AGA-mcp-server
AGA — Attested Governance Artifacts (Заверенные артефакты управления)
Криптографическое управление средой выполнения для ИИ-агентов и автономных систем.
# Try it now
pip install aga-governance
python -m aga demo
python -m aga verify demo-bundle.jsonЧто это делает
Каждый вызов инструмента, который делает ИИ-агент, проходит через шлюз AGA. Каждый вызов оценивается на соответствие политике, а решение (РАЗРЕШЕНО или ЗАПРЕЩЕНО) записывается как подписанная, хеш-связанная квитанция управления. Квитанции собираются в пакеты доказательств, которые любая третья сторона может проверить в автономном режиме, используя стандартную криптографию.
Записывай. Доказывай. Проверяй.
Related MCP server: Proofpane
Использование с Claude Desktop
Добавьте в конфигурацию MCP вашего Claude Desktop (claude_desktop_config.json):
{
"mcpServers": {
"aga": {
"command": "npx",
"args": ["-y", "@attested-intelligence/aga-mcp-server"]
}
}
}После этого Claude сможет запечатывать артефакты, измерять целостность, создавать пакеты доказательств и проверять соответствие требованиям с помощью естественного языка.
Инструменты MCP (20)
Категория | Инструменты |
Идентификация |
|
Жизненный цикл |
|
Принудительное исполнение |
|
Доказательства |
|
Конфиденциальность |
|
Делегирование |
|
Аудит |
|
Быстрый старт
Проверка пакета доказательств (3 команды)
pip install aga-governance
curl -s https://aga-mcp-gateway.attestedintelligence.workers.dev/bundle -o evidence-bundle.json
python -m aga verify evidence-bundle.jsonИли проверка в браузере
Перейдите на attestedintelligence.com/verify и нажмите "Run Verification". Установка не требуется.
Как это работает
AI Agent AGA Gateway Verifier
| | |
|-- tools/call ----------->| |
| [Evaluate Policy] |
| [Sign Receipt] |
| [Chain to Previous] |
|<-- PERMITTED/DENIED -----| |
| | |
| [Export Bundle] |
| |--------- evidence.json ----->|
| | [Verify Signatures]
| | [Verify Chain]
| | [Verify Merkle Tree]
| | [PASS / FAIL]Прокси управления MCP
Запустите AGA как прозрачный прокси между любым клиентом MCP и любым сервером MCP. Каждый вызов инструмента оценивается на соответствие политике и создает подписанную квитанцию.
# Start the proxy with an upstream MCP server
npx tsx src/proxy/index.ts start --upstream "npx -y @modelcontextprotocol/server-filesystem /tmp/test" --profile standard
# Export the evidence bundle
npx tsx src/proxy/index.ts export --output evidence.json
# Verify
npx tsx src/proxy/index.ts verify evidence.jsonПрокси перехватывает запросы tools/call, оценивает их на соответствие запечатанному артефакту политики и генерирует подписанные квитанции. Разрешенные вызовы пересылаются на подчиненный сервер. Запрещенные вызовы возвращают ошибку MCP. Каждое решение хеш-связано в цепочку с защитой от несанкционированного доступа.
Три встроенных профиля политики:
permissive — регистрировать всё, ничего не блокировать (по умолчанию)
standard — ограничение частоты запросов + блокировка деструктивных операций
restrictive — явный список разрешенных инструментов, все неизвестные инструменты запрещены
Проверка (5 шагов)
Проверка алгоритма — Пакет объявляет Ed25519-SHA256-JCS, при любом другом значении проверка не проходит
Подписи квитанций — Ed25519 поверх канонического JSON RFC 8785 (поле подписи исключено)
Целостность цепочки —
previous_receipt_hashкаждой квитанции = SHA-256 предыдущей квитанцииДоказательства Меркла — Проход по узлам/направлениям к корню, сравнение с корнем пакета
Согласованность пакета — Количество доказательств = количеству квитанций, хеши листьев совпадают с хешами квитанций
Криптографические примитивы
Примитив | Назначение |
Ed25519 | Подписи квитанций |
SHA-256 | Хеш-цепочки, деревья Меркла, вычисление листьев |
RFC 8785 (JCS) | Канонический JSON для детерминированной подписи |
Деревья Меркла | Привязка всех квитанций к единому проверяемому корню |
Живой шлюз
Демонстрационный шлюз развернут на Cloudflare Workers:
# Check status
curl https://aga-mcp-gateway.attestedintelligence.workers.dev/health
# Export evidence bundle
curl https://aga-mcp-gateway.attestedintelligence.workers.dev/bundle -o evidence-bundle.jsonPython SDK
pip install aga-governancefrom aga import AgentSession
with AgentSession(gateway_id="my-gateway") as session:
session.record_tool_call(
tool_name="search_web",
decision="PERMITTED",
reason="tool in allowlist",
request_id="req-1",
)
bundle = session.export_bundle()
result = session.verify()
assert result["overall_valid"]Набор тестов
355+ автоматизированных тестов на TypeScript и Python:
TypeScript MCP Server: 218 тестов (vitest)
Python SDK: 137 тестов (pytest)
Кросс-языковые тестовые векторы: 37 векторов в 9 категориях
npm test # TypeScript testsДля Python SDK установите aga-governance из PyPI: https://pypi.org/project/aga-governance/
Структура проекта
src/ # Core protocol: artifacts, receipts, chain, Merkle, crypto, portal state machine
core/ # Governance primitives (artifact, receipt, chain, portal, bundle)
crypto/ # Ed25519, SHA-256, BLAKE2b, Merkle, JCS canonicalization
proxy/ # MCP governance proxy (transparent interception + policy enforcement)
tools/ # MCP tool handlers (20 tools)
middleware/ # Zero-trust governance enforcement wrapper
independent-verifier/ # Standalone verifier with zero AGA imports
scenarios/ # Deployment scenarios (SCADA, drone, AI agent)
tests/ # TypeScript test suite (218 tests)Ссылки
Безопасность
См. SECURITY.md для сообщения об уязвимостях.
Участие в разработке
См. CONTRIBUTING.md для настройки разработки и руководящих принципов.
Лицензия
Attested Intelligence Holdings LLC
Available Tools
15 toolsattest_subjectC
Attest subject, generate sealed Policy Artifact. Auto-loads into portal.
| Name | Required | Description | Default |
|---|---|---|---|
| evidence_items | No | ||
| subject_content | Yes | Content/bytes of the subject | |
| subject_metadata | Yes | ||
| behavioral_baseline | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description only indicates that it generates and auto-loads an artifact. It does not disclose whether the operation is destructive, idempotent, requires authorization, or has side effects beyond loading into the portal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise with two short sentences. It front-loads the core action and provides an important side effect (auto-loading) without unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 4 parameters, nested objects, and no output schema, the description is too sparse. It does not explain return values, the format of the sealed artifact, or how parameters like evidence_items and behavioral_baseline contribute to the attestation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description does not mention any parameters, despite schema description coverage being only 25%. It fails to explain the purpose or usage of subject_content, subject_metadata, evidence_items, or behavioral_baseline, leaving a significant gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states that the tool attests a subject and generates a sealed Policy Artifact, with auto-loading into a portal. However, it does not distinguish from sibling tools like generate_evidence_bundle or request_claim, which could have overlapping purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. There is no mention of prerequisites, use cases, or scenarios where other tools would be more appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delegate_to_subagentB
Derive a constrained policy artifact for a sub-agent. Scope can only diminish, never expand. (NCCoE constrained delegation)
| Name | Required | Description | Default |
|---|---|---|---|
| measurement_types | Yes | Subset of parent measurement types | |
| delegation_purpose | Yes | Purpose of the delegation | |
| enforcement_triggers | Yes | Subset of parent enforcement triggers | |
| requested_ttl_seconds | Yes | Requested TTL (will be clamped to parent remaining) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden. It discloses the key behavioral trait of non-expanding scope, but lacks details on permissions, side effects, or error behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, concise and to the point, with no wasted words. However, it could benefit from slightly more structure or context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 4 required parameters, no output schema, and no annotations, the description is too minimal. It lacks details on return values, prerequisites, or how this fits with siblings, leaving an agent with insufficient information for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and each parameter is described in the schema. The description adds no additional meaning beyond the general purpose of constrained delegation, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool derives a constrained policy artifact for a sub-agent, with specific scope restrictions. It uses domain-specific terminology (NCCoE constrained delegation) but is not contrasted with siblings like request_claim or attest_subject.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The constraints 'Scope can only diminish, never expand' provide some usage context, but there is no explicit guidance on when to use this tool versus alternatives, nor when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
generate_evidence_bundleA
Export the canonical SEP evidence bundle: signed PERMITTED/DENIED tool-call receipts + Merkle proofs + a mandatory signed checkpoint, for offline third-party verification (verify_bundle_offline, aga-verify, or aga-receipt-spec/verify/verify-sep.mjs). Pin gateway_public_key to prove provenance.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description bears full burden. It discloses the output components (receipts, proofs, checkpoint) and purpose (offline verification). However, it does not mention potential side effects, authentication, or whether it is read-only (likely safe).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with two sentences that front-load the main action. It contains no fluff, though it could be slightly more structured (e.g., bullet list) for clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no parameters and no output schema, the description provides a comprehensive overview of what the bundle contains and how it is used. Minor gaps: no mention of prerequisites (like needing a chain) or the bundle's size/format.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters, and schema coverage is 100%. The description adds value by explaining what the tool outputs and its purpose, which is more than the schema provides. Baseline for 0 parameters is 4, and the description meets it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Export' and the resource 'canonical SEP evidence bundle', detailing its content (signed receipts, Merkle proofs, signed checkpoint). It distinguishes from the sibling 'verify_bundle_offline' by specifying this is for generation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states the use case: 'for offline third-party verification'. Mentions verification methods (verify_bundle_offline, etc.) and a key prerequisite (pin gateway_public_key). Does not include when-not-to-use or alternative tools beyond verify_bundle_offline.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_chain_eventsC
Get continuity chain events.
| Name | Required | Description | Default |
|---|---|---|---|
| end_seq | No | ||
| start_seq | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the burden of behavioral disclosure. It does not mention side effects, authorization requirements, rate limits, or any constraints beyond the name.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
At only four words, the description is underspecified rather than concisely informative. It fails to provide necessary details that would make it useful.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, no annotations, and no parameter descriptions, the description leaves the agent with minimal understanding of tool behavior, inputs, or outputs. It is insufficient for the given complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has 0% parameter description coverage, and the description does not explain the meaning, format, or use of 'start_seq' and 'end_seq'. The agent remains uninformed about these parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description states it retrieves 'continuity chain events', identifying a specific resource and action. However, it lacks clarity on what these events represent, and does not distinguish it from sibling tools like 'get_portal_state' or 'get_server_info'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. The description provides no context about scenarios or prerequisites for invoking it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_portal_stateA
Get current portal state, loaded artifact info, and enforcement status.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, description must disclose behavioral traits. It only names what is retrieved, but does not mention side effects, permissions, or whether it is read-only. This is insufficient for a no-annotation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, no wasted words. Every part contributes to understanding the tool's output.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, so description should explain return structure. It names major components but lacks detail on format or fields. Given low complexity (no params, no annotations), it is minimally adequate but not thorough.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters in schema, so baseline is 4. Description adds meaning by specifying what the tool returns, going beyond the empty schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states what is retrieved: 'current portal state, loaded artifact info, and enforcement status'. Verb and resource are specific and distinct from siblings like get_server_info or get_chain_events.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives (e.g., get_server_info). No context about prerequisites or typical use cases.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_receiptsC
Get all signed receipts, optionally filtered by artifact.
| Name | Required | Description | Default |
|---|---|---|---|
| artifact_hash | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full burden. It states 'Get' implying read-only, but does not explicitly confirm no side effects, idempotency, or permission requirements. It does not disclose behavior for missing artifact_hash or large result sets.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, concise but lacks structure. It could be improved by separating purpose and usage details. It earns its place but does not excel in providing organized information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and no annotations, the description is incomplete. It omits return format, pagination, error handling, and behavior for missing parameters. For a tool with one optional param, it is borderline but still leaves significant questions.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description adds minimal meaning: 'optionally filtered by artifact' links the parameter artifact_hash to filtering but does not explain the format or valid values. This is insufficient for a parameter with no schema description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves all signed receipts with optional filtering by artifact. The verb 'Get' and resource 'signed receipts' are specific. Sibling tools like list_claims or get_chain_events are distinct, so no confusion arises.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. The description does not mention prerequisites, context, or exclusions. For example, it does not clarify if this tool is preferred over list_claims for certain cases.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_server_infoA
Get AGA server info, public keys, and portal state.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so the description carries full burden. It does not disclose whether the operation is safe, requires authentication, or has any side effects. For a read-only tool, minimal behavioral disclosure is given.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is front-loaded and concise with no waste. Every word adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Although the description mentions the types of information retrieved (server info, public keys, portal state), it does not describe the output structure or format. With no output schema, the description should provide more detail on what the response contains.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has no parameters, and the description does not need to add parameter meaning. Schema coverage is 100% trivially. Baseline for 0 parameters is 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves AGA server info, public keys, and portal state. It uses a specific verb 'Get' and distinguishes from sibling tools like get_portal_state, which is more specific.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. Given siblings like get_portal_state and other info tools, the description should include context on when to prefer this over others.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
init_chainC
Initialize continuity chain with genesis event.
| Name | Required | Description | Default |
|---|---|---|---|
| specification_hash | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose behavioral traits. It only says 'initialize' and 'genesis event', but does not mention side effects, idempotency, error conditions, or required permissions. Falls short for a mutating operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Extremely concise at 5 words, but at the expense of critical information. It is front-loaded but does not earn its place as it omits parameter details and usage guidance.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has one parameter, no output schema, and no annotations, the description is incomplete. It lacks explanation of the parameter's meaning, return value, and overall behavior, making it insufficient for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter 'specification_hash' has no description in the schema and is not mentioned in the description. The agent has no way to understand its purpose or format.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Initialize' and the resource 'continuity chain' with 'genesis event', which differentiates it from sibling tools like verify_chain. However, the term 'continuity chain' is not explained, assuming domain knowledge.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives like get_chain_events or verify_chain. No prerequisites, exclusions, or contextual conditions are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_claimsA
List available claims with sensitivity levels.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It only states that the tool lists claims with sensitivity levels, but does not disclose side effects (likely none), authorization needs, or data freshness. For a tool with no parameters, the behavior is simple, but more transparency could help.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that conveys the essential information without any fluff. It is front-loaded and efficient, earning its place with precise wording.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no parameters or output schema, the description is sufficient for a simple list operation. It tells the agent what the tool provides (claims with sensitivity levels). However, it could mention if the list is complete or filtered in any way, but overall it is adequately complete for its simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0 parameters and 100% schema description coverage. The description adds no parameter information, but since none exist, this is appropriate. The baseline is 4 for no parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: listing available claims with sensitivity levels. It uses a specific verb ('list') and resource ('claims'), and adds detail about sensitivity levels, distinguishing it from siblings like 'request_claim' or 'verify_bundle_offline' which have different purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. For example, it does not explain how 'list_claims' differs from 'get_receipts' or other listing operations. No context about prerequisites or ideal scenarios is given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
measure_behaviorA
Measure behavioral patterns (unauthorized tools, rate violations, forbidden sequences). DETECTIVE-ONLY by default: it records and PROVES drift but does not block. Pass enforce=true to also trip the portal into phantom quarantine on drift (opt-in; off by default). (NIST-2025-0035)
| Name | Required | Description | Default |
|---|---|---|---|
| enforce | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses the detective-only default, that it records and proves drift but does not block, and that enforce=true triggers phantom quarantine. It could elaborate on what 'phantom quarantine' entails, but it's sufficiently transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with purpose and followed by details on default behavior and enforce option. Every sentence adds value with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with one parameter and no output schema, the description covers purpose, default behavior, and the enforce option. It does not describe the output or what triggers measurement, but it is fairly complete given the context. A brief mention of output would improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema provides only the parameter name and type with 0% coverage. The description adds valuable meaning: it explains that enforce (boolean, default false) opts in to phantom quarantine on drift. This fully compensates for the schema's lack of description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool measures behavioral patterns (unauthorized tools, rate violations, forbidden sequences) and distinguishes itself from sibling tools by highlighting 'DETECTIVE-ONLY' default behavior and an optional enforce parameter for quarantine.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains when to use the tool (for detecting behavioral drift) and how to opt into enforcement via enforce=true. It does not explicitly state when not to use it or compare to siblings like measure_integrity, but the context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
measure_integrityB
Measure subject state, compare to sealed reference. Generates signed receipt for every measurement.
| Name | Required | Description | Default |
|---|---|---|---|
| subject_content | Yes | Current content of the subject | |
| subject_metadata | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden for behavioral disclosure. It mentions receipt generation but does not disclose side effects, permission requirements, or what happens on mismatch. The comparison to a sealed reference is implied but not detailed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no redundancy, front-loaded with the core action. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having two parameters (one nested) and no output schema, the description is too brief. It omits the source of the sealed reference, return format, and any prerequisites, leaving significant gaps for an agent to successfully invoke the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only 50% of parameters have schema descriptions; the description adds no parameter-level details. Subject_content is described in schema; subject_metadata lacks description in both schema and tool description. The description does not clarify their roles beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: measuring subject state and comparing to a sealed reference, and generating signed receipts. It uses specific verbs and resources, distinguishing it from sibling tools like 'attest_subject' and 'measure_behavior'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives, no prerequisites, and no exclusions. It only states the function without contextual usage advice.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
request_claimC
Request disclosure of a claim. Auto-substitutes if denied.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | REVEAL_MIN | |
| claim_id | Yes | ||
| requester_id | No | anonymous |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden for behavioral disclosure. It mentions 'Auto-substitutes if denied', which is a key behavior, but fails to explain what 'substitutes' means, whether it's destructive, or any other side effects. No mention of permissions or rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very concise (two sentences), but it lacks structure and essential information. While it is not verbose, the conciseness comes at the cost of completeness. Every sentence should earn its place, but here they are insufficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 3 parameters, no output schema, and no annotations, the description is severely incomplete. It does not explain the return value, the meaning of disclosure modes, or the auto-substitution behavior in detail. The tool is for a potentially complex operation, but the description leaves many gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, and the description adds no parameter explanations. It doesn't mention claim_id, mode, or requester_id. The mode enum (PROOF_ONLY, REVEAL_MIN, REVEAL_FULL) is not described. The description fails entirely to add meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Request disclosure of a claim.' The verb 'request disclosure' and resource 'claim' are specific. It also mentions auto-substitution on denial, adding context. However, it doesn't differentiate from siblings like 'list_claims', but the purpose is distinct enough.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. There is no mention of prerequisites, scenarios, or exclusions. The tool is for requesting claim disclosure, but no context on when to choose this over other claim-related tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
revoke_artifactA
Revoke an active policy artifact mid-session. Portal terminates on next measurement. (NCCoE Phase 3b)
| Name | Required | Description | Default |
|---|---|---|---|
| reason | Yes | Reason for revocation | |
| sealed_hash | Yes | Sealed hash of artifact to revoke |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description partially carries the burden. It discloses the termination effect on next measurement, but does not detail permissions, side effects on other artifacts, or confirmation mechanics. It adds value but leaves gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with zero waste. Every word contributes to understanding purpose and key behavior. Efficient and front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is minimal but covers the primary action and a notable behavioral effect. However, given no output schema and potential complexity around revocation, more detail (e.g., what happens to the session, how to confirm success) would improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with clear descriptions for both parameters ('sealed_hash', 'reason'). The tool description does not add any additional meaning beyond what the schema already provides, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly specifies the action 'Revoke' on the resource 'active policy artifact', adds context 'mid-session', and notes a specific effect 'Portal terminates on next measurement'. This distinguishes it from sibling tools like 'attest_subject' or 'delegate_to_subagent'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides context ('mid-session') but no explicit guidance on when to use this tool versus alternatives (e.g., when not to use, or which sibling to choose instead). It lacks exclusion criteria or comparative hints.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verify_bundle_offlineA
Verify a canonical SEP evidence bundle offline (full §6 algorithm: structural floor, receipt signatures, chain+ordering, leaf-recompute + Merkle bijection, signed checkpoint). Pass pinned_public_key to also prove provenance.
| Name | Required | Description | Default |
|---|---|---|---|
| bundle | No | ||
| pinned_public_key | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, but the description details the verification algorithm: structural floor, receipt signatures, chain+ordering, leaf-recompute + Merkle bijection, signed checkpoint. This fully discloses the tool's behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences: first describes purpose and algorithm, second adds optional parameter. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the algorithm well and parameter use, but lacks output specification (return value) and prerequisites. For a complex verification tool, this is a notable gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has zero description coverage. The description explains pinned_public_key for provenance but does not elaborate on the bundle parameter's structure or constraints, leaving a gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool verifies a canonical SEP evidence bundle offline, listing specific algorithm steps from §6. It distinguishes from sibling tools like verify_chain by focusing on bundle verification.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use when offline bundle verification is needed and mentions optional provenance via pinned_public_key. It does not explicitly state when not to use, but context with siblings is implicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verify_chainC
Verify continuity chain integrity.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, and the description does not disclose behavioral traits. It does not state whether the tool performs a read or mutation, what it returns, or any side effects, leaving the agent with no insight into the tool's behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very concise (one sentence). However, it sacrifices informativeness for brevity; it could provide more detail without being verbose. It is not tautological but minimally sufficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of the tool (no parameters, no output schema), the description still fails to explain what 'verify' entails, what the output indicates, or how it relates to sibling tools like verify_bundle_offline. It is incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero parameters, so schema coverage is trivially 100%. The description adds no parameter information, but baseline for zero parameters is 4. No further meaning is needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Verify' and resource 'continuity chain integrity', making the general purpose clear. However, it does not differentiate from sibling tools like verify_bundle_offline or get_chain_events, which limits clarity in context.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. The description lacks any context about prerequisites, intended use cases, or when to avoid it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
33 tool updates
v2.0.1- Removed
aga_create_artifact - Removed
aga_delegate_to_subagent - Removed
aga_demonstrate_lifecycle - Removed
aga_disclose_claim - Removed
aga_export_bundle - Removed
aga_generate_receipt - Removed
aga_get_chain - Removed
aga_get_portal_state - Removed
aga_init_chain - Removed
aga_measure_behavior - Removed
aga_measure_subject - Removed
aga_quarantine_status - Removed
aga_revoke_artifact - Removed
aga_rotate_keys - Removed
aga_server_info - Removed
aga_set_verification_tier - Removed
aga_start_monitoring - Removed
aga_trigger_measurement - Removed
aga_verify_artifact - Removed
aga_verify_bundle - Added
attest_subject - Added
delegate_to_subagent - Added
generate_evidence_bundle - Added
get_chain_events - Added
get_portal_state - Added
get_receipts - Added
list_claims - Added
measure_behavior - Added
measure_integrity - Added
request_claim - Added
revoke_artifact - Added
verify_bundle_offline - Added
verify_chain
22 tool updates
v2.0.0- First observed
aga_create_artifact - First observed
aga_delegate_to_subagent - First observed
aga_demonstrate_lifecycle - First observed
aga_disclose_claim - First observed
aga_export_bundle - First observed
aga_generate_receipt - First observed
aga_get_chain - First observed
aga_get_portal_state - First observed
aga_init_chain - First observed
aga_measure_behavior - First observed
aga_measure_subject - First observed
aga_quarantine_status - First observed
aga_revoke_artifact - First observed
aga_rotate_keys - First observed
aga_server_info - First observed
aga_set_verification_tier - First observed
aga_start_monitoring - First observed
aga_trigger_measurement - First observed
aga_verify_artifact - First observed
aga_verify_bundle - First observed
get_server_info - First observed
init_chain
TDQS
Each tool has a unique purpose with no overlapping functionality. For example, measure_behavior and measure_integrity measure different aspects, and verify_chain vs. get_chain_events are distinct operations. The descriptions clearly differentiate them.
All tool names follow a consistent verb_noun pattern in snake_case (e.g., attest_subject, delegate_to_subagent, verify_chain). There is no mixing of conventions or irregular naming.
With 15 tools, the server is well-scoped for its attestation and policy domain. Each tool earns its place, covering setup, measurement, verification, and revocation without being excessively numerous.
The tool surface appears complete for the server's purpose, covering artifact creation, delegation, evidence export, chain initialization, state querying, claims handling, behavioral and integrity measurement, revocation, and offline verification. No obvious gaps in the core workflow.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Zero-trust gateway for AI agents: score tool calls, verify agent cards, enforce policy, audit.
Tamper-evident proof creation and verification for AI agents via MCP, A2A, and REST.
Pre-action attestation perimeter for AI agents — 8 primitives, signed C18 receipt per call.
Pre-execution governance for AI agents. Deterministic PASS/FAIL/REVIEW verdicts, replayable proof.
Related MCP Servers
- AlicenseAqualityAmaintenanceLocal zero-trust permission gateway for AI agents. Enforces policy-based tool authorization, human approvals, scoped permissions, and cryptographically verifiable audit logs.45Apache 2.0
- AlicenseBqualityAmaintenanceA governance proxy for AI tools — every MCP/agent tool call is policy-gated, secret-redacted, and written to a hash-chained, offline-verifiable audit trail.13MIT
- AlicenseNot gradedqualityBmaintenanceSelf-hosted MCP gateway that applies deterministic, compiled policy to tool discovery, invocation, and outbound data flow, with no model in the enforcement path. Every decision emits a hash-chained receipt sealed with Ed25519 and verifiable using public keys only.Apache 2.0

evav-gatewayofficial
AlicenseNot gradedqualityBmaintenanceGoverned MCP gateway that lets AI agents call tools with policy enforcement, prompt-injection screening, a kill-switch, and tamper-evident signed audit logs.Apache 2.0
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/attestedintelligence/aga-mcp-server'
If you have feedback or need assistance with the MCP directory API, please join our Discord server