arifOS MCP Server
The arifOS MCP Server is a constitutional AI governance kernel that enforces 13 ethical/legal floors across an AI agent's full lifecycle — from observation and reasoning to execution and immutable auditing. Key capabilities include:
Session Management (
arif_session_init): Initialize, resume, or validate epoch-based governed sessions that bind actor identity to the 13-floor constitution.Web Search & Observation (
arif_sense_observe): Search the web, ingest URLs, check system vitals, map repositories, and gather raw observational data.Evidence Fetching (
arif_evidence_fetch): Retrieve and preserve external evidence with source citations, confidence scoring, and cryptographic verification.Constitutional Reasoning (
arif_mind_reason): Multi-step reasoning, claim verification, plan generation, adversarial critique, and reflection — evaluated against constitutional axioms.Ethical Risk Assessment (
arif_heart_critique): Assess ethical risks, human impact, empathy scores, simulate what-if scenarios, red-team proposals, and check for dignity violations.Intent Routing & Orchestration (
arif_kernel_route,arif_route,arif_triage): Route intents to the correct federation organ or tool, perform preflight constitutional checks, and triage tasks through the 000→999 pipeline.Federation Bridging (
arif_bridge_connect,arif_gateway_connect): Connect to other federation organs (GEOX, WEALTH, WELL, A-FORGE, AAA) for multi-agent coordination via verified handshakes.Constitutional Judgment (
arif_judge_deliberate): Render binding verdicts (SEAL / HOLD / VOID / SABAR) against all 13 floors — required before any irreversible execution.Execution (
arif_forge_execute): Execute approved builds, deployments, or system changes only after a SEAL verdict from the judge tool.Immutable Audit Ledger (
arif_vault_seal): Seal verdicts and outcomes to an append-only, hash-chained VAULT999 ledger for permanent, verifiable records.Memory & History (
arif_memory_recall): Recall past session decisions, retrieve sealed events, and perform multi-hop RAG queries across the memory stack.Response Composition (
arif_reply_compose): Draft constitutionally compliant responses with tone control, citations, and scoring for truth (F2), clarity (F4), empathy (F6), and humility (F7).Kernel Health & Telemetry (
arif_kernel_health,arif_kernel_status,arif_ops_measure): Check live kernel health, query thermodynamic state (entropy ΔS, genius score G, human impact Ω), and estimate resource costs.Attestation (
arif_kernel_attest): Verify identity, tool surface, and constitutional binding for federation organs.Conformance Testing (
arif_conformance_report): Run the ARIF Conformance Spine to get pass/fail verdicts for transport, session, and governance checks.Transport Diagnostics (
arif_ping,arif_schema_echo,arif_transport_echo,arif_version_echo,arif_initialize_probe): Zero-floor canary tools for testing connectivity, debugging transport payloads, and simulating MCP handshakes.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@arifOS MCP ServerBegin a new constitutional session."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
arifOS — Constitutional AI Governance Kernel
Separates judgment from execution for regulated AI deployment.
Enterprises deploying AI at scale face a critical gap: agents that act are also certifying their own actions. Without an independent authority to evaluate proposals against safety, compliance, and policy constraints before execution, organizations risk regulatory violations, data breaches, and untraceable decisions. arifOS solves this by acting as a constitutional judge — evaluating every consequential AI action against 13 immutable policy floors and returning a verdict before any execution occurs.
Forged, Not Given.
Architecture
┌─────────────────────────────────────────┐
│ arifOS Kernel (:8088) │
│ ┌───────────────────────────────────┐ │
User Intent ─────▶│ │ 13 Constitutional Floors (F1-F13) │ │──▶ SEAL / HOLD / SABAR / VOID
│ │ State Observation & Gap Detection │ │
│ │ VAULT999 Append-Only Ledger │ │
│ └───────────────────────────────────┘ │
└─────────────┬───────────────────────────┘
│
┌───────────────────┼───────────────────┐
│ │ │
▼ ▼ ▼
┌──────────────┐ ┌──────────────┐ ┌──────────────┐
│ SEAL │ │ HOLD │ │ VOID │
│ │ │ │ │ │
│ A-FORGE │ │ Human Review│ │ Blocked │
│ Executes │ │ Approves │ │ by Floor │
└──────┬───────┘ └──────────────┘ └──────────────┘
│
▼
┌──────────────┐
│ VAULT999 │ 67K+ immutable records
│ Audit Log │ append-only, zero gaps
└──────────────┘The judge never executes. The executor never certifies.
Related MCP server: acf-mcp
Quick Start
Docker
docker run -d --name arifos \
-p 8088:8088 \
-v $(pwd)/data:/app/data \
arifos/kernel:latestHealth Check
curl http://localhost:8088/healthMCP Connection
# Connect via MCP endpoint
mcp connect http://localhost:8088/mcpCore Features
13 Constitutional Floors (F1–F13)
Every proposal is evaluated against a chain of 13 policy constraints spanning safety, reversibility, scope, authority, evidence, and governance. A single floor failure produces a VOID verdict — no action proceeds until the constraint is resolved.
Four Verdict Types
Verdict | Meaning |
SEAL | Authorized under stated conditions |
HOLD | Insufficient evidence or human approval required |
SABAR | Proceed with caution — partial authorization |
VOID | Blocked by a constitutional floor |
VAULT999 — Immutable Audit Ledger
Every verdict, evidence chain, and execution receipt is recorded in VAULT999 — an append-only JSONL ledger currently holding 67,000+ records with zero broken lines. Designed for compliance auditing, forensic review, and regulatory proof of governance.
MCP Interface
The kernel exposes 8 MCP verbs over /mcp (and /webmcp locally on :8088). No public console — programmatic access only.
Federation Topology
The arifOS Federation comprises 7 organs, each with a distinct responsibility:
Organ | Port | Responsibility |
arifOS | :8088 | Law — constitutional judgment |
AAA | :3001 | Routing — intelligence & task orchestration |
A-FORGE | :7071/:7072 | Execution — hands that build and act |
GEOX | :8081 | Earth sciences — geospatial reasoning |
WEALTH | :18082 | Capital management — financial operations |
WELL | :18083 | Biometric & health — vitality monitoring |
arifFlow | :7073 | Orchestration — workflow coordination |
ARIF vetoes. arifOS judges. AAA routes. A-FORGE executes.
MCP Verbs Reference
Verb | Purpose |
| Establish session context, actor identity, and constraints |
| State observation & gap detection — inspect current conditions |
| Constitutional reasoning against floors before judgment |
| Route intent to the appropriate federation organ |
| Query and manage institutional memory |
| Evaluate a proposal and return a verdict (SEAL/HOLD/SABAR/VOID) |
| Dispatch authorized actions to A-FORGE for execution |
| Seal a completed action chain with full evidence and receipt |
Sister Repositories
Repository | Description |
Intelligence, routing, and multi-agent orchestration | |
Execution engine — containerized task execution | |
Geospatial and earth sciences reasoning organ | |
Capital management and financial operations organ | |
Biometric monitoring and health management organ | |
Workflow orchestration and pipeline management |
Documentation
Federation Card — Full organ topology and relationships
Full README Reference — Complete feature documentation
Constitution — Constitutional floors and doctrine
ZEN Doctrine — Governance philosophy and design principles
License
AGPL-3.0 — This software is licensed under the GNU Affero General Public License v3.0. See LICENSE for details.
When deployed over a network, the complete source code must be made available to all users interacting with the service, consistent with AGPL-3.0 terms.
Available Tools
11 toolsarif_bridge_connect444 Bridge · Direct Organ (HIGH)AInspect
KERNEL 444-direct · Low-level organ call (organ + tool_name required). Bypasses intent routing. Authority: HIGH / lease — often 888_HOLD for anonymous. Agents should prefer arif_route (same reach, safer default). Not a generic MCP proxy; only federation organs under kernel envelope.
| Name | Required | Description | Default |
|---|---|---|---|
| organ | Yes | "geox" | "wealth" | "well" | "geox" (case-insensitive) | |
| actor_id | No | Calling actor (injected into envelope) | |
| _envelope | No | ||
| arguments | No | Tool arguments dict | |
| tool_name | Yes | MCP tool name on the target organ | |
| session_id | No | Governing session |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations provide basic safety hints (non-destructive, non-idempotent, read-write). The description adds context about authority levels (HIGH / lease) and that it bypasses intent routing, which is valuable. However, it does not elaborate on potential side effects or consequences of misuse beyond these points, so not fully exhaustive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very concise—four sentences. It is front-loaded with the kernel identifier and key purpose, and every sentence adds essential information without redundancy. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 6 parameters, 2 required, high schema coverage, and an output schema, the description adequately covers purpose, usage guidelines, and key constraints. It does not explain return values, but the output schema exists. Minor gap: no mention of error cases or expected behavior when parameters are missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is high (83%), so the baseline is 3. The description reinforces that organ and tool_name are required, but does not add new details about other parameters like actor_id, arguments, or session_id beyond what the schema provides. No parameter-specific guidance is given.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: a low-level, direct organ call that bypasses intent routing, requiring organ and tool_name. It distinguishes itself from the sibling tool arif_route, which is the safer default. The description is specific and actionable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly advises agents to prefer arif_route instead, providing clear when-to-use and when-not-to-use guidance. This directly addresses the decision between this tool and its alternative, making it highly helpful for selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
arif_composeCompose · Kernel ReplyARead-onlyIdempotentInspect
KERNEL reply · Final human-facing composition (citations, tone, ΔS≤0). Call LAST after observe/think/judge — not mid-pipeline. Authority: L0–L1. Modes: compose | summarize | cite | tone_shift | style | format. Not a substitute for arif_judge or arif_seal.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | compose | |
| style | No | ||
| message | No | ||
| actor_id | No | ||
| language | No | en | |
| _envelope | No | ||
| citations | No | ||
| session_id | No | ||
| session_token | No | ||
| ai_involvement | No | full |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnlyHint, idempotentHint, destructiveHint. The description adds significant behavioral context: it is a 'final human-facing composition' with a ΔS≤0 constraint (no state change), and it supports multiple modes. There is no contradiction; the description enriches transparency beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short and front-loaded with key information. It uses jargon like 'ΔS≤0' that may be obscure but is concise. Every sentence adds value. Minor deduction for the jargon density.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 10 parameters and an output schema exists (not shown), the description covers overall purpose and pipeline position but lacks parameter documentation. It is adequate for understanding when to use the tool but insufficient for parameter-level decisions without the schema. The output schema may compensate, but description doesn't reference it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It mentions modes and style but introduces 'format' and 'style' as modes not present in the enum (schema lacks 'style' and 'format' as enum values, though style is a separate parameter). Other parameters (message, actor_id, language, etc.) are not explained at all. This inconsistency and lack of detail limit its helpfulness.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states the tool's purpose: 'Final human-facing composition' and positions it as the last step in a pipeline ('Call LAST after observe/think/judge'). It lists specific capabilities (citations, tone, ΔS≤0) and modes, clearly distinguishing it from siblings like arif_judge and arif_seal.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit guidance on when to call ('LAST after observe/think/judge') and when not to ('not mid-pipeline'). It also states what the tool is not a substitute for (arif_judge, arif_seal), providing clear exclusion criteria. This helps the agent select the correct tool in the pipeline.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
arif_critique555 Critique · HeartARead-onlyIdempotentInspect
KERNEL 555 · Heart — ethical/dignity/risk stress before judgment (not SEAL). Select when blast_radius MEDIUM+, human/dignity impact, or irreversible risk. Requires non-empty target (proposal/plan text). Authority: L1. Modes: critique | redteam | maruah | deescalate | empathize | simulate | instruction_scan. Returns: risk, floors, human impact. Skip pure technical with zero human stake. Binding verdict → arif_judge.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | critique | |
| target | No | ||
| actor_id | No | ||
| _envelope | No | ||
| session_id | No | ||
| session_token | No | ||
| evidence_receipt | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint false, which the description does not contradict. The description adds beyond annotations: requires non-empty target, lists return types (risk, floors, human impact), and describes modes. However, it does not detail behavioral variations across modes, keeping a score of 4.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single dense paragraph that front-loads purpose and usage. It packs substantial information without excessive verbosity, though it could be better structured with separation of modes and return types.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 7 parameters (all optional, mostly metadata), no required params, and existence of output schema, the description covers core aspects: purpose, selection criteria, modes, requirements, and return types. Minor inconsistencies (mode list) and missing details on non-core parameters prevent a 5.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description provides partial meaning for 'mode' and 'target' but contains inaccuracies: lists modes like 'simulate' and 'instruction_scan' not in schema enum, and omits 'shadow' and 'empathy'. Also states target is required but schema allows null default. With 0% schema coverage, the description poorly compensates.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool performs ethical/dignity/risk stress testing before judgment, distinguishing it from SEAL. It specifies the conditions for selection (blast_radius MEDIUM+, human/dignity impact, irreversible risk) and names a sibling tool (arif_judge) for binding verdict.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use (blast_radius MEDIUM+, human/dignity impact, irreversible risk) and when to skip (pure technical with zero human stake). Also mentions authority level L1 and available modes, providing clear context for agent decision.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
arif_forge777 Forge · Execute GateCDestructiveInspect
KERNEL 777 · Execution gate via A-FORGE (hands, not law). Mutates only after arif_judge SEAL + lease/chain IDs — no self-authorize. Authority: 888_HOLD without SEAL. Modes include dry_run | engineer | query | write. Public execution verb (arif_act is internal alias only). Skip while still planning (arif_think) or without judge SEAL.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | engineer | |
| query | No | ||
| plan_id | No | ||
| actor_id | No | ||
| manifest | No | ||
| _envelope | No | ||
| session_id | No | ||
| arif_ack_id | No | ||
| artifact_id | No | ||
| vault_entry_id | No | ||
| seal_verdict_id | No | ||
| ack_irreversible | No | ||
| judge_state_hash | No | ||
| approved_action_hash | No | ||
| constitutional_chain_id | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate destructiveHint=true. Description adds that mutation only occurs after judge SEAL and lease/chain IDs, and mentions modes. However, terms like '888_HOLD without SEAL' are undefined, reducing clarity.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short but dense with jargon. It attempts to be concise but sacrifices clarity. Key information is present but poorly structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having an output schema, the description does not explain what the tool returns or how parameters like 'seal_verdict_id' or 'approved_action_hash' relate to the judge workflow. Given the complexity (15 params, destructive behavior, sibling tools), the description is insufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description adds very little about the 15 parameters. Only 'mode' enum values are mentioned in passing. This is insufficient for an agent to correctly use the tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses cryptic jargon like 'KERNEL 777', 'A-FORGE', and '888_HOLD' without plain-language explanation. It vaguely indicates it's an execution gate requiring judge seal, but the core purpose is unclear for an AI agent.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides some guidance: skip without judge SEAL or while still planning (arif_think). However, it doesn't explicitly state when to use this tool vs siblings like arif_judge or arif_think, leaving ambiguity.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
arif_init000 Init · Kernel SessionAIdempotentInspect
KERNEL 000 · Session ignition — not a helper app. Binds actor, floors, and audit before any other arif_* verb can govern. Without session_id, kernel treats you as anonymous (OBSERVE_ONLY / SYUBHAH). Authority: pre-session open; light/init mint session_id + authority band. Modes: ping | light | init | resume | validate | epoch_open | epoch_seal | canary | preflight | triage. Returns: session_id, actor_verified, authority, allowed_next_verbs, next_tool. Skip when live session already bound → arif_triage; pure facts only → arif_observe.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | init | |
| nonce | No | ||
| intent | No | ||
| context | No | ||
| payload | No | ||
| tooling | No | ||
| verbose | No | ||
| actor_id | No | ||
| epoch_id | No | ||
| evidence | No | ||
| trace_id | No | ||
| _envelope | No | ||
| session_id | No | ||
| agent_policy | No | ||
| counterparty | No | ||
| sovereign_id | No | ||
| actor_signature | No | ||
| caller_actor_id | No | ||
| delegation_mode | No | ||
| idempotency_key | No | ||
| ack_irreversible | No | ||
| executor_actor_id | No | ||
| declared_model_key | No | ||
| client_capabilities | No | ||
| requested_authority | No | OBSERVE_ONLY | |
| previous_session_hash | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations provide idempotentHint and destructiveHint. The description adds context: binds actor/floors/audit, mints session_id and authority band, and describes anonymous mode without session. Good additional insight.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense with jargon but front-loaded with core purpose. Could be more concise; multiple concepts packed into a single paragraph.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 26 undocumented parameters and no formal output schema, the description lists return fields but lacks explanations for most parameters. Incomplete for a complex initialization tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 26 parameters with 0% description coverage. The description only lists some modes but misses two enum values (opt_out, opt_out_profiling) and does not explain other parameters like nonce, intent, context, etc. Insufficient compensation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states that this tool initiates a kernel session, binds actor, floors, and audit, and is required before other arif_* verbs. It distinguishes from siblings by noting when to use arif_triage or arif_observe instead.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use (before other arif_* verbs, if no session) and when not to use (live session bound → arif_triage; pure facts only → arif_observe). Provides clear alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
arif_judge888 Judge · VerdictARead-onlyInspect
KERNEL 888 · Constitutional verdict — only organ that SEAL/HOLD/SABAR/VOIDs. Not advice; binding arbitration of floors + authority. Authority: 888_HOLD / SOVEREIGN session required for real adjudicate. REQUIRES: actor, intent, domain, reversibility_level, blast_radius (+ evidence). Modes: judge | compare | history | explain | floor_status | witness_consensus. Skip if evidence incomplete → arif_observe; plan incomplete → arif_think; reversible low-risk advisory only.
| Name | Required | Description | Default |
|---|---|---|---|
| actor | Yes | ||
| domain | Yes | ||
| intent | Yes | ||
| actor_id | No | ||
| evidence | No | ||
| _envelope | No | ||
| session_id | No | ||
| measurement | No | ||
| blast_radius | Yes | ||
| session_token | No | ||
| authority_token | No | ||
| epistemic_state | No | UNKNOWN | |
| reversibility_level | Yes | ||
| requested_capability | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Description claims binding arbitration and state-changing actions (SEAL/HOLD/SABAR/VOIDs), contradicting the readOnlyHint=true annotation. This is a serious inconsistency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is dense and front-loaded with core purpose, but uses cryptic jargon (KERNEL 888, floors, SABAR) that may confuse agents. Not optimally concise for AI consumption.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers core concept, modes, prerequisites, and alternatives, but lacks explanation of cryptic terms and some parameters. Adequate given output schema exists, but could be more comprehensive.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Description adds meaning to key required parameters (actor, intent, domain, etc.) and mentions evidence, but many parameters (actor_id, session_id, etc.) are left unexplained. With 0% schema coverage, more detail would be beneficial.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool is for constitutional verdict and binding arbitration, with specific verbs like SEAL/HOLD/SABAR/VOIDs. It distinguishes from siblings by naming alternative tools for incomplete evidence or plans.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states required parameters (actor, intent, domain, etc.) and provides clear when-to-use guidance by directing to siblings when evidence or plan is incomplete, or for low-risk advisory.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
arif_memoryMemory Governor · KernelBDestructiveInspect
KERNEL memory governor · L1–L6 stack under F1/F2/F4/F11 (not a free notepad). Recall/inspect free-ish; remember/promote/revise/forget are J-space mutations. Authority: recall L0; writes gated. Modes: recall | inspect | attest | remember | promote | revise | forget. Skip ephemeral one-off facts.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | recall | |
| tier | No | ||
| query | No | ||
| scope | No | ||
| top_k | No | ||
| aspect | No | ||
| hybrid | No | ||
| policy | No | ||
| cascade | No | ||
| content | No | ||
| include | No | ||
| payload | No | ||
| seal_id | No | ||
| to_tier | No | ||
| actor_id | No | ||
| lease_id | No | ||
| metadata | No | ||
| trace_id | No | ||
| _envelope | No | ||
| from_tier | No | ||
| memory_id | No | ||
| tier_hint | No | ||
| timestamp | No | ||
| provenance | No | ||
| redact_pii | No | ||
| session_id | No | ||
| structured | No | ||
| graph_first | No | ||
| new_content | No | ||
| truth_class | No | ||
| caller_chain | No | ||
| memory_class | No | ||
| policy_basis | No | ||
| embedding_ref | No | ||
| include_proof | No | ||
| session_token | No | ||
| vault_version | No | ||
| human_approval | No | ||
| new_structured | No | ||
| temporal_as_of | No | ||
| tombstone_text | No | ||
| idempotency_key | No | ||
| new_truth_class | No | ||
| resolution_kind | No | ||
| source_receipts | No | ||
| correction_event | No | ||
| promotion_reason | No | ||
| include_contested | No | ||
| progressive_level | No | ||
| require_human_ack | No | ||
| time_window_hours | No | ||
| organ_staleness_band | No | ||
| supersedes_memory_id | No | ||
| minimised_vault_record | No | ||
| required_floors_satisfied | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond annotations (destructiveHint true), the description adds that recall/inspect are free-ish and writes are gated mutations. It mentions authority and tiers. However, it does not explain what 'J-space mutations' entail, rate limits, or what exactly gets destroyed, leaving some ambiguity.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise (4 sentences) and front-loaded with the essential identifier. It includes a list of modes. However, the dense jargon and lack of structure (e.g., bullet points) slightly reduce readability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (55 parameters, no schema descriptions), the description is incomplete. It omits explanations for most parameters, does not clarify parameter interactions, and assumes knowledge of the kernel stack. The output schema exists but does not compensate for the lack of usage guidance.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 55 parameters and 0% schema description coverage, the description only explains the 'mode' parameter (lists values) and briefly hints at 'tier'. The vast majority of parameters (e.g., query, content, policy) are not addressed, leaving agents to guess their meaning and usage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it is a memory governor for a kernel, managing L1–L6 tiers and listing modes (recall, inspect, etc.). It distinguishes itself from a free notepad and from siblings by focusing on structured memory operations. However, the heavy jargon (J-space, F1/F2/F4/F11) reduces immediate clarity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use it (for structured memory, not ephemeral facts) and distinguishes read vs write modes. However, it lacks explicit guidance on when to use this tool vs sibling tools (e.g., arif_observe, arif_think) or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
arif_observe111 Observe · Sense RealityARead-onlyIdempotentInspect
KERNEL 111 · Sense reality into evidence (not reasoning, not judgment). Web/URL/vitals/repo/entropy with epistemic tags. Authority: L0 OBSERVE. Modes: search | fetch | ingest | compass | atlas | entropy_dS | vitals | repo_map | hybrid_discovery. Returns: evidence + sources + uncertainty. Skip when pure reasoning → arif_think; domain compute → arif_route to GEOX/WEALTH/WELL.
| Name | Required | Description | Default |
|---|---|---|---|
| url | No | ||
| mode | No | search | |
| query | No | ||
| layers | No | ||
| actor_id | No | ||
| _envelope | No | ||
| session_id | No | ||
| result_limit | No | ||
| session_token | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover safety (readOnly, idempotent, openWorld). Description adds behavioral detail: returns evidence, sources, uncertainty; authority level L0 OBSERVE; mentions epistemic tags. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is very concise with no wasted words. It front-loads the purpose and lists modes. However, the jargon 'KERNEL 111', 'L0 OBSERVE' may be opaque without additional context, slightly reducing accessibility.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 9 un-documented parameters and many modes, the description is far from complete. It mentions return types but fails to explain parameter roles or mode differences. Output schema exists but is not shown; description does not compensate for missing parameter semantics.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% – the description does not explain any of the 9 parameters beyond listing some modes. It omits meanings for url, query, layers, actor_id, session_id, etc. This is a critical gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool gathers evidence from reality, with specific verb 'sense' and resource 'reality'. It distinguishes from siblings arif_think (pure reasoning) and arif_route (domain compute), making purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use: for evidence gathering with modes like search, fetch, etc. Directly advises against use for pure reasoning ('skip when pure reasoning → arif_think') and domain compute ('arif_route to GEOX/WEALTH/WELL').
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
arif_route444 Route · Intent→OrganARead-onlyIdempotentInspect
KERNEL 444 · Intent→organ router (default path to GEOX/WEALTH/WELL/A-FORGE). Select when you know the goal but not which organ/verb. Optional organ_tool+arguments = governed bridge call (prefer this over arif_bridge_connect). Authority: L0. Returns: organ, port, tool_prefix, suggested_tools. Not session preflight (use arif_triage). Not a free shell.
| Name | Required | Description | Default |
|---|---|---|---|
| task | No | Alias for intent (backward compat). | |
| organ | No | Optional explicit organ override. If provided, intent matching is skipped and this organ is used directly. | |
| intent | Yes | Natural-language description of what the user wants. e.g. "interpret this seismic section", "assess portfolio risk" | |
| actor_id | No | Calling actor. | |
| _envelope | No | ||
| arguments | No | Arguments to pass to organ_tool. | |
| organ_tool | No | The tool name on the target organ to call. If absent, returns routing decision only (no bridge call). | |
| session_id | No | Governing session. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotation declares readOnlyHint=true, but the description mentions 'Optional organ_tool+arguments = governed bridge call', which implies potential execution of a non-read-only action. This contradiction undermines transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is concise, front-loaded with purpose, and each sentence adds value. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (8 params, output schema exists), the description covers purpose, usage, alternatives, return values, and constraints (L0 authority, not a free shell). It is sufficiently complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 88% (high), so baseline is 3. The description adds minimal parameter info beyond the schema; it mentions 'organ_tool+arguments' but does not elaborate on other parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it is an 'Intent→organ router' and explains the use case: route a goal to the appropriate organ and verb. It distinguishes from siblings by mentioning arif_bridge_connect and arif_triage, providing specific alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use: 'Select when you know the goal but not which organ/verb.' Also gives clear when-not: 'Not session preflight (use arif_triage).' Recommends preferring this over arif_bridge_connect.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
arif_seal999 Seal · VAULT999BDestructiveInspect
KERNEL 999 · VAULT999 immutable append — civilizational memory, irreversible. Authority: 888_HOLD / SOVEREIGN + ack_irreversible for seal mode. Modes: seal | verify | chain | list | dry_run | seal_card | render. Seal only after SEAL verdict path; HOLD/SABAR/VOID do not seal. Testing → dry_run. Kernel judges; vault seals; Arif owns F13 veto.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | seal | |
| nonce | No | ||
| payload | No | ||
| actor_id | No | ||
| _envelope | No | ||
| session_id | No | ||
| drift_events | No | ||
| witness_type | No | ai | |
| session_token | No | ||
| actor_signature | No | ||
| judge_state_hash | No | ||
| constitutional_chain_id | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description reinforces the annotation's destructiveHint=true by stating 'irreversible' and 'immutable append'. It adds behavioral context beyond annotations, such as authority requirements ('Authority: 888_HOLD / SOVEREIGN + ack_irreversible for seal mode') and a veto power ('Arif owns F13 veto'). There is no contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single paragraph of moderate length, front-loading the core concept of immutable append. It contains poetic language and jargon (e.g., 'civilizational memory'), which reduces conciseness. While it covers key points, it could be more efficiently structured for an AI agent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (12 parameters, destructive, no param descriptions), the description leaves significant gaps. It does not explain the meaning or purpose of any parameter, nor describe the output (despite an existing output schema). The mode list discrepancy further undermines completeness. An agent would struggle to use this tool correctly without additional context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 12 parameters with 0% description coverage, and the description does not explain any parameter in detail. It lists modes in text ('seal | verify | chain | list | dry_run | seal_card | render') but the schema's mode enum includes different values ('seal', 'verify', 'ledger', 'changelog', 'audit'), creating inconsistency. The description adds minimal helpful parameter semantics and introduces confusion instead.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states that the tool performs an 'immutable append' or 'seal' operation, implying irreversible creation of a record. It mentions modes like 'seal' and 'verify', and gives a condition ('Seal only after SEAL verdict path'). However, the language is esoteric and uses proprietary terms (e.g., '888_HOLD', 'F13 veto') that may confuse an AI agent. The purpose is somewhat clear but not universally understandable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides implicit usage guidance: 'Seal only after SEAL verdict path' and 'Testing → dry_run', indicating when to use the seal mode versus dry run. It distinguishes the tool from siblings by stating 'Kernel judges; vault seals', implying arif_seal is for sealing after judging. However, it does not explicitly list when to use this tool over sibling tools like arif_judge or arif_think, limiting clarity.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
arif_think333 Think · MindARead-onlyIdempotentInspect
KERNEL 333 · Mind — structure reasoning under F2/F7 (not a chat model, not a verdict). Plan, reflect, verify, synthesize with OBS/DER/INT/SPEC labels. Authority: L0–L1. Modes: reason | reflect | verify | plan | plan_review | plan_approve | refactor_plan | metabolize | axioms. Returns: structured reasoning + confidence + next_safe_action. Ethical/maruah risk → arif_critique. Binding decision → arif_judge. Facts → arif_observe.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | reason | |
| query | No | ||
| plan_id | No | ||
| actor_id | No | ||
| _envelope | No | ||
| session_id | No | ||
| witness_type | No | ai | |
| session_token | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint, idempotentHint, destructiveHint. Description adds that it operates at Authority L0–L1, returns structured reasoning + confidence + next_safe_action, and is not a chat model. This provides useful behavioral context beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, packing purpose, modes, output, and cross-references into a few sentences. It front-loads the core identity. However, heavy jargon (F2/F7, OBS/DER/INT/SPEC) may reduce clarity for some agents, but it remains efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 8 parameters and an output schema, the description covers purpose, usage, and behavioral traits reasonably well. However, it does not explain most parameters or provide usage examples, leaving some gaps for a complex tool. The output schema exists but is not shared in the description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%. The description explains the 'mode' parameter with its enum values, but does not describe other parameters like query, plan_id, actor_id, session_id, etc. Given 8 parameters, the description only partially compensates for the lack of schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it's for structure reasoning under F2/F7, explicitly distinguishes from a chat model and a verdict, and differentiates from siblings by pointing to arif_critique (ethical risk), arif_judge (binding decision), and arif_observe (facts).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description says when not to use it ('not a chat model, not a verdict') and directs to sibling tools for related tasks. It lists modes but does not provide explicit guidance on when to choose each mode, though the mode names are self-explanatory.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
35 tool updates
v0.1.1- Removed
arif_bridge - Changed
arif_bridge_connect3 fields changed- added
Output schema / additionalPropertiesAdded value: +true - removed
Output schema / propertiesRemoved value: -{ - "_nine_signal_compliant": { - "description": "Internal compliance flag", - "type": "boolean" - }, - "_violations": { - "description": "Non-compliance audit trail", - "items": { - "type": "string" - }, - "type": "array" - }, - "actor_id": { - "description": "Sovereign or agent actor ID", - "type": [ - "string", - "null" - ] - }, - "delta_S": { - "description": "Thermodynamic entropy change", - "type": "number" - }, - "meta": { - "description": "Metadata including actor_id, mode, circuit", - "type": "object" - }, - "nine_signal": { - "description": "F2 addendum nine-signal block", - "type": "object" - }, - "output_policy": { - "description": "Policy constraints: DOMAIN_SEAL, DOMAIN_HOLD, DOMAIN_VOID, SIMULATION_ONLY", - "type": "string" - }, - "reasons": { - "description": "Human-readable justification list", - "items": { - "type": "string" - }, - "type": "array" - }, - "result": { - "description": "Tool-specific payload", - "type": "object" - }, - "session_id": { - "description": "Active session identifier", - "type": [ - "string", - "null" - ] - }, - "stage_progression": { - "description": "Next stage auto-chain hint", - "type": [ - "object", - "null" - ] - }, - "status": { - "description": "Execution status: OK, ERROR, TIMEOUT, DRY_RUN", - "type": "string" - }, - "timestamp": { - "description": "ISO-8601 timestamp", - "type": "string" - }, - "tool": { - "description": "Canonical tool name that produced this response", - "type": "string" - }, - "verdict": { - "description": "Constitutional verdict: SEAL, HOLD, VOID, SABAR, PROVISIONAL, PARTIAL", - "type": "string" - } -} - removed
Output schema / requiredRemoved value: -[ - "status", - "tool", - "verdict", - "result", - "nine_signal", - "reasons" -]
- Added
arif_compose - Removed
arif_conformance_report - Added
arif_critique - Removed
arif_evidence_fetch - Added
arif_forge - Removed
arif_forge_execute - Removed
arif_gateway_connect - Removed
arif_heart_critique - Added
arif_init - Removed
arif_initialize_probe - Added
arif_judge - Removed
arif_judge_deliberate - Removed
arif_kernel_attest - Removed
arif_kernel_health - Removed
arif_kernel_route - Removed
arif_kernel_status - Added
arif_memory - Removed
arif_memory_recall - Removed
arif_mind_reason - Added
arif_observe - Removed
arif_ops_measure - Removed
arif_ping - Removed
arif_reply_compose - Changed
arif_route3 fields changed- added
Output schema / additionalPropertiesAdded value: +true - removed
Output schema / propertiesRemoved value: -{ - "_nine_signal_compliant": { - "description": "Internal compliance flag", - "type": "boolean" - }, - "_violations": { - "description": "Non-compliance audit trail", - "items": { - "type": "string" - }, - "type": "array" - }, - "actor_id": { - "description": "Sovereign or agent actor ID", - "type": [ - "string", - "null" - ] - }, - "delta_S": { - "description": "Thermodynamic entropy change", - "type": "number" - }, - "meta": { - "description": "Metadata including actor_id, mode, circuit", - "type": "object" - }, - "nine_signal": { - "description": "F2 addendum nine-signal block", - "type": "object" - }, - "output_policy": { - "description": "Policy constraints: DOMAIN_SEAL, DOMAIN_HOLD, DOMAIN_VOID, SIMULATION_ONLY", - "type": "string" - }, - "reasons": { - "description": "Human-readable justification list", - "items": { - "type": "string" - }, - "type": "array" - }, - "result": { - "description": "Tool-specific payload", - "type": "object" - }, - "session_id": { - "description": "Active session identifier", - "type": [ - "string", - "null" - ] - }, - "stage_progression": { - "description": "Next stage auto-chain hint", - "type": [ - "object", - "null" - ] - }, - "status": { - "description": "Execution status: OK, ERROR, TIMEOUT, DRY_RUN", - "type": "string" - }, - "timestamp": { - "description": "ISO-8601 timestamp", - "type": "string" - }, - "tool": { - "description": "Canonical tool name that produced this response", - "type": "string" - }, - "verdict": { - "description": "Constitutional verdict: SEAL, HOLD, VOID, SABAR, PROVISIONAL, PARTIAL", - "type": "string" - } -} - removed
Output schema / requiredRemoved value: -[ - "status", - "tool", - "verdict", - "result", - "nine_signal", - "reasons" -]
- Removed
arif_schema_echo - Added
arif_seal - Removed
arif_sense_observe - Removed
arif_session_init - Added
arif_think - Removed
arif_transport_echo - Removed
arif_triage - Removed
arif_vault_seal - Removed
arif_version_echo
26 tool updates
v0.1.0- First observed
arif_bridge - First observed
arif_bridge_connect - First observed
arif_conformance_report - First observed
arif_evidence_fetch - First observed
arif_forge_execute - First observed
arif_gateway_connect - First observed
arif_heart_critique - First observed
arif_initialize_probe - First observed
arif_judge_deliberate - First observed
arif_kernel_attest - First observed
arif_kernel_health - First observed
arif_kernel_route - First observed
arif_kernel_status - First observed
arif_memory_recall - First observed
arif_mind_reason - First observed
arif_ops_measure - First observed
arif_ping - First observed
arif_reply_compose - First observed
arif_route - First observed
arif_schema_echo - First observed
arif_sense_observe - First observed
arif_session_init - First observed
arif_transport_echo - First observed
arif_triage - First observed
arif_vault_seal - First observed
arif_version_echo
TDQS
Each tool has a distinct and clearly defined purpose within the kernel's lifecycle: from session initiation (arif_init) through observation, reasoning, ethical critique, judgment, sealing, composition, execution, and memory management. The only potential overlap between arif_route and arif_bridge_connect is explicitly resolved by preferring arif_route. All other tools are uniquely scoped with no ambiguity.
All tools follow the 'arif_<verb>' pattern, with most verbs being single words (e.g., compose, judge, seal). The sole exception is 'arif_bridge_connect', which uses a compound verb. This minor inconsistency slightly detracts from the overall uniformity, but the pattern is otherwise consistent and predictable.
With 11 tools, arifOS covers the full gamut of operations for a sophisticated governance kernel without being excessive. Each tool serves a clear and necessary role in the agent's workflow, from initialization to immutable sealing. The count feels well-scoped for the intended domain.
The tool set covers the major stages of the decision and execution pipeline: init, observe, think, critique, judge, seal, compose, forge, memory, route, and bridge. This provides a cohesive workflow. Missing are utility tools like listing or unsealing, but these are not central to the core lifecycle, so the gap is minor.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Constitutional AI kernel with 13 MCP tools, 888_JUDGE verdict pipeline, and VAULT999 ledger.
Compliance frameworks (SOC 2, ISO 27001, CMMC, NIST, more) delivered to AI agents as MCP tools.
1Agent governance with A2A/Shopify/MCP trust audits, action screening, and decision UI.
Pre-execution governance for AI agents. Deterministic PASS/FAIL/REVIEW verdicts, replayable proof.
Related MCP Servers
- AlicenseAqualityBmaintenanceUniversal governance layer for AI agents — MCP-native, fail-closed, LNN interpretability. Governed receipts, IPFS audit proofs, and rollback for any agent in any framework.382Apache 2.0
- AlicenseNot gradedqualityBmaintenanceEnables AI agents to reason about the ACF governance standard for autonomous AI agents, providing structured assessments, regulatory compliance checks, and doctrine-based tools via MCP.189MIT
- AlicenseNot gradedqualityFmaintenanceConstitutional MCP server enforcing 13 Floors of governance for AI agents, providing tools for session anchoring, reasoning, safety critique, and audit logging.AGPL 3.0
- AlicenseNot gradedqualityDmaintenanceEnables AI agents to interact with a Git-native organizational governance system, supporting proposal-validation workflows, decision-making, and audit trail management through 21 MCP tools over stdio transport.1MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/ariffazil/arifos'
If you have feedback or need assistance with the MCP directory API, please join our Discord server