The QAE-Claude-MCP server enables Claude to perform deterministic safety certification for autonomous actions using the QAE safety kernel. It exposes three core capabilities:
Certify Actions (certify_action): Evaluate a proposed action by submitting an action ID, agent ID, and three constraint scores (scope, reversibility, sensitivity). Returns a decision (Certified, CertifiedWithWarning, EscalateToHuman, or Blocked), a risk zone (Safe >0.6, Caution 0.3–0.6, Danger ≤0.3), per-dimension safety margins, the binding constraint, remaining drift budget, and a SHA256-verified certificate ID.
Check Safety Budget (check_budget): View the current safety budget state — total limit, amount used, amount remaining, rate limit, total certifications performed, and utilization percentage.
Retrieve Certification History (get_certification_history): Access up to 50 recent certification records (most recent first), including certificate ID, action ID, agent ID, decision, risk zone, timestamp, and optional description — useful for audit and review.
An MCP (Model Context Protocol) server that gives Claude access to deterministic safety certification for autonomous actions. Built on the QAE safety kernel, this server enables Claude to evaluate the safety profile of proposed actions across multiple constraint dimensions (scope, reversibility, sensitivity) before execution.
Claude Desktop / IDE
↓
MCP Client
↓
MCP Protocol
↓
QAE-Claude-MCP-Server
↓
Python MCP SDK
↓
qae_safety Package (PyO3 bindings to Rust kernel)
↓
QAE Safety Certification Engine
↓
SafetyCertificate (Certified / Warning / Escalate / Blocked)Related MCP server: blackwall-mcp
pip install -e .This installs the MCP server and its dependencies (qae-safety, mcp). The qae-safety package is the production PyO3 binding to the Rust QAE safety kernel, available on PyPI. Requires Python 3.9+.
Add the MCP server to your Claude Desktop configuration:
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json
Linux: ~/.config/Claude/claude_desktop_config.json
{
"mcpServers": {
"qae-safety": {
"command": "python",
"args": ["-m", "qae_mcp_server"],
"env": {}
}
}
}The MCP server will start automatically. You can see available tools in the tool menu.
In Claude, you can now use the following tools:
certify_action — Evaluate the safety of a proposed action
Action: "Deploy new recommendation algorithm to 10% of users"
Scope: 0.7 (affects moderate user segment)
Reversibility: 0.4 (difficult to rollback)
Sensitivity: 0.8 (high impact on user experience)check_budget — View your current safety budget utilization
get_certification_history — Retrieve recent certification decisions
Deterministic Certification: No randomness. Same inputs → Same decision every time.
Constraint-Based Safety: Evaluates scope, reversibility, and sensitivity independently.
Safety Zones:
Safe (Certified): margin > 0.6 — Safe to proceed
Caution (CertifiedWithWarning): margin 0.3–0.6 — Proceed with caution
Danger (EscalateToHuman): margin 0.1–0.3 — Human review required
Danger (Blocked): margin ≤ 0.1 — Action blocked
Budget Tracking: Certifications consume a safety budget; budget resets on schedule.
Audit Trail: Every certification is logged with full details for review.
Claude proposes an action with scope, reversibility, and sensitivity scores.
MCP server instantiates a SafetyCertifier with the AgenticAdapter.
QAE kernel evaluates across three constraint channels.
Margin is computed as normalized headroom in [0, 1].
Decision is mapped to zone and returned to Claude.
Certificate is logged with ID and deterministic hash.
Example flow:
from qae_safety import AgenticAdapter, SafetyCertifier, SimpleAction, StateDelta
# Create adapter and certifier
adapter = AgenticAdapter(budget_limit=100.0, rate_limit=50.0)
certifier = SafetyCertifier(adapter)
# Define action with state deltas
action = SimpleAction(
action_id="act_123",
agent_id="claude_v3",
state_deltas=[
StateDelta(dimension="scope_score", from_value=0.0, to_value=0.7),
StateDelta(dimension="reversibility_score", from_value=1.0, to_value=0.4),
StateDelta(dimension="sensitivity_score", from_value=0.0, to_value=0.8),
]
)
# Certify
cert = certifier.certify(action)
# Check decision
print(f"Decision: {cert.decision}") # "Certified", "CertifiedWithWarning", etc.
print(f"Zone: {cert.zone}") # "Safe", "Caution", "Danger"
print(f"Margins: {cert.margins}") # {"scope": 0.6, "reversibility": 0.5, ...}certify_actionEvaluate the safety of an action.
Input:
action_id (str): Unique action identifier
agent_id (str): Agent performing the action
scope (float): Scope dimension score [0, 1]
reversibility (float): Reversibility dimension score [0, 1]
sensitivity (float): Sensitivity dimension score [0, 1]
Output:
{
"decision": "Certified" | "CertifiedWithWarning" | "EscalateToHuman" | "Blocked",
"zone": "Safe" | "Caution" | "Danger",
"margins": {
"scope": 0.75,
"reversibility": 0.45,
"sensitivity": 0.60
},
"binding_constraint": "reversibility" | null,
"drift_budget": 25.5,
"certificate_id": "cert_abc123",
"deterministic_hash": "sha256:0x...",
"timestamp": "2025-03-15T14:23:45Z"
}check_budgetCheck current budget utilization.
Output:
{
"budget_limit": 100.0,
"budget_used": 34.5,
"budget_remaining": 65.5,
"budget_utilization": 0.345,
"rate_limit": 50.0,
"certifications_this_period": 5,
"utilization_percent": 34.5,
"timestamp": "2025-03-15T14:23:45Z"
}get_certification_historyRetrieve recent certifications (limit: 50).
Output:
{
"certifications": [
{
"certificate_id": "cert_xyz789",
"action_id": "act_456",
"decision": "CertifiedWithWarning",
"timestamp": "2025-03-15T14:15:32Z"
}
]
}The MCP server uses the built-in AgenticAdapter with default thresholds:
Safe Threshold: margin > 0.6
Caution Threshold: margin 0.3–0.6
Block Threshold: margin ≤ 0.1
To customize, edit src/qae_mcp_server/server.py and modify the AgenticAdapter initialization.
QAE Research: https://doi.org/10.6084/m9.figshare.31742857
QAE Platform: https://qaesubstrate.com
PyPI Package: https://pypi.org/project/qae-safety/
Model Context Protocol: https://modelcontextprotocol.io
This example is part of the QAE fintech risk certification platform. See the main repository for license details.
Evaluate the safety of an action across multiple constraint dimensions.
This tool uses the QAE safety kernel to assess whether a proposed action is safe to execute. It returns a certificate with a decision (Certified, CertifiedWithWarning, EscalateToHuman, or Blocked) and detailed margins for each constraint dimension.
Args: action_id: Unique identifier for the action (e.g., "act_123") agent_id: Identifier of the agent proposing the action (e.g., "claude_v3") scope: Scope dimension [0, 1], where 0=narrow, 1=global reversibility: Reversibility dimension [0, 1], where 0=permanent, 1=easily reversible sensitivity: Sensitivity dimension [0, 1], where 0=low-impact, 1=high-impact description: Optional human-readable description of the action
Returns: Dictionary with keys: - decision: "Certified", "CertifiedWithWarning", "EscalateToHuman", or "Blocked" - zone: "Safe", "Caution", or "Danger" - margins: Dict of dimension -> margin value [0, 1] - binding_constraint: Name of most restrictive constraint (if any) - drift_budget: Remaining budget after this certification - certificate_id: Unique certificate identifier - deterministic_hash: SHA256 hash of the certificate - timestamp: ISO 8601 timestamp - description: Echo of input description (if provided)
Example: >>> certify_action( ... action_id="act_deploy_algo", ... agent_id="claude_sales", ... scope=0.7, ... reversibility=0.4, ... sensitivity=0.8, ... description="Deploy new recommendation algorithm to 10% of users" ... )
| Name | Required | Description | Default |
|---|---|---|---|
| action_id | Yes | ||
| agent_id | Yes | ||
| scope | Yes | ||
| reversibility | Yes | ||
| sensitivity | Yes | ||
| description | No |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure, successfully detailing the decision categories (Certified, CertifiedWithWarning, EscalateToHuman, Blocked), zone classifications, and constraint margin logic. It explains the 'drift_budget' return value implying budget consumption, though it could more explicitly state that this operation consumes budget or creates a persistent certificate record.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The docstring structure is logical and front-loaded with purpose, though the Returns section lists 9 output fields that likely duplicate the existing output schema (context signals indicate has_output_schema=true), creating minor redundancy. The example usage is valuable and appropriately placed at the end.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a high-complexity safety tool, the description provides robust coverage including parameter semantics, return structure, decision logic, and executable examples. Minor gaps remain regarding inter-tool workflow (e.g., whether to call `check_budget` first) and explicit mutation/side-effect statements.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Given the schema has 0% description coverage, the Args section provides comprehensive compensation by documenting all 6 parameters with semantic ranges (e.g., scope '[0, 1], where 0=narrow, 1=global') and illustrative examples (e.g., 'act_123', 'claude_v3'), fully clarifying the dimension scales and identifiers.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with the specific verb 'Evaluate' and clear resource 'safety of an action', elaborating that it uses the 'QAE safety kernel' to assess proposed actions. It effectively distinguishes from siblings: unlike `check_budget` (resource checking) or `get_certification_history` (retrieval), this performs active multi-dimensional safety evaluation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
While the phrase 'assess whether a proposed action is safe to execute' implies usage prior to action execution, there is no explicit guidance on when to use this versus `check_budget` (e.g., whether to check budget first) or how it relates to `get_certification_history`. The description lacks explicit 'when-not-to-use' or prerequisite guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Check the current safety budget utilization.
This tool returns the current state of the safety budget, including:
Total budget limit (resets on schedule)
Amount used in current period
Number of certifications performed
Rate limit enforcement status
Returns: Dictionary with keys: - budget_limit: Total safety budget [tokens/actions] - budget_used: Amount consumed in current period - budget_remaining: budget_limit - budget_used (clamped to >= 0) - rate_limit: Maximum certifications per period - total_certifications: Total number of certifications performed - utilization_percent: (budget_used / budget_limit) * 100 - timestamp: Current time (ISO 8601)
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, description carries full behavioral disclosure burden. Excellent coverage: specifies reset schedule ('resets on schedule'), calculation logic ('clamped to >= 0'), rate limiting enforcement status, and precise return structure including ISO 8601 timestamp format.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with clear visual separation between purpose statement and return value specification. Front-loaded with the core action. Detailed return dictionary is verbose but justified given budget monitoring requires precise field definitions.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Comprehensive coverage for a zero-parameter read operation. Despite existence of output schema (per context signals), description ensures completeness by documenting all return fields, calculations, and temporal behaviors (reset schedules) that might not be visible in schema alone.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Zero parameters present; baseline score of 4 applies per rubric. Description appropriately does not fabricate parameter semantics where none exist.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clear verb ('Check') and resource ('safety budget utilization'). Implies read-only status check distinct from sibling 'certify_action' (which performs mutations) by framing itself as state retrieval and referencing certifications as metadata rather than actions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit when-to-use guidance or comparison to siblings. Does not advise calling this before 'certify_action' to validate budget availability, though the return structure implies this use case.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Retrieve the recent certification history.
This tool returns a list of recent certifications, most recent first. The history includes decision, zone, timestamp, and other metadata. Up to 50 certifications are stored; older ones are discarded.
Args: limit: Maximum number of certifications to return (default 10, max 50)
Returns: Dictionary with keys: - certifications: List of recent certification summaries - total_count: Total certifications in history - timestamp: Current time (ISO 8601)
Each certification entry contains: - certificate_id: Unique certificate identifier - action_id: Action that was certified - agent_id: Agent that proposed the action - decision: Final decision ("Certified", "CertifiedWithWarning", etc.) - zone: Risk zone ("Safe", "Caution", "Danger") - timestamp: When the certification occurred - description: Optional action description
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full behavioral burden excellently. It discloses critical data lifecycle constraints ('Up to 50 certifications are stored; older ones are discarded'), ordering guarantees ('most recent first'), and rich return structure details that annotations would typically cover.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
While well-structured with Args/Returns sections, the description is verbose; the extensive Returns field enumeration duplicates information that should ideally live in the output schema (which exists per context signals). The retention limit sentence earns its place, but the field-by-field return documentation could be trimmed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given zero annotations and minimal schema coverage, the description provides comprehensive context including data retention policies, return format, and parameter constraints. The output schema exists, so the detailed return documentation in the description is somewhat redundant, though the behavioral metadata (50 item limit, discarding) is essential.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the Args section compensates effectively by documenting the 'limit' parameter's purpose, default value (10), and maximum constraint (50) - crucial information not present in the bare JSON schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses specific verb 'Retrieve' and resource 'certification history', clearly distinguishing it from sibling 'certify_action' (which implies writing/creating) and 'check_budget' (unrelated domain). It establishes the scope as 'recent' history with explicit ordering ('most recent first').
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage by detailing what the tool returns (history vs new certifications), but lacks explicit selection guidance like 'Use this to audit past decisions; to certify new actions use certify_action instead.' No when-not-to-use or prerequisite guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
v1.0.0certify_actioncheck_budgetget_certification_historyThe three tools have clearly distinct purposes with no overlap: certify_action evaluates safety for proposed actions, check_budget monitors budget utilization, and get_certification_history retrieves past certifications. Each tool serves a unique function in the safety certification workflow, making selection straightforward for an agent.
All tool names follow a consistent verb_noun pattern: certify_action, check_budget, and get_certification_history. The naming convention is uniform throughout, using clear action verbs followed by specific nouns that describe the tool's function.
Three tools is reasonable for a safety certification server, covering core operations: certification, budget checking, and history retrieval. While slightly minimal, each tool earns its place, and the count aligns well with the server's focused purpose without being overly sparse.
The tool set provides complete coverage for the safety certification domain: certify_action handles the primary certification operation, check_budget manages budget monitoring, and get_certification_history offers audit capabilities. This covers the essential lifecycle of certification, budget tracking, and historical review with no obvious gaps.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
Pre-execution governance for AI agents. Deterministic PASS/FAIL/REVIEW verdicts, replayable proof.
Deterministic runtime safety for AI agents: scan PII, gate tool actions, verify LLM output.
Runtime permission, approval, and audit layer for AI agent tool execution.
Zero-trust gateway for AI agents: score tool calls, verify agent cards, enforce policy, audit.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/tb8412/qae-claude-mcp-example'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
