemini-cli --yesScope
Available today:
MCP Proxy for routed MCP tool calls;
project-local Cursor connector;
project-local Claude Code connector;
project-local Codex connector;
project-local Gemini CLI connector;
Hermes CLI controlled MCP launch profile;
approval / redirect / block / evidence outcomes for routed actions;
bounded local evidence export.
Available as SDK / protocol primitives:
capability-token primitives;
local identity helpers;
delegation receipts;
proof packet helpers.
Preview / design-partner product flows:
session-token flows for reducing repeated approvals;
richer policy packs;
credential custody;
egress boundary;
hosted approval and team governance.
Not included in the public connector:
machine-wide shell interception;
global Cursor / Claude / Codex / Gemini / Hermes lock;
automatic control of unrelated chats;
private enterprise policy packs;
hosted auth, licensing, telemetry, or enterprise custody logic.
Example Risk Patterns
AgentVeil is useful when an agent crosses from reading context into changing state.
Workflow | Low-risk actions | Higher-risk actions AgentVeil can gate |
Code / PR workflow | read files, inspect git history, list workspace | edit files, run mutation commands, change repo state |
Content workflow | read drafts, inspect metadata | publish, send, update CMS-like content |
Data workflow | read query results, inspect schemas | mutate records, export sensitive data, run destructive operations |
Package / build workflow | inspect dependencies, read lockfiles | install packages, run scripts, change build output |
Agentic media / broadcast workflows
Agentic media and broadcast workflows often start with read access to files, assets, CMS entries, Git history, or SQL query results, then cross into higher-risk writes and sends: publishing updates, changing a repository, mutating a database, or sending final content.
This is one example of the broader risk pattern:
agent reads metadata -> allow / observe
agent edits file or record -> approval required
agent publishes or sends -> approval / redirect
agent tries unsafe mutation -> block
agent action completes -> bounded evidenceAgentVeil does not ship native broadcast, CMS, or SQL integrations in this package. The example describes the risk pattern for agentic workflows.
Why This Exists
AI agents increasingly hold direct access to files, repositories, package managers, credentials, and workflow tools.
The risk is no longer only what an AI says. The risk is what an AI can do.
AgentVeil focuses on action control:
Block unsafe native agent actions in configured project connectors.
Return redirect guidance so the agent can retry through controlled MCP tools.
Require approval for routed writes and mutations.
Record bounded evidence for audit, review, and compliance.
AgentVeil does not solve the general access-control safety problem. It narrows the problem to configured projects, routed MCP calls, supported agent tool paths, and explicit policy decisions.
Design Basis
The MCP Proxy design is summarized in MCP Proxy Design Principles.
Fail-safe defaults: missing policy, missing approval, or unavailable trusted decisions move toward denial or explicit review.
Complete mediation on routed calls: each protected downstream MCP call goes through the same classify, decide, evidence, and forward-or-deny path.
Least privilege: approvals are scoped to concrete action context instead of broad standing permission.
Separation of privilege: local proxy identity, control grants, and backend signing authority are separate roles.
Bounded evidence: receipts, payload hashes, and local evidence chains bind decisions to the routed action subset.
For deeper security framing, including Saltzer & Schroeder and HRU-aware limits, see MCP Proxy Design Principles.
Comparison
Category | Main focus | Where AgentVeil differs |
Prompt/content guardrails | Detect unsafe text | AgentVeil controls actions and tool calls, not only prompts |
LLM API gateways | Route model traffic | AgentVeil mediates agent tool execution and evidence |
Direct MCP servers | Expose tools to agents | AgentVeil adds policy, approval, redirect, and evidence between agent and tool when routed through the proxy |
Secret managers | Store credentials | AgentVeil controls when risky agent actions may execute |
Generic audit logs | Record app events | AgentVeil binds evidence to specific agent action requests and decisions |
Reporting Issues And Security Findings
For bugs and integration problems, use the repository issue tracker. For security-sensitive findings, follow the repository Security Policy.
Security-sensitive reports should not include secrets, raw credentials, private keys, or full customer data in public issues.
Licensing
The root SDK is MIT-licensed.
agentveil-mcp-proxy is a separately packaged source-available component under BUSL-1.1. See Licensing before using it in commercial or competing hosted services.
Python SDK and advanced protocol primitives
Advanced Python SDK package: agentveil.
The public SDK also includes protocol primitives that can support custom integrations: local did:key identity, delegation receipts, credential helpers, reputation credential access, receipt helpers, and optional framework adapter modules under agentveil.tools.* when their framework dependencies are installed.
These primitives are not the main product path in this README. For direct use, start with:
Available Tools
20 toolsapprove_actionA
Approve a pending human approval request and return signed receipt JCS plus sha256.
| Name | Required | Description | Default |
|---|---|---|---|
| approval_id | Yes | Human approval request id returned as approval.approval_id |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses that the tool returns a signed receipt JCS and sha256, implying the action is recorded and irrefutable. However, it does not specify whether the approval is reversible, what permissions are required, or what happens on failure. Some behavioral gaps remain.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that directly states the action and the return value. There is no extraneous information; every word is necessary and front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one parameter) and the presence of an output schema, the description is sufficient. It mentions the key outputs (signed receipt JCS and sha256), which complements the output schema. However, it could briefly note that the approval must be pending, which is implied but not explicit.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The tool description does not add information about the parameter beyond what is in the schema's description for 'approval_id' (which references 'approval.approval_id'). The description does not provide format constraints or additional semantics, so no uplift.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool approves a pending human approval request and returns a signed receipt JCS plus sha256. The verb 'approve' is specific and the resource is a human approval request, distinguishing it from sibling tools like 'deny_action' which performs the opposite action.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use this tool: to approve a pending request. It implicitly distinguishes from 'deny_action', but does not explicitly state when not to use it or suggest alternatives like first retrieving the request via 'get_approval_request'. However, the purpose is clear enough for an agent to decide.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
check_reputationA
Get the full reputation profile of an agent: score, confidence, risk factors, and tier.
Returns detailed numerical data for analysis and logging.
Use this when you need the actual numbers (score, confidence, risk breakdown).
NOT for yes/no delegation decisions — use check_trust instead (returns allowed: true/false).
NOT for rating history — use get_attestations_received for individual peer reviews.
Read-only. Does not modify any data or affect the target agent's score.
Args:
did: Agent's DID in W3C format. Must start with "did:key:z6Mk".
Returns:
JSON with score (0.0-1.0), confidence (0.0-1.0), risk_score (0.0-1.0),
risk_factors (list), tier (newcomer/basic/trusted/elite), and interpretation.
| Name | Required | Description | Default |
|---|---|---|---|
| did | Yes | Agent's decentralized identifier in W3C DID format. Must start with 'did:key:z6Mk'. Example: 'did:key:z6MkhaXgBZDvotzkL...' |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
States 'Read-only. Does not modify any data or affect the target agent's score.' Since no annotations are provided, the description fully covers behavioral traits, making it clear this is a safe query operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with clear sections: purpose, usage guidance, safety note, parameter description, and return format. Every sentence is informative and earns its place without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one required parameter, output schema exists), the description covers all essential aspects: what it does, when to use it, alternatives, behavioral impact, and return structure. It is fully complete for an agent to use correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema already describes the 'did' parameter completely (100% coverage), including the required format. The description's Args section repeats the same information without adding new semantics or constraints beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states 'Get the full reputation profile of an agent' and enumerates return components (score, confidence, risk factors, tier). It differentiates from siblings by specifying this is for numerical data, not yes/no decisions (check_trust) or rating history (get_attestations_received).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly tells when to use ('when you need the actual numbers') and when not to, with specific alternative tools named ('NOT for yes/no delegation decisions — use check_trust instead', 'NOT for rating history — use get_attestations_received'). This is excellent guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
check_trustA
Quick yes/no delegation decision: is this agent trusted enough for my task?
Returns allowed (true/false) with a human-readable reason. Use this when you
only need a go/no-go answer before delegating work.
NOT for detailed analysis — use check_reputation for full score breakdown.
NOT for rating history — use get_attestations_received for peer reviews.
Tiers from lowest to highest: newcomer, basic, trusted, elite.
Advisory signal, not a guarantee.
Read-only. Does not modify any data.
Args:
did: Agent's DID (did:key:z6Mk...).
min_tier: Minimum required tier: "newcomer", "basic", "trusted", "elite". Default "trusted".
task_type: Optional task category for specialized scoring.
Returns:
JSON with allowed (true/false), score, tier, risk_level, and reason.
| Name | Required | Description | Default |
|---|---|---|---|
| did | Yes | Agent's DID to evaluate. Format: did:key:z6Mk... | |
| min_tier | No | Minimum required trust tier. One of: newcomer, basic, trusted, elite. Default: trusted | trusted |
| task_type | No | Optional task category for specialized scoring. Examples: code_quality, task_completion, data_accuracy |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so the description carries full burden. It states 'Read-only. Does not modify any data' and 'Advisory signal, not a guarantee', and explains tier ordering. However, it does not mention error behavior, potential logging, or state changes beyond read-only, leaving minor gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Extremely concise: opens with core purpose, then usage guidelines, tier info, read-only note, and parameter/return sections. Every sentence adds value. No redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the output schema exists (described in Returns), the description covers purpose, usage, parameters, behavior, and return structure. It lacks error handling or rate limit info, but for a simple check tool, this is nearly complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description adds tier ordering context, default value for min_tier, and examples for task_type. It also describes the return format (JSON with allowed, score, tier, risk_level, reason), going beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it provides a 'Quick yes/no delegation decision' and returns 'allowed (true/false) with a human-readable reason'. It distinguishes from siblings by noting 'NOT for detailed analysis — use check_reputation' and 'NOT for rating history — use get_attestations_received', making the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says 'Use this when you only need a go/no-go answer before delegating work' and provides clear exclusion criteria with specific alternative tool names. This is textbook usage guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
controlled_actionA
Run the high-level AVP controlled-action flow.
Returns `ControlledActionOutcome.to_dict()` as a JSON string. Possible
statuses are `executed`, `approval_required`, and `blocked`. Human approval
is never auto-approved; after approval, call `execute_after_approval`.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Action name to evaluate and execute only if Runtime Gate allows it | |
| amount | No | Optional monetary amount for spend-sensitive actions. Omit when not applicable | |
| params | No | Optional execution params as a JSON object string. Default: {} | {} |
| currency | No | Optional ISO currency code for spend-sensitive actions. Example: USD | |
| resource | Yes | Target resource identifier bound into the Runtime Gate decision | |
| environment | Yes | Execution environment. Examples: development, staging, production | |
| delegation_receipt | Yes | DelegationReceipt JSON object string issued by the workflow owner/principal | |
| approval_expires_in_seconds | No | Approval TTL in seconds when Runtime Gate returns WAITING_FOR_HUMAN_APPROVAL |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, but description covers return format (JSON string), possible statuses, and the need for a follow-up call. Doesn't address rate limits or auth, but sufficient for basic behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four sentences, front-loaded with purpose, concise and no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 8 params, 100% schema coverage, and existence of output schema, the description explains the flow, statuses, and follow-up. Still some room for more detail on return format.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description adds no extra parameter details beyond the schema, but provides overall context for delegation_receipt and params.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it runs the 'controlled-action flow,' specifies the return format and possible statuses, and distinguishes from siblings like execute_after_approval.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit guidance: human approval is never auto-approved, and after approval call execute_after_approval. Provides clear context for when to use this tool versus its sibling.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
deny_actionB
Deny a pending human approval request and return signed receipt JCS plus sha256.
| Name | Required | Description | Default |
|---|---|---|---|
| reason | No | Optional denial reason recorded with the signed denial receipt | |
| approval_id | Yes | Human approval request id returned as approval.approval_id |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It indicates the tool mutates state (denying a request) and returns a receipt, but it does not disclose side effects, required permissions, irreversibility, or error conditions. The description is insufficient for an agent to fully understand the tool's behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that front-loads the main action and return values. It is concise and contains no filler, though it could be slightly more structured by separating action from return value details. It efficiently communicates the core purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has an output schema and relatively simple semantics, the description is moderately complete. It covers the action and return values, but it does not explain how this tool fits into a workflow with siblings like 'approve_action' or 'controlled_action', nor does it clarify what 'pending' implies about the request's state.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage, so the schema already documents both parameters. The description adds no additional meaning beyond what the schema provides. According to the guidelines, with high schema coverage, a baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Deny') and the resource ('pending human approval request'), and specifies the return value ('signed receipt JCS plus sha256'). This distinguishes it from its sibling 'approve_action' and provides a clear, specific purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for denying a pending request, which provides basic context. However, it lacks explicit guidance on when to use it versus alternatives, prerequisites, or conditions like whether the request must be in a specific state. The phrase 'pending' hints at the context but is not detailed enough.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
execute_after_approvalB
Resume a controlled action after principal approval.
The approval payload key is `approval_id`. This tool deliberately passes
that key through to `AVPAgent.execute_after_approval(...)`.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Action name bound to the Runtime Gate decision | |
| params | No | Optional execution params as a JSON object string. Default: {} | {} |
| audit_id | Yes | Runtime Gate audit_id from the WAITING_FOR_HUMAN_APPROVAL decision | |
| resource | Yes | Resource identifier bound to the Runtime Gate decision | |
| approval_id | Yes | Approved human approval id. Use approval.approval_id, not approval.id | |
| environment | Yes | Execution environment bound to the Runtime Gate decision |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It only mentions passing through the approval key, omitting side effects, error conditions, or idempotency. Minimal behavioral disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short, direct sentences with no fluff. Purpose is front-loaded and every word adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite an output schema being present, the description fails to explain what the tool returns or any execution context. Lacks guidance on error handling or confirmation of success.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has 100% coverage with descriptions for all 6 parameters, so description adds negligible value. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states it resumes a controlled action after approval, referencing the approval payload key. Distinguishes itself from siblings like 'approve_action' or 'controlled_action' by specifying the resume behavior.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies usage for resuming after approval but lacks explicit when-to-use vs. alternatives or exclusions. No mention of when not to use or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_agent_infoA
Get public profile information about a registered AI agent.
Returns display name, verification status, capabilities, and provider.
Use this when you already have a specific DID and need profile data.
For trust assessment, use check_reputation or check_trust instead.
For rating history, use get_attestations_received.
To find agents by capability, use search_agents.
Read-only — does not affect reputation or any stored data.
Args:
did: The agent's DID (did:key:z6Mk...).
Must be a registered agent on the AVP network.
Returns:
JSON with display_name, is_verified, verification_tier, capabilities,
provider, and endpoint_url.
Returns {"error": "Agent not found"} if DID is not registered.
| Name | Required | Description | Default |
|---|---|---|---|
| did | Yes | Agent's DID to look up. Format: did:key:z6Mk... Must be a registered agent |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description directly states 'Read-only — does not affect reputation or any stored data,' which fully discloses the non-destructive nature. It also explains the return format and error case, providing complete behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured into clear sections: purpose, usage guidance, alternatives, behavioral note, parameters, and return values. Every sentence adds value, no fluff, and it is appropriately concise for the tool's simplicity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (1 parameter, no annotations, no output schema but returns described), the description is fully complete. It covers when to use, what it does, behavioral impact, parameter details, return format, and error handling.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with a basic description for 'did'. The description adds meaningful context: format requirement ('did:key:z6Mk...') and validation condition ('Must be a registered agent on the AVP network'), improving over the schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Get public profile information about a registered AI agent.' It specifies the verb 'Get' and the resource 'public profile information', distinguishing it from siblings by listing alternatives for other needs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'Use this when you already have a specific DID and need profile data.' It also provides clear when-not-to-use guidance and names specific sibling tools (check_reputation, get_attestations_received, search_agents) for alternative actions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_approval_requestB
Fetch a human approval request visible to the local agent identity.
| Name | Required | Description | Default |
|---|---|---|---|
| approval_id | Yes | Human approval request id returned as approval.approval_id |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must fully convey behavior. It only states it fetches a request visible to the local agent identity, but omits details like whether the request is removed after fetching, permissions needed, or any side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, concise sentence that front-loads the key information. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple fetch tool with an output schema, the description is somewhat complete but lacks usage guidance. It does not explain what the return object contains, though the output schema may cover that.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with a well-described parameter (approval_id). The description does not add extra meaning beyond the schema, but per guidelines, baseline is 3 for high coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action (fetch) and resource (human approval request), and distinguishes it from sibling tools like approve_action or deny_action which modify approvals.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus siblings (e.g., approve_action, execute_after_approval). The description provides no context about typical use cases or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_attestations_receivedA
Get peer ratings (attestations) received by an agent — who rated them and how.
Returns individual ratings from other agents: who gave them, positive/negative,
weight, and context. Use this to understand the evidence behind a score.
NOT for protocol-level events — use get_audit_trail for registration, disputes, transfers.
NOT for the computed score — use check_reputation for the final number.
Read-only. Does not affect reputation or stored data.
Args:
did: Agent's DID (did:key:z6Mk...) to look up ratings for.
Returns:
JSON list of attestations (newest first) with from_agent_did,
outcome, weight, context, and created_at.
| Name | Required | Description | Default |
|---|---|---|---|
| did | Yes | Agent's DID to look up ratings for. Format: did:key:z6Mk... |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description states 'Read-only. Does not affect reputation or stored data', which is a key behavioral trait. Since no annotations were provided, the description fully covers the safety profile and ordering ('newest first').
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with clear sections: purpose, what is returned, exclusions and alternatives, read-only note, arguments, and returns. Every sentence adds value, and it is appropriately concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the output schema exists (context signals indicate has output schema), the description still explains return fields (from_agent_did, outcome, weight, context, created_at) and ordering. It covers purpose, usage, behavior, and parameter fully.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already describes the 'did' parameter with 100% coverage. The description's 'Args' section adds a format example ('did:key:z6Mk...') and context, providing useful but not essential extra meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it gets peer ratings (attestations) received by an agent and explains what is returned (individual ratings with who gave them, outcome, weight, context). It differentiates from siblings by explicitly saying what it is NOT for and naming alternative tools (get_audit_trail, check_reputation).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit when-to-use ('Use this to understand the evidence behind a score') and when-not-to-use ('NOT for protocol-level events... NOT for the computed score') with direct references to alternative tools (get_audit_trail, check_reputation).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_audit_trailA
Get the tamper-evident audit trail: every protocol action by this agent.
Returns hash-chained events: registration, card publications, disputes,
job actions. Each entry links cryptographically to the previous one.
Use this for compliance, due diligence, or dispute evidence.
NOT for peer ratings — use get_attestations_received for who rated this agent.
Use verify_audit_chain to check integrity of the entire chain.
Read-only. Public data, no authentication required.
Args:
did: Agent's DID (did:key:z6Mk...) to get audit history for.
limit: Maximum entries (1-100). Default 20. Newest first.
Returns:
JSON list of audit entries with action type, timestamp,
target DID, payload, and hash chain reference.
| Name | Required | Description | Default |
|---|---|---|---|
| did | Yes | Agent's DID to get audit history for. Format: did:key:z6Mk... | |
| limit | No | Maximum entries to return, 1-100. Newest first. Default: 20 |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses read-only nature, public data, no authentication, and return format. Minor deduction for not mentioning potential rate limits or error handling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with clear sections: purpose, details, usage, differentiation, parameters. Every sentence adds value, no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the output schema exists, the description sufficiently summarizes return values and covers all essential aspects: purpose, parameters, usage context, and sibling differentiation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, baseline 3. Description adds format hints (did:key:z6Mk...), ordering (newest first), and explicit range for limit, increasing clarity beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb-resource pair ('Get the tamper-evident audit trail') and clearly distinguishes from siblings like get_attestations_received and verify_audit_chain.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use (compliance, due diligence, dispute evidence) and provides direct alternatives for peer ratings and chain integrity checks.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_decision_receiptB
Fetch exact signed DecisionReceipt JCS text and its sha256 digest.
| Name | Required | Description | Default |
|---|---|---|---|
| audit_id | Yes | Runtime Gate audit_id whose signed DecisionReceipt should be fetched |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must fully convey behavior. It only states what is fetched, not side effects, authentication needs, error conditions, or whether it is read-only. As a fetch operation, it is presumably safe, but this is not explicitly stated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One concise sentence with no unnecessary words. All information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one required parameter and an existing output schema, the description is nearly complete. It could briefly explain the purpose of the sha256 digest or the JCS text, but the context of sibling tools makes the function clear.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%—the parameter 'audit_id' is described as 'Runtime Gate audit_id whose signed DecisionReceipt should be fetched'. The tool description adds no new semantics beyond restating the resource. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the action ('Fetch') and specific resource ('exact signed DecisionReceipt JCS text and its sha256 digest'). Differentiates from sibling tools like get_execution_receipt and get_audit_trail by specifying 'DecisionReceipt'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives (e.g., get_execution_receipt, verify_audit_chain). Does not mention prerequisites or context such as after an approval action.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_execution_receiptA
Fetch exact signed ExecutionReceipt JCS text and its sha256 digest.
| Name | Required | Description | Default |
|---|---|---|---|
| receipt_id | Yes | Execution receipt id whose signed ExecutionReceipt should be fetched |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description indicates a read operation ('Fetch') but does not disclose error handling, rate limits, or permission requirements. With no annotations, behavioral transparency is moderate; it confirms the output includes text and a digest, but lacks depth.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, focused sentence of 12 words. It is front-loaded with the action verb and delivers essential information without any redundant or extraneous content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read tool with one parameter and an output schema, the description is largely complete. It states what is fetched and the digest aspect. However, it omits any mention of required preconditions or error states, which slightly reduces completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already fully describes the single parameter ('receipt_id') with a clear description. The tool description adds no additional meaning beyond what the schema provides, so the baseline score of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Fetch') and the specific resource ('signed ExecutionReceipt JCS text and its sha256 digest'), which is precise and unambiguous. It distinguishes itself from sibling tools like 'get_decision_receipt' by specifying the exact receipt type and output format.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like 'get_decision_receipt' or 'get_approval_request'. There are no usage notes, prerequisites, or conditions specified, leaving the agent to infer context solely from the name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_my_agent_infoA
Get YOUR agent's DID, registration status, and reputation — the locally configured agent only.
Call this to verify your own setup before calling submit_attestation or publish_agent_card.
Returns private details (public key, registration state) not available through get_agent_info.
NOT for looking up other agents — use get_agent_info(did) for any agent by DID,
or check_reputation(did) for another agent's trust score.
No parameters. Uses the agent configured via AVP_AGENT_NAME environment variable.
Read-only. Does not modify any data.
Returns:
JSON with did, public_key_hex, is_registered, is_verified,
and current reputation (or "not yet scored").
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Discloses that it returns private details, is read-only, depends on environment variable AVP_AGENT_NAME, and provides full return format. No annotations provided, but description carries the burden well.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-organized with clear sections. A bit verbose but each sentence adds value. Could potentially be condensed slightly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Complete for a zero-parameter tool with output schema. Covers purpose, usage, behavior, return format, and contrasts with siblings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist, so description cannot add parameter-specific semantics. However, it explains why no parameters are needed (uses configured agent). Schema coverage is 100%.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states it retrieves the locally configured agent's DID, registration status, and reputation. Explicitly distinguishes from sibling tools like get_agent_info and check_reputation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit instructions on when to call (before submit_attestation or publish_agent_card) and when not to (for other agents, use get_agent_info or check_reputation). Includes alternative tool names.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_protocol_statsA
Get network-wide aggregate statistics: total agents, attestations, and verified identities.
Call this to answer "how big is the AVP network?" or "is the service active?"
before registering a new agent. Returns counts, not individual agent data.
NOT for individual agents — use check_reputation for a specific agent's score,
or search_agents to find agents by capability.
Read-only. No authentication required. No parameters.
Returns:
JSON with total_agents, total_attestations, verified_agents,
total_cards, and protocol version.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description discloses 'Read-only. No authentication required. No parameters.' and that it returns counts, not individual data. No contradictions, but could mention rate limits or side effects (though none expected).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, well-structured with clear sections: purpose, usage, exclusions, behavioral traits, and return format. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (no params, output schema exists), the description fully explains what it does, when to use, and what it returns. No gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters (0 params) per schema. The description states 'No parameters' which aligns with schema. Baseline 4 per rule for 0 params.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it gets 'network-wide aggregate statistics' and distinguishes from siblings like check_reputation for individual agents and search_agents for finding by capability.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says when to use: to answer 'how big is the AVP network?' or 'is the service active?' before registering an agent. Also states when not to use and provides alternative tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
publish_agent_cardA
Publish or update your agent's capability card for network discovery.
Makes your agent discoverable by other agents using search_agents.
IMPORTANT: This operation is idempotent — calling it again replaces
the previous card entirely. The card becomes publicly visible to all
agents on the network immediately.
Requires a registered agent identity (call register_agent first).
Use search_agents afterward to verify your card is discoverable.
Use get_my_agent_info to check your current registration status.
Side effects: creates or replaces your public capability card.
No effect on other agents' data.
Args:
capabilities: Comma-separated capabilities. At least one required.
Examples: "code_review,security_audit,testing".
provider: LLM provider powering this agent. Helps discovery filtering.
endpoint_url: URL for receiving HTTP requests from other agents.
Returns:
JSON with card details: capabilities list, provider, endpoint,
and confirmation. Returns {"error": "..."} if not registered
or on invalid input.
| Name | Required | Description | Default |
|---|---|---|---|
| provider | No | LLM provider name. Examples: anthropic, openai, google, mistral. Optional | |
| capabilities | Yes | Comma-separated capabilities. Examples: 'code_review,security_audit,testing'. At least one required | |
| endpoint_url | No | HTTP endpoint for agent-to-agent interactions. Example: 'https://my-agent.example.com/api'. Optional |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description fully discloses behavioral traits: idempotent ('calling it again replaces the previous card entirely'), visibility ('publicly visible to all agents on the network immediately'), prerequisites ('Requires a registered agent identity'), side effects ('creates or replaces your public capability card. No effect on other agents.'), and error conditions ('Returns error if not registered or on invalid input'). Meets all transparency needs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately concise (~10 lines) and well-structured: a one-line purpose, followed by discovery benefit, important note, prerequisites, side effects, arguments section, and return value. Every sentence adds value, and key information is front-loaded. No unnecessary repetition or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (3 parameters, 1 required) and the presence of an output schema (described in Returns), the description covers all necessary context: prerequisite steps, behavioral guarantees (idempotent, public visibility), side effects, error cases, and post-use verification. It sufficiently enables an agent to decide when and how to invoke this tool correctly relative to siblings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so description adds minimal value beyond schema. The Args section largely restates schema descriptions (e.g., 'Comma-separated capabilities. At least one required. Examples: ...'). The description provides example values for capabilities and endpoint_url, which adds slight clarity, but does not introduce new semantic constraints or clarify interdependencies. Therefore, a score of 3 is appropriate (baseline for high schema coverage).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Publish or update your agent's capability card for network discovery.' It specifies the verb (publish/update) and resource (capability card). It also distinguishes from sibling tools like register_agent (registration prerequisite) and search_agents (post-publication verification), making its unique role explicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit prerequisites: 'Requires a registered agent identity (call register_agent first).' Advises on post-use verification: 'Use search_agents afterward to verify your card is discoverable. Use get_my_agent_info to check your current registration status.' Also clarifies when not to use by implication (requires registration, idempotent so safe to repeat). No contradictory guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
register_agentA
Register a new AI agent on the Agent Veil Protocol network.
Creates a cryptographic identity (Ed25519 keypair), generates a W3C DID,
and registers the agent. Keys are saved locally to ~/.avp/agents/
with restricted permissions (chmod 0600).
IMPORTANT: Registration is irreversible. The DID becomes the agent's
permanent identifier. Keys cannot be regenerated for the same DID —
keep the local key file safe.
Call this once before using write operations (submit_attestation,
publish_agent_card). Use get_my_agent_info to verify setup afterward.
Side effects: creates local key file, registers agent on the network.
Args:
display_name: Human-readable name (e.g. "Code Reviewer").
If empty, uses AVP_AGENT_NAME environment variable.
Returns:
JSON with the new agent's DID, display_name, registration status,
and local key storage path.
Returns {"error": "..."} if registration fails (network error, name conflict).
| Name | Required | Description | Default |
|---|---|---|---|
| display_name | No | Human-readable name for the agent. Example: 'Code Reviewer'. If empty, uses AVP_AGENT_NAME env var |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description fully discloses side effects (local key file with chmod 0600, network registration), irreversibility, and key regeneration impossibility. This goes well beyond basic purpose.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is well-structured, front-loading purpose, then details, usage, and side effects. Every sentence adds value without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given complexity (identity creation, network registration), the description covers setup prerequisites, side effects, return format, and failure cases. Output schema complements but description is self-sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers the single parameter with description and default. The description repeats the parameter details and environment variable fallback, adding marginal value beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool registers a new AI agent on the Agent Veil Protocol network, detailing the cryptographic identity and DID creation. It distinguishes from sibling tools by positioning it as a one-time setup before write operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly advises calling once before write operations and suggests using get_my_agent_info to verify setup. While it doesn't list when not to use, the context of first-time setup and permanence is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
runtime_evaluate_actionA
Evaluate one proposed action with AVP Runtime Gate.
Returns the Runtime Gate decision payload from AVP. The decision is expected
to be one of ALLOW, WAITING_FOR_HUMAN_APPROVAL, or BLOCK. This tool only
evaluates the action; it does not execute anything and does not intercept
other MCP tool calls.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Action name to evaluate. Examples: deploy.release, infra.volume.delete, payment.transfer | |
| amount | No | Optional monetary amount for spend-sensitive actions. Omit when not applicable | |
| currency | No | Optional ISO currency code for spend-sensitive actions. Example: USD | |
| resource | Yes | Target resource identifier. Examples: service:checkout, volume:vol-123, account:vendor-7 | |
| environment | Yes | Execution environment. Examples: development, staging, production | |
| delegation_receipt | Yes | DelegationReceipt JSON object string issued by the workflow owner/principal |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It discloses the tool is read-only (evaluates, does not execute) and the expected decision values. It does not mention side effects, auth needs, or rate limits, but the overall behavior is transparent enough.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, front-loaded with the core purpose, and every sentence adds necessary context. No redundant words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given there is an output schema (not shown but indicated), the description sufficiently covers the tool's purpose, scope, and decision outcomes. It could mention prerequisites like delegation receipt, but the required parameters already imply that.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema coverage is 100%, so baseline is 3. The description adds value by explaining the overall purpose and that the tool returns a decision payload, but it does not elaborate on individual parameters beyond the schema. Still, the schema descriptions are clear, so the combined effect is good.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool evaluates one proposed action with AVP Runtime Gate and returns a decision (ALLOW, WAITING_FOR_HUMAN_APPROVAL, BLOCK). It distinguishes itself from executing actions, which separates it from sibling tools like execute_after_approval.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states the tool only evaluates, does not execute, and does not intercept other calls, giving clear context for when to use it. However, it lacks explicit when-not-to-use guidance or naming of alternative tools like approve_action or execute_after_approval.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_agentsA
Find AI agents by capability, provider, or minimum reputation score.
Use this to discover available agents for a task before delegation.
Results are sorted by reputation score (highest first).
Combine filters to narrow results.
Use get_agent_info when you already have a specific DID.
Use check_reputation or check_trust to evaluate a found agent.
Read-only — does not modify any data.
Args:
capability: Filter by published capability. Examples:
"code_review", "security_audit", "translation". Empty for all.
provider: Filter by LLM provider. Examples: "anthropic", "openai". Empty for all.
min_reputation: Minimum reputation score (0.0-1.0). Default 0.0 returns all.
limit: Maximum number of results (1-100). Default 10.
Returns:
JSON list of matching agents with DID, display_name, capabilities,
provider, and reputation score. Returns empty list if no matches.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum results to return, 1-100. Default: 10 | |
| provider | No | Filter by LLM provider. Examples: anthropic, openai, google, mistral. Empty returns all | |
| capability | No | Filter by capability. Examples: code_review, security_audit, translation, data_analysis. Empty returns all | |
| min_reputation | No | Minimum reputation score 0.0-1.0. Set 0.5+ to exclude unproven agents. Default: 0.0 |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
States 'Read-only — does not modify any data.' and 'Results are sorted by reputation score (highest first).' This adds value beyond schema, though could mention more about execution context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured: headline, usage context, sorting, read-only note, then parameter and return descriptions. No fluff, front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With output schema present, description still details return fields. Covers all parameters, differentiates from siblings, and provides enough for a search tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Despite 100% schema coverage, description adds examples for capability and provider (e.g., 'code_review', 'anthropic') and explains min_reputation with a practical suggestion ('Set 0.5+ to exclude unproven agents'). Enriches understanding beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Find AI agents by capability, provider, or minimum reputation score.' It specifies the verb (Find) and resource (AI agents), and distinguishes from siblings like get_agent_info and check_reputation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly tells when to use: 'Use this to discover available agents for a task before delegation.' Provides alternatives: 'Use get_agent_info when you already have a specific DID. Use check_reputation or check_trust to evaluate a found agent.'
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
submit_attestationA
Submit a peer attestation (rating) for another agent after an interaction.
Records your evaluation of another agent's performance. This is the
primary mechanism for building reputation on the network.
IMPORTANT: Attestations are cryptographically signed and immutable —
they cannot be modified or deleted after submission. Use the dispute
system to contest unfair ratings received.
Side effects: permanently modifies the target agent's attestation
history and may change their computed reputation score.
Requires a registered agent identity (call register_agent first).
Self-attestation (rating yourself) is blocked.
Args:
to_did: DID of the agent being rated (did:key:z6Mk...).
outcome: Must be "positive", "negative", or "neutral".
weight: Confidence (0.0-1.0). Default 0.9.
context: Interaction type for category-specific scoring. Empty for general.
Returns:
JSON with attestation ID, signature confirmation, and effective weight.
Returns {"error": "Rate limited"} if limits exceeded.
Returns {"error": "..."} on invalid input or network errors.
| Name | Required | Description | Default |
|---|---|---|---|
| to_did | Yes | DID of the agent being rated. Format: did:key:z6Mk... Cannot be your own DID | |
| weight | No | Confidence in this rating, 0.0-1.0. Higher = more impact on target's score. Default: 0.9 | |
| context | No | Interaction type. Examples: code_review, task_completion, data_accuracy. Empty for general | |
| outcome | No | Rating: 'positive' (performed well), 'negative' (performed poorly), or 'neutral' (no strong signal) | positive |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses immutability, cryptographic signing, side effects (permanently modifies history and reputation), blocked self-attestation, requirement for prior registration, and potential error responses. This is comprehensive for a tool with no annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with clear sections: summary, importance caveat, side effects, prerequisites, blocked actions, bulleted argument list, and return value specification. It is concise yet complete, with no unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 4 parameters, 100% schema coverage, presence of output schema (described), and 19 sibling tools, the description covers all needed aspects: purpose, usage constraints, side effects, prerequisites, error handling, and return format. It is fully informative for agent invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, but the description adds significant value: for 'outcome' it repeats allowed values; for 'weight' clarifies confidence impact; for 'context' provides examples; and it documents return values and error cases not in the schema. This goes beyond the schema's basic descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Submit a peer attestation (rating) for another agent after an interaction.' It uses a specific verb (submit) and resource (attestation), and distinguishes from sibling tools like check_reputation and get_attestations_received by explaining its role as the primary reputation-building mechanism.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says to use this after an interaction and warns against self-attestation. It implies the dispute system for contesting ratings but does not explicitly name alternative tools for specific cases (e.g., reading reputation). This is clear context but lacks explicit exclusions for all alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verify_audit_chainA
Verify the cryptographic integrity of AVP's immutable audit trail.
Checks that no audit entries have been tampered with by verifying
the SHA-256 hash chain from genesis to the latest entry.
Use this before relying on audit data for compliance or dispute resolution.
For an individual agent's audit history, use get_audit_trail instead.
Read-only — no authentication required. Safe to call at any time.
Returns:
JSON with is_valid (true/false), total_entries count, latest_hash,
and verification timestamp. is_valid=false means tampering detected.
Returns {"error": "..."} on network errors.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Despite no annotations, the description fully discloses behavior: read-only, no authentication required, safe to call anytime. It explains what the tool checks (SHA-256 hash chain) and describes return values including possible error cases.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, well-structured, and front-loaded. Each sentence adds value, covering purpose, mechanism, usage, safety, and return format without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless tool with an output schema, the description is complete. It explains the return values and error handling, and covers behavioral context. No gaps remain.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero parameters and 100% coverage, so the description needs to add no param info. Baseline is 3, and the description does not add param semantics beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: verifying cryptographic integrity of the audit trail using SHA-256. It distinguishes from the sibling tool 'get_audit_trail' by noting the difference in scope (entire chain vs. individual agent history).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly advises use before relying on audit data for compliance or dispute resolution. Also provides an alternative: use 'get_audit_trail' for individual agent audit history.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
8 tool updates
v0.7.15- Added
approve_action - Added
controlled_action - Added
deny_action - Added
execute_after_approval - Added
get_approval_request - Added
get_decision_receipt - Added
get_execution_receipt - Added
runtime_evaluate_action
12 tool updates
v0.1.1- Added
check_reputation - Added
check_trust - Added
get_agent_info - Added
get_attestations_received - Added
get_audit_trail - Added
get_my_agent_info - Added
get_protocol_stats - Added
publish_agent_card - Added
register_agent - Added
search_agents - Added
submit_attestation - Added
verify_audit_chain
11 tool updates
- Removed
check_reputation - Removed
get_agent_info - Removed
get_attestations_received - Removed
get_audit_trail - Removed
get_my_agent_info - Removed
get_protocol_stats - Removed
publish_agent_card - Removed
register_agent - Removed
search_agents - Removed
submit_attestation - Removed
verify_audit_chain
11 tool updates
- First observed
check_reputation - First observed
get_agent_info - First observed
get_attestations_received - First observed
get_audit_trail - First observed
get_my_agent_info - First observed
get_protocol_stats - First observed
publish_agent_card - First observed
register_agent - First observed
search_agents - First observed
submit_attestation - First observed
verify_audit_chain
TDQS
Each tool has a clearly distinct purpose with detailed descriptions that explicitly contrast with similar tools (e.g., check_reputation vs check_trust, get_agent_info vs get_my_agent_info). There is no ambiguity between tools.
All tools consistently use snake_case with a verb-first pattern (e.g., approve_action, check_reputation, submit_attestation). There is no mixing of conventions or inconsistent verb styles.
With 20 tools covering registration, reputation, attestations, audit, agent discovery, and action approval, the count is well-scoped for the protocol's domain. Each tool serves a distinct and necessary function without redundancy.
The tool set covers major workflows: registration, profile publication, reputation assessment, attestations, audit trail, and controlled actions. A minor gap is the lack of a dedicated dispute tool mentioned in submit_attestation, but the set still feels comprehensive for most use cases.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Trust infrastructure for AI agents. Portable reputation (JTS 0-5), agent discovery, vouching.
Agent reputation registry: check, register, and endorse AI agents
Trust infrastructure for AI agents: read a verifiable Trust Rating, claim an identity, earn a badge.
On-chain ERC-8004 agent registry. Search, register, and check reputation across 16 chains.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceAgent network intelligence for trust verification, broker discovery, and capability matching. Ed25519 identity, graph-based trust scoring, USDC payments, and MCP tools for agent registration, search, and trust attestation.1,4985MIT
- AlicenseAqualityBmaintenanceAI agent identity and reputation registry. Ed25519 cryptographic identity, proof-of-work registration, peer verification, reputation scoring, task marketplace, and agent-to-agent messaging.1614Apache 2.0
- AlicenseAqualityAmaintenanceEnterprise AI governance layer for spend tracking, runtime guardrails, policy enforcement, and budget limits. Connects Claude, ChatGPT, and any MCP client to ThinkNEO's control plane for SOC2/GDPR/HIPAA compliance monitoring and real-time provider health.83Apache 2.0
- AlicenseAqualityCmaintenanceCryptographic accountability for AI agents. Ed25519-signed receipts for every MCP tool call. Constraints, chains, AI judgment, invoicing, and local dashboard included.24131MIT
Appeared in Searches
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/agentveil-protocol/agentveil-sdk'
If you have feedback or need assistance with the MCP directory API, please join our Discord server