Skip to main content
Glama

TunnelMind Data API

Server Details

Tracker / Sigil / Cross-lens — every TunnelMind Data API operation as one MCP surface.

Status
Healthy
Last Tested
Transport
Streamable HTTP
URL

Glama MCP Gateway

Connect through Glama MCP Gateway for full control over tool access and complete visibility into every call.

MCP client
Glama
MCP server

Full call logging

Every tool call is logged with complete inputs and outputs, so you can debug issues and audit what your agents are doing.

Tool access control

Enable or disable individual tools per connector, so you decide what your agents can and cannot do.

Managed credentials

Glama handles OAuth flows, token storage, and automatic rotation, so credentials never expire on your clients.

Usage analytics

See which tools your agents call, how often, and when, so you can understand usage patterns and catch anomalies.

100% free. Your data is private.
Tool DescriptionsA

Average 4.5/5 across 90 of 90 tools scored. Lowest: 2.6/5.

Server CoherenceC
Disambiguation2/5

Many tools overlap in purpose, such as cross_lens_verify, cross_lens_lookup, profile_entity, and preflight_should_i_act, which all return node verdicts with subtle differences. Sigil verification tools and receipt-related tools also have similar names and require deep reading to distinguish.

Naming Consistency3/5

The tool names are mostly readable, but the pattern is mixed: some use verb_noun (get_domain, create_subscription) while others use domain prefixes (sigil_*, ghostroute_*, intel_*). Within each domain, naming is consistent, but the overall style lacks uniformity.

Tool Count1/5

With 90 tools, this server is extremely overloaded. Even for a multi-purpose data API, the sheer number overwhelms and makes navigation difficult, far exceeding the typical well-scoped MCP server. The count is an extreme mismatch for the apparent scope.

Completeness4/5

The tool surface is very comprehensive, covering tracker lookup, cross-lens verification, receipts, compliance, subscriptions, tasks, intel probes, and more. Minor gaps exist, such as no batch cross-lens verification, but core workflows are well covered.

Available Tools

93 tools
agent_registries_lookupAInspect

P75 registry aggregation: the cross-lens join applied to agent identity. Incumbent providers each consult only their own registry; this endpoint checks every registry TunnelMind can reach and labels each answer with an explicit state, so a gap can never be mistaken for a clean result:

  • observed — the subject IS in this registry (record attached)

  • not_present — checked, and it isn't (an observation, not a gap)

  • not_applicable — the registry doesn't key on this subject type

  • degraded — the check failed (timeout, upstream error)

  • unavailable — the registry is not publicly consultable (closed / platform-scoped); stated in-band because silence would read as clean

Registries (v0): crawler_ranges (operator-published IP feeds — Googlebot, GPTBot, PerplexityBot…), wba_directory (RFC 9421 Signature-Agent JWKS at the subject domain), mcp_registry (registry.modelcontextprotocol.io), tunnelmind_known_agents (curated verifiable/claim-only set), plus honest unavailable rows for Visa TAP, Mastercard Agent Pay, and Cloudflare Verified Bots.

Use this tool when:

  • You are deciding whether an agent, bot, or MCP server is registered anywhere that vouches for it — in one call instead of five.

  • You need the blind spots stated: which registries could NOT be consulted for this subject, and why.

Inputs: subject — an IP (registry membership by published ranges), a domain (WBA directory + MCP registry), or an agent name/UA fragment (e.g. gptbot, claudebot). ?receipt=true attaches a signed Receipt v1.0 committed to the transparency log.

Latency: remote registry checks are KV-cached for 1h; a warm call is edge-fast, a cold one bounded by 5s per-registry timeouts.

ParametersJSON Schema
NameRequiredDescriptionDefault
receiptNoAttach a signed TunnelMind Receipt v1.0 over the aggregation.
subjectYesIP address, domain, or agent name / User-Agent fragment.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fully covers behavior: it checks all reachable registries, returns explicit states (observed, not_present, etc.), lists specific registries, mentions caching (KV-cached 1h), latency bounds (5s cold), and receipt option. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-structured with bullet points but verbose (4 paragraphs). Some redundancy, e.g., repeating cross-lens concept. Front-loaded with purpose, but could be trimmed while retaining key details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description comprehensively explains all possible answer states, registries checked, and latency behavior. It provides sufficient context for an AI agent to understand tool's scope and results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with descriptions, but the description adds context: explains subject types (IP, domain, agent name/UA fragment) and receipt as 'signed Receipt v1.0 committed to transparency log', enhancing understanding beyond the enum.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool performs a cross-lens join across multiple registries to check agent/bot/MCP server registration. It distinguishes from siblings by contrasting with 'incumbent providers each consult only their own registry' and positions this as a single-call aggregation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit bullet points for when to use: deciding on registration status and needing blind spots. Implicitly contrasts with checking registries individually, but does not name specific alternative tools or explicitly state when not to use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

attributes_lookupAInspect

P73 fast attributes endpoint (PIP-PLAN P3): a full POST /v1/verify resolve fans out across four lenses (~2s) — fine for preflight, fatal inside a per-request authorization loop. This endpoint serves the last-known signed bundle from a single KV read, with the P69 freshness contract deciding how much to trust it.

Use this tool when:

  • A policy decision point (OPA, Cerbos, Cedar) needs node attributes on its hot path and can tolerate valid_until-bounded staleness.

  • An agent re-checks a node it (or anyone) verified recently.

Inputs:

  • node (path, required): IPv4 address, domain, ASN (AS64500), or entity_slug — same grammar as /v1/verify.

Returns:

  • The exact verify bundle last cached for the node (lens blocks, cross_lens verdict, coverage with valid_until / stale_if_error, signed receipt), plus attributes_meta: cached_at and freshnessfresh (inside valid_until) or stale (past it, still inside the stale_if_error window; the contract says a consumer may use it rather than fail closed).

  • 404 when nothing is cached — the node was never verified, or its bundle aged past stale_if_error. POST /v1/verify to (re)observe.

  • The short-lived sigil_token from the original verify is never included: bearer capabilities are not re-served.

Cost:

  • Counts as one request against the daily rate limit.

Latency:

  • Typical: <100ms (one KV read, no lens fan-out).

ParametersJSON Schema
NameRequiredDescriptionDefault
nodeYes
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses read-only nature, KV read, returns cached bundle with freshness meta, 404 on miss, no sigil token, cost as one request, latency <100ms. No annotations provided, so description fully covers behavioral traits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-structured with clear sections, but moderately verbose. Could be slightly shorter without losing clarity, but each sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers inputs, returns (including error 404), cost, latency, and staleness contract. No output schema, but description explains return values comprehensively.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has one parameter 'node' with no description (0% coverage). Description adds meaning by specifying allowed formats (IPv4, domain, ASN, entity_slug) and referencing /v1/verify grammar.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states it's a fast attributes endpoint for node attribute lookups using a cached bundle, distinguishing it from the full /v1/verify endpoint and other sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use (hot path with staleness tolerance, re-checking verified nodes) and when not to use (per-request auth loops, need for fresh verification or sigil token).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

audit_exportAInspect

Returns NDJSON (one JSON object per line) of audit log entries. Each entry records the operation called, the identity, hashes of the request and response, duration, and an Ed25519 signature over the canonical entry JSON. Entries are hash-chained: each entry's prev_entry_hash is SHA-256 of the previous entry's signature, making deletion of any entry detectable offline.

Authenticated callers receive only their own entries (identity_sub match). Admin key holders receive all entries.

Use this tool when:

  • You want a tamper-evident record of your own API calls.

  • You are auditing a sequence of requests for compliance or debugging.

  • You want to verify the audit chain integrity offline.

Do NOT use this tool when:

  • You are anonymous — authentication is required.

  • You want task status — use get_task instead.

Inputs:

  • from (query, optional): ISO 8601 start datetime. Default: 7 days ago.

  • to (query, optional): ISO 8601 end datetime. Default: now.

  • limit (query, optional): Max entries. 1–5000, default 1000.

Returns:

  • NDJSON stream, one AuditEntry per line.

  • X-Total-Count response header with entry count.

  • X-Took-Ms response header.

Verify the chain offline:

  • For each consecutive pair (A, B): SHA-256(A.signature) == B.prev_entry_hash.

  • For each entry: verify Ed25519 signature against public key in /.well-known/atap.json.

Cost:

  • Counts as one request against the daily limit.

Latency:

  • Typical: <300ms for 1000 entries, p99: <1s.

ParametersJSON Schema
NameRequiredDescriptionDefault
toNo
fromNo
limitNo
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure, and it excels: it explains the hash-chaining and deletion detection, authentication scoping (own entries vs admin), NDJSON stream format, response headers, offline verification procedure, cost counting, and latency profile. This is far beyond minimal transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Although lengthy, the description is well-structured with clear sections (description, use cases, inputs, returns, verification, cost, latency), front-loaded with the core purpose. Every sentence adds operational value—no filler. The structure makes it easy to scan and ingest.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity, absent annotations, and lack of output schema, the description is remarkably complete: it covers inputs, output format, HTTP headers, chain verification logic, authentication behavior, rate-limit cost, and typical latency. There are no significant gaps for an agent to select and invoke this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It does: every parameter (`from`, `to`, `limit`) is explained with format, default, and constraints (e.g., 'default 7 days ago', '1–5000, default 1000'). This gives the agent full comprehension without needing to infer from the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Returns NDJSON (one JSON object per line) of audit log entries.' It goes on to detail what each entry records, making the tool's purpose unmistakable. It also distinguishes itself from siblings by explicitly saying 'use `get_task` instead' for task status, which differentiates it from at least one alternative.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides an explicit 'Use this tool when:' and 'Do NOT use this tool when:' section, including a concrete alternative (`get_task`). It also states the authentication requirement, clarifying a key condition for use. This is exemplary usage guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cancel_taskAInspect

Marks the task as cancelled. If the task is already in a terminal state (complete, failed, expired), returns 409 Conflict. Only the identity that created the task may cancel it.

Use this tool when:

  • You submitted a probe with ?async=true and no longer need the result.

  • You want to free up a pending task before it expires.

Do NOT use this tool when:

  • The task is already complete — cancellation is not possible.

Inputs:

  • task_id (path, required): 26-char ULID.

Returns:

  • task_id and status: cancelled.

Cost:

  • Free.

Latency:

  • Typical: <150ms.

ParametersJSON Schema
NameRequiredDescriptionDefault
task_idYes
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description fully covers behavioral traits: returns 409 Conflict for terminal states, requires the creator identity to cancel, returns task_id and status, states cost is free, and gives typical latency. This is comprehensive and goes beyond basic mutation semantics.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections for action, usage, inputs, returns, cost, and latency. Each section earns its place, though cost and latency could be considered optional; however, they do not bloat the text significantly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has one parameter and no output schema, and the description covers the mutation, conflict behavior, authorization, return values, cost, and latency. It provides all necessary context for an agent to decide when to use it and what to expect.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has no description for task_id (0% coverage), but the description compensates by specifying it is a path parameter, required, and a 26-char ULID. This fully resolves the parameter's meaning and format, exceeding what the schema alone provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Marks the task as `cancelled`', with a specific verb and resource. It also mentions the conflict on terminal states, but does not explicitly differentiate from sibling tools like get_task or stream_task, so it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes explicit 'Use this tool when' and 'Do NOT use this tool when' sections, giving clear invocation scenarios and an exclusion (already complete). However, it does not name alternative tools for other scenarios, so it misses the 'alternatives' component for a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

check_receipt_revokedAInspect

Single-item revocation lookup per Receipt Format v1.0 §8.2. Verifiers that do not want to maintain a local mirror of /.well-known/receipt-revocations.json call this endpoint instead. The response includes feed_version for cache coherence.

Use this tool when:

  • You are verifying a receipt and need to confirm its signature.key_id is still trusted.

  • You are verifying a receipt and need to confirm the specific receipt_id was not retracted by its issuer.

  • You hold receipts long-term and want to recheck trust before acting on them.

Do NOT use this tool when:

  • You want the full revocation set — fetch /.well-known/receipt-revocations.json directly.

  • You want to publish a revocation — that is operator-controlled and not exposed via this API.

Inputs:

  • key_id (query, optional): Receipt-format key_id (e.g., tm-receipt-2026-05). Provide one of key_id or id.

  • id (query, optional): UUIDv7 of a specific receipt. Provide one of key_id or id.

Returns:

  • revoked: boolean.

  • When revoked: revoked_at (ISO 8601), reason (human-readable), replacement_key_id (for keys).

  • Always: checked_at (ISO 8601), feed_version (integer).

Cost:

  • Free; rate-limited like the rest of the data API. Edge-cached 60s.

Latency:

  • Typical <100ms (warm cache); p99 <500ms (cold fetch from well-known).

ParametersJSON Schema
NameRequiredDescriptionDefault
idNoUUIDv7 of a specific receipt to check.
key_idNoReceipt-format signing key_id to check.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description fully carries the burden of behavioral disclosure. It goes well beyond a basic read operation: it states the endpoint is an alternative to a local mirror, includes `feed_version` for cache coherence, details response fields (`revoked`, `revoked_at`, `reason`, etc.), and discloses cost, rate-limiting, edge-caching (60s), and latency ranges. This level of detail is exceptional and leaves little ambiguity about side effects or operational behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is organized into clear, labeled sections (purpose, use cases, non-use cases, inputs, returns, cost, latency) with bullet points for scannability. Every sentence adds operational value—the cost and latency sections are not fluff but pragmatic details for an agent deciding whether to use this endpoint. It is longer than average but tightly written and front-loaded with the core purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is fully self-contained for a tool with no output schema and no annotations: it explains the input options, the exact response structure, the cache/rate-limit behavior, and even provides fallback guidance (fetch well-known directly). There is no missing context an agent would need to make an informed invocation decision. The only minor omission is explicit authentication requirements, but the 'Free; rate-limited like the rest of the data API' implies public access, and the overall completeness is outstanding.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with both parameters already having descriptions and examples. The description adds the critical constraint 'Provide one of `key_id` or `id`', which is not encoded in the schema, and reinforces the context for each parameter (e.g., 'Receipt-format key_id'). This adds meaningful semantics beyond the schema, though the schema already does most of the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Single-item revocation lookup per Receipt Format v1.0 §8.2', immediately stating the specific verb ('lookup'), resource ('revocation'), and scope ('single-item'). It further distinguishes this tool from siblings like 'get_receipt' and 'verify_receipt' by contrasting it with fetching the full revocation set. This is a clear, specific purpose statement that differentiates the tool effectively.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit 'Use this tool when' and 'Do NOT use this tool when' sections, enumerating concrete scenarios (verifying a receipt's key_id, checking a specific receipt_id, long-term rechecking) and explicitly naming the alternative (fetching `/.well-known/receipt-revocations.json` directly) for the negative case. This gives an agent unambiguous guidance on when to invoke this tool versus another resource.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compliance_configureAInspect

Set the customizable knob: which regulatory regime your auditor maps to, how long to retain decision content, and which export formats to offer. Body: { enabled?, regime?, retention_days?, export_formats? }. retention_days is 1..3650; regime is one of the catalog ids; export_formats is a non-empty subset of [signed_json, csv, eat, stix]. No bespoke engineering — you pick, the ledger adapts.

ParametersJSON Schema
NameRequiredDescriptionDefault
regimeNo
enabledNo
export_formatsNo
retention_daysNo
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the transparency burden. It discloses optional fields, allowed ranges, and the non-empty subset constraint, plus the 'ledger adapts' behavior. However, it does not describe side effects like whether existing settings are overwritten, persistence, or authorization requirements.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences with no fluff. It front-loads the purpose, provides a compact body template, and packs constraints and behavioral notes efficiently. Well structured for quick parsing.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a configuration tool with no output schema or annotations, the description covers most key aspects: settings, constraints, and adaptation. But it omits what happens on success (e.g., return value), whether it's a patch or full replacement, and the exact effect of 'enabled'. Slightly incomplete given the complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description compensates by explaining regime, retention_days, and export_formats with concrete constraints. The 'enabled' parameter is only mentioned as optional without explaining what it enables, which is a minor gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the tool as setting compliance configuration (regime, retention, export formats) with a specific verb 'Set'. It does not explicitly differentiate from sibling tools like compliance_export or compliance_verify, but the scope is evident.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied through 'Set the customizable knob' and the list of settings, but there are no explicit when-to-use or when-not-to-use instructions or references to alternatives. The 'No bespoke engineering' note hints at when it's appropriate, but not definitively.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compliance_exportAInspect

Generates a signed export bundle of your ledger over an optional time window, mapped to your regime's field names and citation, with a manifest

  • chain-integrity proof + the latest signed checkpoint. Choose the format with ?format= (signed_json | csv | eat | stix; defaults to your profile's first) and override the regime with ?regime=. The response is a downloadable artifact your auditor can verify independently against the spec.

ParametersJSON Schema
NameRequiredDescriptionDefault
toNoISO8601 upper bound.
fromNoISO8601 lower bound.
formatNosigned_json | csv | eat | stix.
regimeNoOverride the profile regime for this export.
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral disclosure burden. It reveals that the output is a downloadable artifact including a manifest, chain-integrity proof, and latest signed checkpoint, and that the result is independently verifiable. It does not mention auth requirements, rate limits, or side effects, but for an export tool the given detail is substantial and goes beyond a simple 'generates export' statement.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single dense paragraph but is front-loaded with the core purpose ('Generates a signed export bundle'). All sentences contribute relevant information (format, regime, artifact contents). Slightly verbose due to packing many details, but no fluff; still concise enough for an MCP tool with four parameters.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is moderately complex with 4 optional parameters and no output schema. The description explains the return value (a downloadable artifact with manifest, proof, checkpoint) and mentions verification context, covering what an agent needs to invoke it. It doesn't detail every edge case or error behavior, but given the schema coverage and description richness, it is sufficiently complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. The description adds extra meaning beyond the schema: it explains that the time window is optional, identifies format choices ('signed_json | csv | eat | stix'), states the default behavior (profile's first), and clarifies the 'regime' override semantics. This enriches the bare parameter descriptions and justifies a score above baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Generates') and names the resource ('signed export bundle of your ledger') with detailed contents. It clearly distinguishes this export tool from siblings like audit_export by emphasizing the signed bundle, chain-integrity proof, and regime mapping.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context on how to use the tool: choose format via ?format= and override regime via ?regime=. It implies the optional time window and default format behavior, but does not explicitly mention when to use this tool instead of alternatives or when not to use it. Lacks an explicit exclusion clause, so not a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compliance_ledgerAInspect

Returns your hash-chained decision records — one per verdict-bearing call (/v1/verify, /v1/explain, /v1/preflight, /v1/profile) made while compliance is enabled. Each entry carries its node, verdict, scores, receipt_id, the full decision record, and the chain hashes (prev_hash, entry_hash). Filter with from/to (ISO8601) and page with cursor (a seq) + limit (≤1000).

ParametersJSON Schema
NameRequiredDescriptionDefault
toNoISO8601 upper bound (inclusive).
fromNoISO8601 lower bound (inclusive).
limitNoPage size, max 1000.
cursorNoResume after this seq.
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses the scope (records from verdict-bearing calls while compliance is enabled), the fields each entry carries, and the filtering and pagination behavior. It does not mention ordering or error cases, but covers the essential behavioral traits well.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences: purpose, fields, and filtering/pagination. It is front-loaded with the core purpose, and every sentence provides necessary information without waste. The structure is logical and easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (a paginated ledger) and the absence of an output schema or annotations, the description is quite complete. It covers the returned content, the filtering and pagination mechanics, and the scope. It could mention ordering, but overall it is sufficient for an agent to invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already provides 100% coverage with descriptions for all four parameters. The description largely restates the schema ('Filter with from/to (ISO8601) and page with cursor (a seq) + limit (≤1000)') and adds marginal clarification that cursor is a sequence number, which the schema already notes. Thus, the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Returns') and clearly identifies the resource ('hash-chained decision records') with a precise scope ('one per verdict-bearing call... while compliance is enabled'). It distinguishes itself from siblings like compliance_export or audit_export by emphasizing the hash-chained structure and the included fields.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly implies when to use the tool: when you need your hash-chained decision records. It provides context by listing the qualifying call types and the filtering/pagination options. However, it does not explicitly mention alternatives or exclusions, so it falls short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compliance_profileAInspect

Returns your current compliance configuration (regime, retention_days, export_formats, enabled) and the catalog of supported regimes (EU AI Act Art.12, DORA, NYDFS 500, HIPAA, PCI DSS, SOC 2, generic) and export formats (signed_json, csv, eat, stix). Authenticated. The compliance ledger is a tamper-evident, retained record of every verdict you make — configure it once, then it self-maintains.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses that authentication is required, describes the underlying ledger as 'tamper-evident, retained record,' and notes that the configuration 'self-maintains' after configuration. While it doesn't explicitly state that the tool is read-only, 'Returns' implies it, and the added context about persistence is valuable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences and front-loaded with the core purpose. The first sentence is dense and specific. The second sentence about the compliance ledger adds useful system context, though it is slightly tangential to the profile tool itself. No unnecessary repetition, and it stays within an appropriate length.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description is highly informative: it lists the exact fields returned (regime, retention_days, export_formats, enabled) and enumerates supported regimes and export formats. It also notes authentication. For a zero-param, no-output-schema tool, this is essentially complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and an empty schema, which is fully covered (100%). Per the rubric, a baseline of 4 is appropriate for 0 params; the description naturally doesn't need to add parameter-level detail, and no such detail is missing.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Returns your current compliance configuration' and specifies the exact scope (current configuration plus catalog of regimes and export formats). The verb 'Returns' clearly indicates a read operation, distinguishing it from siblings like compliance_configure (which likely modifies) and compliance_export (which likely exports).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states 'Authenticated,' indicating a prerequisite, and the read-only nature of returning a profile is clear. It doesn't explicitly name alternatives or exclusions, but the list of fields and catalog implies it is the go-to tool for inspecting current compliance settings, especially in contrast to configuration or export siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compliance_verifyAInspect

Recomputes your entire hash chain server-side and reports integrity ({ intact, entry_count, chain_head_hash } — plus reason + first_break_seq if a record was altered or deleted), alongside the most recent Ed25519 checkpoint signed with the TunnelMind receipt key. This is the auditor's "prove it" button — and even TunnelMind cannot rewrite history before a signed checkpoint without detection.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does an excellent job. It explains the recompute behavior, the conditional reason and first_break_seq fields, and the security property that TunnelMind cannot rewrite history before a signed checkpoint without detection—offering substantial insight beyond the tool's name.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact yet information-dense, with no fluff. The first sentence front-loads the core mechanism and output, and the second sentence adds usage context and a security guarantee. Every clause earns its place, making it appropriately sized for a complex verification tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and no annotations, the description thoroughly explains return values (including conditional fields) and the security context. It does not need to cover parameters since there are none. The description is complete enough for an agent to understand when and why to invoke this tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero parameters, so schema coverage is effectively 100% and there is nothing for the description to compensate for. Per the rubric, a tool with 0 parameters gets a baseline of 4, and the description appropriately focuses on behavior rather than unnecessary parameter details.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Recomputes') and resource ('your entire hash chain') and clearly describes the output (integrity report with entry_count, chain_head_hash). It distinguishes itself from sibling verify tools by focusing on server-side hash chain integrity and the signed checkpoint, making it the auditor's 'prove it' button.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context: it is the auditor's 'prove it' button, implying use when independent verification of chain integrity is needed. However, it does not explicitly name alternatives or state when not to use it, stopping short of full fallback guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

create_free_keyAInspect

Self-serve free tier — the rung between anonymous access and paid blocks. One email in, one API key out, shown exactly once.

Use this tool when:

  • You are calling anonymously and hitting the anonymous rate limit.

  • You want your calls identified so usage survives IP changes.

Limits:

  • 50 requests/day (same endpoints as anonymous, higher ceiling).

  • One active free key per email; 3 signups per IP per day.

  • The raw key is returned once and stored only as a SHA-256 hash — it cannot be recovered, only revoked and reissued.

Cost: free. No card, no account — the email is the revocation handle, nothing more.

ParametersJSON Schema
NameRequiredDescriptionDefault
emailYes
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses key is shown once, stored as SHA-256 hash (unrecoverable), limits (50/day, 1 per email, 3 per IP), and cost (free). No annotations exist, so description fully carries behavioral disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Concise and well-structured: overview, usage guidance, limits, and key recovery note. Every sentence adds value without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given one parameter, no output schema, and no annotations, the description fully covers input, behavior, limits, and implications, making it complete for agent decision-making.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although the schema defines email with format and example, the description adds context ('One email in') and confirms the email is the revocation handle, adding meaning beyond the schema definition.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool creates a free API key, distinguishing it from siblings like get_api_key (retrieve) and revoke_api_key (invalidate). It positions the tool as the step between anonymous and paid access.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly lists when to use: when hitting anonymous rate limits or wanting persistent usage tracking. Implicitly suggests not to use if already have a key or need paid tier.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

create_subscriptionAInspect

Subscribe to a node (ip, domain, asn, or entity slug). On a recurring sweep (~20 min) TunnelMind re-runs the fused POST /v1/verify verdict and, when the material result changes — the verdict label flips, the trust score crosses a band, or the signal set changes — POSTs a signed event to your callback_url.

Webhook authenticity: every delivery carries an X-TunnelMind-Signature: sha256=<hex> header, an HMAC-SHA256 over the raw request body keyed by the signing_key returned ONCE at creation. Recompute and compare to trust it.

Delivery body: { subscription_id, node, event: "verdict_change", previous, current, delivered_ms } where previous/current are compact verdict summaries { verdict, trust_score, signals }.

Inputs (JSON body):

  • node (required): the node to watch.

  • callback_url (required): an https URL to receive deliveries.

  • events (optional): reserved; defaults to ["verdict_change"].

Requires an API key. The baseline verdict is captured at creation, so the first webhook fires on the first genuine change, not the initial state.

ParametersJSON Schema
NameRequiredDescriptionDefault
nodeYes
eventsNo
callback_urlYes
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden and does so excellently. It discloses the ~20 minute sweep interval, trigger conditions (verdict label flips, trust score crosses a band, signal set changes), the signature header scheme, the one-time return of the signing key, delivery body structure, and that the baseline verdict is captured at creation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is multi-paragraph but well-structured: purpose first, then webhook behavior, authenticity, delivery body, inputs, and requirements. Every sentence adds necessary detail without redundancy. It is long but appropriately sized for a complex webhook creation tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the full scope of the tool: creation inputs, recurring behavior, webhook signature scheme, delivery payload, and first-event semantics. Even without an output schema, it mentions that the signing_key is returned once at creation, giving agents a critical piece of the response. The description is remarkably complete for the tool's complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It does with an 'Inputs (JSON body)' section that explains each parameter: node as 'the node to watch', callback_url as 'an https URL to receive deliveries', and events as optional/reserved defaulting to ['verdict_change']. This adds substantial meaning beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's action: 'Subscribe to a node (ip, domain, asn, or entity slug).' It also explains the webhook semantics, distinguishing it from sibling tools like get_subscription and delete_subscription. The verb 'subscribe' is specific and the resource (node) is well-defined.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage context (setting up recurring change notifications) but does not explicitly mention when to use this tool versus alternatives like list_subscriptions or get_subscription. No exclusions or alternative tool names are provided, so guidance is only implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cross_lens_lookupAInspect

Returns all three lens views for a single node key without computing a fused verdict. Use this when you want raw transparency — the Tracker catalog presence, Scry attacker observations, and Sigil supply-graph position — and intend to make your own decision. For an opinionated verdict, call cross_lens_verify instead. For an agent-side allow/caution/deny gate plus signed consultation receipt, call preflight_should_i_act.

Coverage block exposes which lenses responded so agents can reason about partial-data verdicts. issued_by carries the OAI of the answering witness so the response is attributable.

ParametersJSON Schema
NameRequiredDescriptionDefault
nodeYesIPv4/IPv6 address, domain, ASN with optional `AS` prefix, or entity_slug. Type is auto-detected.
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full transparency burden, and it adds meaningful behavioral detail: it does not compute a fused verdict, it returns raw lens views, the coverage block indicates which lenses responded, and issued_by provides attribution. It does not mention error handling or rate limits, but for a read-only style lookup this is adequate and substantially beyond a bare restatement.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and front-loaded: the first sentence states the core behavior, the second clarifies use cases and alternatives, and the third adds response-relevant details (coverage, issued_by). Every sentence earns its place, with no filler or repetition of schema content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter lookup tool with no output schema and no annotations, the description provides complete context: it names the three lens views, explains the no-fused-verdict behavior, points to alternatives for different needs, and highlights response fields needed for reasoning about partial data. This is sufficient for an agent to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is only one parameter, node, and the schema already fully describes it (IPv4/IPv6 address, domain, ASN with optional AS prefix, or entity_slug; type auto-detected). The description adds no new parameter-specific details beyond calling it a 'node key,' so a baseline of 3 is appropriate given 100% schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Returns all three lens views for a single node key without computing a fused verdict.' It also differentiates from siblings by stating what it does NOT do ('without computing a fused verdict') and by naming the raw-transparency use case, which clearly separates it from cross_lens_verify and preflight_should_i_act.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage guidance is explicit: 'Use this when you want raw transparency... and intend to make your own decision.' It also names specific alternatives ('For an opinionated verdict, call cross_lens_verify instead. For an agent-side allow/caution/deny gate plus signed consultation receipt, call preflight_should_i_act.'), giving clear when-to-use vs. when-not-to-use context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cross_lens_verifyAInspect

A2 — the cross-lens join. TunnelMind owns multiple halves of the open-web graph: Scry sees who is on every IP (attacker intelligence, actor class, Augur threat-intel overlap); Sigil sees the supply graph (publishers, SSPs, DSPs, ads.txt + sellers.json + SupplyChain Object); GhostRoute sees routing integrity & sovereignty (RPKI origin validity, BGP prefix, claimed sovereign zone, sanctions, AI-infrastructure ownership, certificate CA). This endpoint fuses them into one verdict on a single node key.

Streaming mode (P56): send Accept: application/x-ndjson and the same verdict computation streams as one JSON object per line — a {"t":"lens",...,"state":"start"} line when each lens query is dispatched, a "state":"result" line as each lens actually resolves (real completion order, never reordered or paced), then the final {"t":"verdict",...} line with the fused verdict, trust score, and attestation tier. The default single-JSON response is unchanged and the two modes return the identical verdict for the same node.

The response leads with a base record, then the lens views:

  • ip_intel — the BASE: the commodity IP-intelligence + WHOIS record (geo/ASN/company/WHOIS/routing/cert), every field provenance-tagged {value, tier, source} (verified/derived/trusted) with a behaviour axis from Scry. The lens blocks below are augmentation beside it. Committed in the receipt payload. See docs/IP-INTEL-RECORD.md.

  • scry — the single-lens Scry view (transparency).

  • sigil — the single-lens Sigil view (transparency).

  • ghostroute — the single-lens GhostRoute view (transparency).

  • cross_lens — the fused verdict (the moat).

Fusion math: weighted-mean over evaluated components plus a co_observation_bonus when both lenses independently flag the node. GhostRoute adds a routing-integrity component with two hard safety floors that cannot be averaged away: an RPKI-INVALID origin (a BGP hijack signal) caps its trust at 0.15, and a sanctions match zeroes it. Weights and thresholds are per-request overridable.

Lens unavailability is reported in-band: each lens fails independently and the cross_lens block reflects degraded confidence when fewer lenses have data (0.55 one lens / 0.80 two / 0.94 three). GhostRoute has no routing surface for a bare entity_slug, so it drops out and the remaining weights re-normalise. Returns 503 only when ALL lenses are unavailable.

v1 lens coverage matrix:

  • IP node — Scry: full; Sigil: not_indexed (v2 will reverse-DNS); GhostRoute: full.

  • Domain node — Scry: deferred; Sigil: full (publisher/ssp/dsp + entity); GhostRoute: full (resolves to IP).

  • entity_slug node — Scry: n/a; Sigil: full (entity + sell/buy presence); GhostRoute: n/a (no routing surface).

  • ASN node — Scry: deferred (v2); Sigil: not_indexed; GhostRoute: origin-AS lookup.

ParametersJSON Schema
NameRequiredDescriptionDefault
aitNoOptional ATAP AIT id (`AIT-<uuidv7>`). When present, the verdict is wrapped in a witness-tier `cross_lens:verified` event chained onto the AIT and signed by Sigil (witness OAI-2026-0000201). Independent of the AIT, a short-lived signed `sigil_token` is always issued on a successful verify, and a durable TunnelMind `receipt` (v1.0) commits to the verdict for long-term audit.
nodeYesThe node to verify. Type is auto-detected: IPv4/IPv6 address, domain, ASN with optional `AS` prefix, or entity_slug.
weightsNoPer-component weight overrides
thresholdsNo{ pass, fail } verdict cutoffs (defaults 0.7 / 0.3)
claimed_zoneNoCaller-asserted sovereign zone for the subject (e.g. `EU`) — "the vendor's contract says EU-only; score the routing against that claim." Validated against the sovereign-zone reference; an unknown code is ignored with caveat `claimed_zone_unrecognised_ignored` (garbage input never creates penalties). Takes precedence over the corpus's public claim; the response and signed receipt record who asserted it in `ghostroute.claimed_sovereign_zone_source` (`caller` | `corpus`). Claim-bearing calls bypass the shared lens cache and are never written back to the corpus (ADR-012).
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description fully discloses behavior: streaming mode with Accept header, response structure with base record and lens views, fusion math with hard safety floors, in-band lens unavailability reporting, and 503 only when all lenses are down. It also covers claim-bearing calls bypassing cache and ADR-012, providing deep transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is structured with clear sections but is extremely verbose, covering streaming mode, fusion math, response layout, and a coverage matrix. While each section adds useful information, the sheer length may overwhelm an agent; the opening is not front-loaded with a succinct purpose statement, starting instead with 'A2 — the cross-lens join.'

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (5 parameters, nested objects, no output schema), the description thoroughly covers output structure, edge cases, and behavior under various node types. It explains the response shape (base record, lens views, cross_lens) and failure modes (in-band lens degradation, 503 conditions), making it complete for agent use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already provides 100% parameter coverage with detailed descriptions for node, ait, and claimed_zone. The description adds minimal parameter-specific value beyond noting that weights and thresholds are per-request overridable, which is already implied by the schema. Therefore, it meets the baseline of 3 without exceeding.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool 'fuses them into one verdict on a single node key', combining Scry, Sigil, and GhostRoute lenses. This is a specific verb+resource (verify a node via cross-lens fusion) and distinguishes it from sibling tools like cross_lens_lookup by emphasizing the verdict generation and verification aspect.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides extensive context on when the tool is applicable, including a coverage matrix for different node types and behavior under lens unavailability. However, it does not explicitly name alternative tools or give 'use this instead of X' guidance, leaving when-to-use vs alternatives implied rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

delete_subscriptionCInspect

Cancel a subscription.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations are absent, so the description carries full responsibility. 'Cancel a subscription' implies a mutation but does not disclose whether cancellation is reversible, what happens to the subscription's data, or side effects like billing or access changes. This is a significant transparency gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely terse ('Cancel a subscription.') but this is under-specification rather than effective conciseness. It omits essential details that could have been included in a slightly longer but still efficient description.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutation tool with no annotations, output schema, or parameter details, the description is insufficient. It does not explain return values, error conditions, or behavioral consequences, making it incomplete for an agent to invoke safely and understand outcomes.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has one required parameter 'id' (string) with no description, and the tool description does not explain its meaning, format, or how it identifies the subscription. With 0% schema description coverage, the description fails to compensate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Cancel') and resource ('a subscription'), clearly distinguishing it from siblings like create_subscription, get_subscription, and list_subscriptions. It is unambiguous about the core action.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No usage guidance is provided. The description does not state when to use this tool, any prerequisites, or alternative tools to consider, leaving the agent without context for choosing it over other subscription-related tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

explain_verdictAInspect

Call this when you need to ACT ON a verdict and prove why. It returns the exact verdict /v1/verify/{node} computes (same fusion, same weights) PLUS a traced evidence chain: every claim is attributed to where it came from — the attested sensor fleet (with attestation tier), a named Augur threat feed, sellers.json/ads.txt supply-graph presence, the cross-lens co-observation join, the DDG/IAB tracker corpus — and how much each item moved the verdict (weight; null = supplementary, not scored).

The response is committed to by a P38 signed receipt via evidence_digest (a hash of the exact evidence array), so an agent can act on the verdict and leave behind a cryptographically verifiable trail of the reasoning in the same request. Empty/none evidence is the honest "no corpus presence", never a fabricated reason.

node is an IPv4/IPv6, ASN, domain, or entity_slug — the same key space as /v1/verify.

ParametersJSON Schema
NameRequiredDescriptionDefault
nodeYesIPv4/IPv6, ASN (AS####), domain, or entity_slug.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and excels. It discloses the exact verdict computation, evidence attribution details, weight semantics (null = supplementary), P38 signed receipt commitment via evidence_digest, and explicitly addresses empty evidence as honest 'no corpus presence'. This provides comprehensive behavioral insight.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and front-loaded with the core use case. Three paragraphs pack substantial detail without redundancy: purpose, evidence chain mechanics, receipt and edge-case behavior, and node key space. Every sentence contributes meaning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and no annotations, the description explains key output aspects: exact verdict, evidence chain attributes, weight interpretation, and cryptographic receipt via evidence_digest. It also clarifies the node key space and empty-evidence semantics, making the tool fully understandable for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already fully describes the single parameter with 100% coverage. The description adds only that 'node' uses the same key space as `/v1/verify`, which is minor contextual reinforcement. No new semantic meaning is introduced beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with a clear directive: 'Call this when you need to ACT ON a verdict and prove why.' It specifies that the tool returns the exact verdict and a traced evidence chain, distinguishing it from siblings like verdict_lookup by emphasizing the evidence and cryptographic receipt.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states when to use the tool ('when you need to ACT ON a verdict and prove why') and notes that 'node' uses the same key space as `/v1/verify`. It doesn't explicitly name alternative sibling tools, but the usage context is clear and actionable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

generate_receiptAInspect

Looks up each submitted domain in the TunnelMind tracker database, aggregates risk metrics (avg score, max score, fingerprinters, high-risk domains, entity ownership), and issues a signed surveillance receipt. The receipt is stored in the public registry and can be verified at /verify/{receipt_id}.

Use this tool when:

  • You want a verifiable record of which trackers were observed in a context (page, app, session).

  • You need a signed evidence artifact for a privacy audit or compliance report.

  • You want to know the overall surveillance exposure level for a set of domains.

  • You are generating a receipt to share with a user as evidence of tracker presence.

Do NOT use this tool when:

  • You want full tracker details per domain — use get_domain instead.

  • You want to look up an existing receipt — use get_receipt instead.

  • You need live probes (HTTP headers, stack detection) — use /v1/intel/* instead.

Inputs:

  • domains (body, required): Array of 1–50 fully qualified domain names. Duplicates are deduplicated. URLs are stripped to host component.

  • domain (body, alternative): Single domain string (shorthand for domains: [domain]).

Returns:

  • receipt_id: Unique receipt ID (e.g. rcpt_01JXYZ...).

  • receipt: Full receipt document including domains submitted, tracker findings, high-risk domains, fingerprinters, unique entities, and exposure metrics.

  • content_hash: SHA-256 of the canonical receipt JSON.

  • signature: Base64 Ed25519 signature (empty string if signing key not configured).

  • signed: Boolean — true if the receipt is cryptographically signed.

  • verify_url: Path to retrieve this receipt from the public registry.

Exposure levels: minimal / moderate / high / critical Based on average tracker score and proportion of high-risk domains (score ≥ 70).

Cost:

  • Counts as one request against the daily limit regardless of domain count.

Latency:

  • Typical: <100ms (pure D1 lookup, no outbound probing). p99: <300ms.

ParametersJSON Schema
NameRequiredDescriptionDefault
domainNoSingle domain shorthand (alternative to `domains`)
domainsNoDomain names to look up (1–50)
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fully carries the burden, disclosing that the receipt is stored in a public registry, verifiable at /verify/{receipt_id}, that signature may be empty if signing key is not configured, cost implications, and latency. It also explains deduplication and URL stripping.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections (intro, usage, inputs, returns, exposure, cost, latency), each sentence providing essential information. It is front-loaded with the core functionality and avoids redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers inputs, outputs, cost, latency, and alternatives comprehensively, despite lacking an output schema and annotations. It provides enough detail for an agent to invoke the tool correctly and understand its side effects.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Even though schema coverage is 100%, the description adds meaningful details: 'Array of 1–50 fully qualified domain names', 'Duplicates are deduplicated', 'URLs are stripped to host component', and the relationship between `domain` and `domains` as a shorthand alternative.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action: 'Looks up each submitted domain in the TunnelMind tracker database, aggregates risk metrics... and issues a signed surveillance receipt.' It clearly distinguishes from siblings by naming alternatives like get_domain, get_receipt, and /v1/intel/*.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides explicit 'Use this tool when' and 'Do NOT use this tool when' sections with concrete alternative tool names (get_domain, get_receipt, /v1/intel/*), giving clear context for selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_analyst_configAInspect

Returns the TunnelMind analyst config bundle. Configures any LLM (Claude, GPT, Gemini, local) to behave as a TunnelMind analyst that knows the data graph, follows the 5-call golden path, and surfaces attestation_tier on every claim.

The bundle is signed inline (Ed25519, key_id from /.well-known/receipt-signing-key.json). Add ?receipt=true to wrap the response in a Receipt v1.0 envelope for end-to-end audit.

Use this tool when:

  • You want to configure a new LLM runtime to act as a TunnelMind analyst

  • You want to verify the system prompt you're running matches what TunnelMind serves

  • You're building a BYOM (bring-your-own-model) deployment and need the canonical config

Do NOT use this tool when:

  • You want to call individual TunnelMind data tools — use the tools directly

  • You want to verify a specific receipt — use check_receipt_revoked or @tunnelmindai/receipt-verify

Inputs (all optional):

  • surface (query): "data" (default, full surface), "scry", or "sigil"

  • version (query): pin a specific bundle version (e.g. "1.0.0" or "1" for latest 1.x.y)

  • receipt (query): "true" to wrap the response in a signed Receipt v1.0 envelope

Content negotiation (via Accept header):

  • application/json (default) — full bundle JSON

  • text/markdown — system prompt only (Anthropic flavor)

  • application/vnd.anthropic.config+json — Anthropic-shaped subset

  • application/vnd.openai.config+json — OpenAI-shaped subset

Returns:

  • version, schema, issuer, surface, surface_label

  • system_prompts.{anthropic,openai,generic} — three encodings of the same semantic prompt

  • tools.surface_subset — array of operationIds for this surface (null = all)

  • response_format — JSON Schema the analyst's verdicts must conform to

  • attestation_tiers — the 4-tier vocabulary (self_asserted → silicon_root)

  • graph_state — live corpus counts at serve time

  • references — URLs to the rest of the open-protocol layer

  • bundle_signature — inline Ed25519 signature for offline verification

  • pin_recommended — stable supply-chain identifier (survives hourly graph_state updates)

Headers: X-Bundle-Version, X-Pin-Recommended, ETag, X-RateLimit-*.

Cost:

  • Free, anonymous-accessible. Rate-limited on a SEPARATE counter from data-API calls (cfg:ip:<ip> identity) so a config refetch loop can't burn your data quota.

Latency:

  • Typical <100ms (cached); cold fetch <500ms (live Supabase counts).

ParametersJSON Schema
NameRequiredDescriptionDefault
receiptNoWhen true, wrap the bundle in a Receipt v1.0 envelope.false
surfaceNodata
versionNoPin a specific bundle version. Omit for latest.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses a rich set of behaviors: inline Ed25519 signing with key source, Receipt v1.0 envelope wrapping via ?receipt=true, content negotiation via Accept headers, free anonymous access with a separate rate-limit counter, and latency expectations (<100ms typical, <500ms cold). This is far beyond what structured fields would provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Although lengthy, the description is excellently structured with labeled sections (Inputs, Content negotiation, Returns, Headers, Cost, Latency) and is front-loaded with the core purpose. Every sentence carries useful information; the bullet-style lists make it easily scannable for an agent.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is complex (config bundle, content negotiation, signing, versioning, surfaces) and has no output schema. The description enumerates the returned fields (version, schema, issuer, system_prompts, tools.surface_subset, response_format, attestation_tiers, graph_state, references, bundle_signature, pin_recommended), lists relevant headers, and explains cost and latency. This is comprehensive enough for an agent to invoke and parse responses correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 67% (receipt and version have descriptions; surface does not). The description adds meaning beyond the schema: clarifies surface default as 'full surface', explains version pinning with '1' for latest 1.x.y, and introduces Accept header content negotiation not present in the schema. It doesn't fully explain the scry/sigil surfaces, but adds enough to merit above baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Returns the TunnelMind analyst config bundle.' It clearly distinguishes from sibling data tools by positioning itself as the canonical config endpoint and explicitly excluding individual data tool calls in the 'Do NOT use' section, naming alternatives like check_receipt_revoked and @tunnelmindai/receipt-verify.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit 'Use this tool when' and 'Do NOT use this tool when' sections with concrete scenarios (configuring a new LLM runtime, verifying the system prompt, BYOM deployments) and named alternatives (use data tools directly, check_receipt_revoked). This gives clear guidance for an agent to select this tool over siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_api_keyAInspect

Returns the tier, label, masked owner email, creation date, last-used timestamp, today's request count, and daily request limit for the API key used in this request. Useful for agents that need to monitor their own quota consumption.

Use this tool when:

  • You want to check how many requests your key has used today.

  • You need to know your current tier or daily limit.

  • You want to confirm that your API key is active.

Do NOT use this tool when:

  • You want to manage multiple keys — this endpoint only reflects the calling key.

  • You need tracker data — use the tracker endpoints instead.

Inputs:

  • No body or query parameters. Auth is from the Authorization: Bearer header.

Returns:

  • tier: free, supporter, pro, or enterprise.

  • requests_today: integer count from KV (best-effort; resets at UTC midnight).

  • limit_per_day: null for enterprise (unlimited).

  • last_used: ISO 8601 timestamp, may be null if never used.

Cost:

  • Free. Does not count against the daily request limit.

Latency:

  • Typical: <150ms, p99: <400ms.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description carries full behavioral disclosure. It reveals that the request is free and does not count against the daily limit, notes that 'requests_today' is best-effort from KV and resets at UTC midnight, and gives latency estimates. It also clarifies auth via the Authorization header.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is moderately long but highly structured with sections for use cases, returned fields, cost, and latency. Bullet points make it scannable, and there is no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has no parameters and no output schema, the description fully compensates by specifying all return values, including edge cases like null last_used and unlimited enterprise limit. Usage guidance and cost/latency details make selection and invocation unambiguous.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With zero parameters in the schema, the description states 'No body or query parameters' and clarifies that auth comes from the Authorization header, which adds meaning beyond the empty schema. It also enumerates the exact return fields with types and edge cases.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb 'Returns' and enumerates exactly what is returned for the API key used in this request. It distinguishes from sibling tools like revoke_api_key and create_free_key by focusing on the calling key's quota and metadata.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit 'Use this tool when' and 'Do NOT use this tool when' sections lay out appropriate scenarios (monitor quota, check tier/limit, confirm active) and exclusions (managing multiple keys, needing tracker data) with an alternative ('use the tracker endpoints instead').

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_bgp_eventsAInspect

Returns the routing anomalies the bgp-monitor has observed against TunnelMind's BGP watchlist — the witnessability layer's routing dimension. The monitor polls RIPEstat (RIPE NCC) on a cron, self-baselines each watched prefix's origin set on first sight, then records an event whenever a later poll deviates from that baseline.

Use this to check whether a prefix or ASN you depend on (an SSP's egress, a publisher's network, your own infrastructure) has shown a hijack-shaped routing event. event_type is one of:

  • origin_change — an origin AS not in the baseline is announcing the prefix (severity critical if that announcement also fails RPKI, else high).

  • rpki_invalid — a current announcement fails RPKI ROA validation.

  • withdrawn — a previously-announced prefix is no longer visible.

  • new_more_specific / visibility_drop — reserved for a later monitor pass.

prev_origins is the baseline the event deviated from. count is the full filtered set; events is bounded by limit, newest first. An empty events array means no anomalies in the window — the honest "all clear".

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMax events returned (default 100, hard cap 500).
resourceNoFilter to one watched resource — a CIDR prefix (e.g. 45.32.0.0/24) or an ASN (e.g. AS13335). Omit for all.
since_msNoUnix epoch milliseconds lower bound on observed_at.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden and delivers rich disclosure: it explains the polling source (RIPEstat), the self-baselining mechanism, the event-type taxonomy with severity mapping, and return semantics including 'count is the full filtered set; events is bounded by limit, newest first.' This goes well beyond what structured fields provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but purposeful; every sentence contributes technical or behavioral context. It front-loads the core purpose, then moves through usage and field semantics, using a clean list for event types and no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only lookup with no output schema, the description fully equips the agent: it explains all event_type values, severity implications, `prev_origins`, pagination semantics, and the honest meaning of an empty `events` array. It even notes reserved event types for future monitor passes, leaving no critical interpretation gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds meaningful semantics: it explains that `limit` bounds the `events` array while `count` remains the full filtered set, and that results are newest-first. It also clarifies `resource` as a watched CIDR or ASN, which reinforces but goes slightly beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Returns the routing anomalies the bgp-monitor has observed against TunnelMind's BGP watchlist', immediately distinguishing it from sibling lookup and verification tools. It also grounds the tool in the 'witnessability layer's routing dimension', making its unique role clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly instructs when to use: 'Use this to check whether a prefix or ASN you depend on... has shown a hijack-shaped routing event.' This is clear context, but it does not name sibling alternatives or state when not to use it, so it misses the explicit exclusion criterion for a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_domainAInspect

Returns the complete surveillance intelligence record for a domain name. If the domain is in TunnelMind's tracker database (80,000+ entries), the response includes tracker category, risk score, fingerprinting data, cookie persistence, IAB TCF purposes, and the owning corporate entity. If the domain is not in the database, a live probe is automatically run: RDAP registration data, DNS records (MX, SPF, TXT verification tokens), HTTP headers, and CSP third-party actors are fetched fresh from the edge and returned.

Use this tool when:

  • You need to know whether a specific domain tracks users, and how aggressively.

  • You are researching who owns a domain and what corporate entity controls it.

  • You want to check HTTP security headers and third-party services embedded in a site.

  • You are building a risk score for a domain before routing traffic through it.

Do NOT use this tool when:

  • You want to search by keyword or category — use search instead.

  • You want all domains for an entity — use get_entity instead.

Inputs:

  • domain (path, required): Domain name. Strip www. prefix — it is removed automatically. Subdomains are resolved to the parent: ads.doubleclick.netdoubleclick.net. Examples: doubleclick.net, google-analytics.com, intercom.io.

Returns:

  • Full DomainRecord. Free tier returns the domain, category, score, prevalence, and entity name. Pro/enterprise additionally return tcf_vendor_id, tcf_purposes, tcf_features, and disconnect_cats.

  • If the domain is not in the tracker database, live_lookup: true is set and RDAP/DNS/HTTP probe results are returned instead of tracker fields.

  • 404 if the domain cannot be found via live probe either (unknown TLD, unreachable).

Cost:

  • Free tier: included in 50 req/day limit. Pro/enterprise: included in plan.

Latency:

  • Database hit: typical <100ms, p99 <300ms.

  • Live probe: typical 2-5s, p99 10s (external DNS/HTTP calls).

ParametersJSON Schema
NameRequiredDescriptionDefault
domainYesDomain name to look up (www. prefix stripped automatically)
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description fully carries the burden. It discloses automatic subdomain resolution, the live probe fallback, tier-dependent return fields, 404 errors, cost, and latency. No hidden behaviors remain.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but excellently structured with clear sections (overview, when to use, when not to use, inputs, returns, cost, latency). Every sentence provides necessary operational detail; nothing is filler. The opening sentence immediately establishes the core purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Gven the lack of an output schema, the description comprehensively covers return values (free vs pro fields, live_lookup flag, 404 response), error conditions, cost, and latency. It is fully self-contained for an agent to use the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

While schema already specifies the `domain` parameter, the description adds significant meaning: subdomain normalization (ads.doubleclick.net → doubleclick.net), concrete examples, and behavioral implications (www stripping, live probe consequences). This goes well beyond the schema's minimal description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool returns 'the complete surveillance intelligence record for a domain name' and details both database and live-probe modes. It explicitly differentiates from siblings by naming `search` and `get_entity` as alternatives for different use cases.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Extensive 'Use this tool when' scenarios are listed (tracking behavior, ownership research, header checks, risk scoring) alongside explicit 'Do NOT use' cases with named alternative tools. This leaves no ambiguity about when to choose this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_entityAInspect

Returns an entity record for a surveillance company or data broker, including its industry, estimated annual data value per user (in USD), categories of personal data collected, and the full list of domains it controls. Free tier returns 5 domains, paid returns up to 200.

Use this tool when:

  • You want to understand what corporate entity owns or controls a tracker domain.

  • You need to assess the total surveillance footprint of a company (e.g., Alphabet, Meta, Oracle).

  • You are building a corporate surveillance graph and need domain-to-entity mapping.

Do NOT use this tool when:

  • You have a domain and need its category — use get_domain instead.

  • You want to browse entities by industry — use list_entities instead.

  • You are searching for an entity by name — use search instead.

Inputs:

  • slug (path, required): URL-safe entity identifier (lowercase, hyphens). Examples: alphabet, meta, oracle-data-cloud, the-trade-desk.

Returns:

  • Full EntityRecord with data categories, estimated data cost, and associated domains.

  • domains: array of top-scoring domains (5 for free tier, 200 for paid).

  • Pro/enterprise additionally return website and description fields.

Cost:

  • Free tier: included in 50 req/day limit. Pro/enterprise: included in plan.

Latency:

  • Typical: <150ms, p99: <400ms.

ParametersJSON Schema
NameRequiredDescriptionDefault
slugYes
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations present, the description carries the full burden and excels: it discloses tier-based output limits (5 vs 200 domains), cost context (free tier vs Pro/enterprise), return fields, additional fields for higher tiers, and latency expectations (<150ms typical, <400ms p99). This goes well beyond a simple read-only statement.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections (Returns, Use when, Do NOT use, Inputs, Cost, Latency), but the returns information is duplicated: the opening paragraph lists fields and domain counts, then a later 'Returns' section repeats them. This small redundancy prevents a perfect score.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter lookup with no output schema, the description is highly complete. It covers purpose, alternatives, input semantics, tier behavior, cost, latency, and return content, leaving no significant gap in understanding.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description compensates fully for the single parameter slug. It explains that it is a URL-safe entity identifier (lowercase, hyphens) and provides concrete examples like alphabet, meta, and oracle-data-cloud, adding meaning beyond the schema's pattern.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Returns an entity record for a surveillance company or data broker,' listing the exact fields included. It clearly distinguishes itself from siblings like get_domain, list_entities, and search via explicit 'Do NOT use' guidance.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit 'Use this tool when' conditions and equally explicit 'Do NOT use this tool when' exclusions that name alternative tools (get_domain, list_entities, search). This gives the agent clear decision criteria for tool selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_feedbackAInspect

Public read of the crowd-sourced outcome aggregate for a node — how callers reported their real-world results after acting on its verdict. Advisory signal, not a trust verdict. An empty aggregate returns cleanly with total: 0 and signal: none.

signal is derived: none (no reports), insufficient (<3), positive / negative (score past ±0.3), or mixed.

ParametersJSON Schema
NameRequiredDescriptionDefault
nodeYesip, domain, asn, or entity slug.
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the burden of behavioral disclosure. It covers the read-only nature ('Public read'), empty aggregate return (`total: 0` and `signal: none`), and the derivation rules for `signal`. It could be more explicit about the response shape (e.g., whether a `score` field is always present), but covers key behaviors well.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is tightly structured in three short segments: purpose, empty aggregate edge case, and signal derivation logic. Every sentence adds value with no filler or repetition. It's front-loaded with the core purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter read tool with no output schema, the description explains the main return value (`total` and `signal`) and the signal derivation thresholds. It doesn't explicitly describe the full response structure (e.g., whether a `score` field is present), but it's reasonably complete for the tool's simplicity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already provides 100% coverage of the `node` parameter with a clear description ('ip, domain, asn, or entity slug.'). The tool description doesn't add further parameter-specific semantics beyond contextualizing node as the subject of the outcome aggregate, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Public read of the crowd-sourced outcome aggregate for a node — how callers reported their real-world results after acting on its verdict.' It uses a specific verb ('read') and resource (outcome aggregate), and explicitly distinguishes it from a trust verdict, differentiating it from sibling tools like explain_verdict or verdict_lookup.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides context about when to use it: it's an advisory signal on real-world outcomes, not a trust verdict. It also explains empty aggregate behavior. However, it doesn't explicitly name alternative tools or say 'use this instead of X', so it stops short of full usage guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_freshnessAInspect

D4 — the freshness contract a PDP can gate on. For each lens (Scry / Sigil / Tracker / GhostRoute) this reports the newest observation timestamp in the corpus, the declared ingest cadence (taken from the ingester's own code and cron schedules, never asserted), the published SLO, the current corpus age in seconds, and whether the SLO holds. GhostRoute reports its three corpus workers (CT hourly, RPKI 6-hourly, ASN daily) individually.

SLO rule: 2x the declared cadence — one fully missed ingest cycle trips it — except where an estate monitor already publishes a threshold, in which case the SLO matches the monitor.

Every source is independently null-tolerant: a momentarily-unmeasurable lens reports last_observation_at: null and slo_met: null — never a fabricated timestamp, never a silent pass. Cached ~5 minutes (unlike the weekly /v1/stats snapshot — freshness that was itself a week stale would be self-refuting).

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden and does so excellently. It discloses the SLO rule (2x cadence), explains that cadence comes from code/cron (never asserted), details null-tolerance behavior (null timestamps never fabricated), and reveals caching behavior. This goes well beyond a basic summary and gives the agent critical behavioral expectations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is reasonably concise given the complexity, but the opening 'D4 — the freshness contract' is somewhat cryptic and may require domain knowledge. Still, every sentence contributes useful detail, and the structure with clear paragraphs aids readability. It could be slightly tighter but earns a strong score.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description must explain return values. It fully covers the per-lens fields, the per-worker breakdown for GhostRoute, the SLO calculation, null-handling, and caching. For a read-only status tool, this is remarkably complete and leaves no ambiguity about what the agent will receive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, and the schema coverage is 100% (trivially). Per the baseline for no-parameter tools, a score of 4 is appropriate, since there is no parameter meaning to add. The description does not attempt to invent parameters and stays focused on output behavior.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: it reports freshness metrics per lens (Scry/Sigil/Tracker/GhostRoute), including observation timestamps, cadence, SLO, age, and whether the SLO holds. This is a specific verb ('reports') plus a well-defined resource (freshness contract), and it distinguishes itself from sibling tools like get_stats or snapshot_data by focusing on live freshness data.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage context ('a PDP can gate on') and contrasts with the weekly /v1/stats snapshot, explaining why this tool is cached only 5 minutes. However, it does not explicitly name when to use this over alternatives or specify exclusion criteria. The indirect comparison provides clear context but stops short of explicit guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_receiptAInspect

Returns metadata for a TunnelMind surveillance receipt — a signed document proving that a specific user's surveillance exposure was observed, measured, and recorded at a specific time. Does NOT return the receipt's signature (anti-phishing protection). To verify a receipt's content integrity, use verify_receipt with the hash and signature from the receipt document itself.

Use this tool when:

  • You have a receipt ID and want to confirm it was genuinely issued by TunnelMind.

  • You need the issuance timestamp and signing key ID for a receipt.

  • You want to check whether a receipt exists before attempting content verification.

Do NOT use this tool when:

  • You have the full receipt document and want to verify it hasn't been tampered with — use verify_receipt instead.

Inputs:

  • receipt_id (path, required): The receipt ID from the receipt document. Alphanumeric with hyphens, max 128 characters.

Returns:

  • status: FOUND if the receipt is in the registry.

  • generated_at: ISO 8601 timestamp of receipt issuance.

  • signing_key_id: identifier of the Ed25519 key used to sign.

  • schema_version: receipt schema version.

  • message: human-readable summary with instructions for content verification.

  • 404 if the receipt ID is not in the registry.

Cost:

  • Free. No API key required.

Latency:

  • Typical: <100ms, p99: <300ms.

ParametersJSON Schema
NameRequiredDescriptionDefault
receipt_idYes
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description fully carries the behavioral disclosure burden. It explicitly states the tool does NOT return the signature for anti-phishing protection, lists return fields, indicates 404 for missing IDs, and discloses cost and latency, providing comprehensive transparency beyond what any schema would reveal.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is structured with clear sections (purpose, usage, inputs, returns, cost, latency). While it is somewhat long, every sentence provides valuable information. The latency and cost details are beneficial but could be considered supplementary, yet they do not detract from the overall clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter tool with no output schema, the description covers all necessary aspects: detailed return fields, error handling (404), cost, latency, and explicit usage guidance. It is complete enough for an agent to invoke the tool correctly without additional context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Despite 0% schema description coverage, the description thoroughly explains receipt_id, including its source (receipt document), path location, alphanumeric format with hyphens, and max length. This adds meaningful semantic context beyond the schema's pattern and maxLength constraints.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it returns metadata for a TunnelMind surveillance receipt, using a specific verb and resource. It explicitly distinguishes itself from verify_receipt by noting it does NOT return the signature, and explains the difference between metadata and content verification.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit 'Use this tool when' and 'Do NOT use this tool when' sections, naming verify_receipt as the alternative for verification. This clearly guides the agent on when to select this tool vs. siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_self_viewAInspect

P83 Gate 1. The caller is the subject: every fact here comes from the TLS handshake and headers the caller has already sent, so there is no render, no browser, and nothing to authorize.

Three surfaces:

  • client — user-agent, HTTP protocol, TLS version/cipher, ClientHello length, the pre-hashed JA3/JA4 input components, header order.

  • state — how many cookies were sent (never their values), Referer, DNT, Global Privacy Control.

  • network — address, ASN and operator, coarse geography, edge colo, and the four-lens verdict on the caller's own IP.

Every field carries a coverage state from the same three-value vocabulary as /v1/verify: observed_clean, never_observed, degraded. There is no fourth state. Fields that run inside a page — localStorage, canvas fingerprinting, cookie values — are reported never_observed with reason not_observable_server_side, because they are outside a server's vantage rather than missing.

claim_vs_conduct compares the claimed user-agent against the shape of the request itself and returns consistent, mismatch, or unverifiable, with the evidence listed. It is deliberately narrow: JA4 requires Cloudflare Enterprise + Bot Management, so there is no portable fingerprint to look up in a public corpus, and this check only reports contradictions it can demonstrate from the request in hand. unverifiable is the honest default and is never dressed up as a pass.

Use this tool when:

  • You want to know what a server learns about your client without asking you anything.

  • You are checking whether a client's user-agent claim matches its conduct.

Do NOT use this tool when:

  • You need facts about some OTHER host — that is POST /v1/verify/{node}.

Must be called directly at data.tunnelmind.ai. Behind a proxy, the connection properties describe the proxy, not the caller.

?receipt=true attaches a signed Receipt v1.0 committed to the transparency log.

ParametersJSON Schema
NameRequiredDescriptionDefault
receiptNo
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Despite no annotations, the description thoroughly discloses behavioral traits: no rendering/browser/authorization, the three-value coverage vocabulary with no fourth state, the deliberate narrowness of claim_vs_conduct (unverifiable default), and the proxy effect on connection properties. This is comprehensive and prevents misuse.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with sections and bullet points, but is somewhat long due to detailed explanations about coverage states, JA4 limitations, and claim_vs_conduct behavior. While these details are valuable, a few sentences could be tightened without losing essential information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema or annotations, the description carries the full burden of explaining return data and operational nuances. It covers the three data surfaces, coverage states, edge cases, usage exclusions, and receipt behavior, making it complete for reliable tool selection and invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The only parameter `receipt` is explained in the description ('?receipt=true attaches a signed Receipt v1.0 committed to the transparency log'), fully compensating for the schema's 0% description coverage. The boolean semantics and its effect are clear.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'The caller is the subject' and enumerates three surfaces (client, state, network), clearly defining the tool as returning self-view data about the caller. It distinguishes from sibling tools by explicitly stating 'Do NOT use when... other host', making the purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes a dedicated 'Use this tool when' and 'Do NOT use this tool when' section, explicitly naming the alternative for other hosts (POST /v1/verify/{node}). It also adds the proxy caveat requiring direct calls to data.tunnelmind.ai, providing clear context for correct invocation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_statsAInspect

One public "state of the corpus" readout — the whole graph in a single call. Distinct from the Scry-only sensor stats at api.tunnelmind.ai/v1/stats (which this reuses for the scry block): this spans Scry, Sigil, and Tracker plus the attestation and routing layers.

Use it to cite live coverage — how many publishers / SSPs / DSPs / sell paths / sellers.json seats are in the Sigil supply graph, how many tracker entities and domains Tracker holds, how many ATAP witness events and OAIs the attestation layer carries, and how many BGP watchlist resources and routing events the monitor has recorded.

Every count is independent and null-tolerant: a momentarily-unavailable lens reports null, never a silent zero. Cacheable for ~10 minutes.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fully discloses critical behaviors: independent, null-tolerant counts ('reports null, never a silent zero'), cacheability for ~10 minutes, and public accessibility. These traits go beyond the basic 'read-only' implication and are genuinely useful for an agent deciding to call the tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact yet dense. The first sentence defines the tool, the second clarifies scope and distinction, the third gives usage context and examples, and the last addresses edge-case behavior and caching. Every sentence earns its place, and key information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-param read-only tool, the description covers the essential contextual ground: what's included (publishers, SSPs, DSPs, etc.), how to use it, and behavioral quirks (null tolerance, cache). The only minor gap is not describing the exact return structure (since no output schema exists), but the descriptive categories are likely sufficient for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the baseline is 4. The description adds no parameter syntax (unnecessary), but it does reference the 'scry block' in the output, which indirectly hints at response structure. This is acceptable given the empty input schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description nails the purpose: a 'state of the corpus' readout that spans multiple layers. It uses a specific verb ('get') and resource ('stats') while detailing exactly what is covered, and it explicitly distinguishes from Scry-only sensor stats, effectively differentiating it from potential alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides explicit when-to-use guidance: 'Use it to cite live coverage.' It also offers a clear alternative/exclusion: 'Distinct from the Scry-only sensor stats at api.tunnelmind.ai/v1/stats'. This tells the agent both when to invoke this tool and when not to.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_subscriptionAInspect

Read one of your subscriptions (signing_key redacted).

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the transparency burden. It discloses that the signing key is redacted in the response, which is a useful behavioral detail. However, it does not mention other behaviors such as authentication requirements, error conditions, or response format beyond the redaction note.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence that conveys the core action and a key output detail. No filler words or redundant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read operation with one parameter and no output schema, the description provides the essential purpose and a notable output caveat. However, it does not describe the full returned subscription object or any side effects, leaving some gaps for an agent to infer.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has a single 'id' parameter with no description (0% coverage). The tool description does not explain what 'id' refers to or its expected format, although the context of 'subscriptions' implies it is the subscription identifier. This falls short of compensating for the lack of schema documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses the specific verb 'Read' with the resource 'subscriptions', making the operation clear. The parenthetical 'signing_key redacted' adds a distinctive detail that helps differentiate from related tools like 'list_subscriptions' or 'delete_subscription'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrasing 'one of your subscriptions' implies this is for reading a single subscription, contrasting with the sibling 'list_subscriptions' for multiple. However, it does not explicitly mention alternatives or when not to use, so guidance is implicit rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_taskAInspect

Returns the current status of a task created by an ?async=true intel request. Poll this endpoint until status is one of: complete, failed, cancelled, expired. On complete, the result field contains the same payload the sync endpoint would have returned. On failed, error.message explains the failure.

Use this tool when:

  • You submitted an intel probe with ?async=true and need to retrieve the result.

  • You want to check whether a background task finished without opening an SSE stream.

Do NOT use this tool when:

  • You want real-time event streaming — use stream_task instead.

  • You have no task_id — submit a probe with ?async=true first.

Inputs:

  • task_id (path, required): 26-char ULID returned in the 202 response.

Returns:

  • status: pending | running | complete | failed | cancelled | expired.

  • result: populated when status is complete. Null otherwise.

  • error: populated when status is failed. Null otherwise.

  • expires_at: tasks expire 1 hour after creation.

Cost:

  • Free. Does not count against rate limits.

Latency:

  • Typical: <100ms.

ParametersJSON Schema
NameRequiredDescriptionDefault
task_idYes
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description fully discloses behavior: polling semantics, terminal statuses, result/error fields, expiration time, cost (free), and latency. This goes well beyond the minimal expectation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-organized with clear sections (Inputs, Returns, Cost, Latency). Every sentence contributes valuable information without verbosity, making it easy to scan and understand.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite no output schema, the description enumerates all possible statuses and the conditions for `result` and `error` fields, making the tool's behavior fully comprehensible. Cost and latency further enhance completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter `task_id` is explained as a 26-char ULID returned in the 202 response, adding useful origin context beyond the schema's pattern and example. With 0% schema description coverage, this compensation is strong.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool 'Returns the current status of a task created by an `?async=true` intel request', which is a specific verb and resource. It distinguishes itself from sibling tools by explicitly contrasting with `stream_task`.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit 'Use this tool when' and 'Do NOT use this tool when' sections provide clear context and name alternatives like `stream_task`. It also specifies prerequisites, such as having a task_id from an async request.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_website_historyAInspect

The over-time layer behind the site's website map (the radar's evolution). Every domain verify appends the domain's machinery tuple — origin AS, RPKI state, announced prefix, network country, CDN, certificate authority, registrar, owning entity, and the per-lens coverage tri-states — to an append-only change-log, one row per observed change (plus a daily heartbeat row per looked-up domain).

Honesty contract: first_recorded is when the observatory first looked at this domain — never presented as when the machinery came to exist. History accretes from real lookups starting 2026-08-04; a domain nobody has verified has zero rows, which is itself the honest answer.

ParametersJSON Schema
NameRequiredDescriptionDefault
domainYes
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Even with no annotations, the description fully discloses behavioral traits: append-only change-log, one row per observed change plus daily heartbeat, the honest interpretation of 'first_recorded', the start date (2026-08-04), and the zero-rows behavior for unverified domains. This exceeds what annotations typically provide and gives clear expectations about data completeness.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: it opens with the core purpose, then details the data composition, and finally explains honesty semantics and edge cases. While it is longer than strictly necessary, each sentence adds meaningful context—such as what the tuple contains and the zero-rows behavior—so it earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one parameter and no output schema, the description is quite comprehensive. It explains what data the history contains, the semantics of timestamps, and the behavior for unverified domains. It could be improved by briefly indicating the output format (e.g., list of change-log rows), but the description covers the most important context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description does not explicitly explain the 'domain' parameter, but it repeatedly references domains ('every domain verify', 'a domain nobody has verified'), implying that the parameter is the domain to look up. Since the schema has no description and coverage is 0%, the description should compensate more, but for a single obvious parameter, a score of 3 is adequate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it provides the over-time history ('the radar's evolution') of domain verification observations, and details exactly what data is recorded in the change-log. This distinguishes it from sibling tools like status_history or snapshot_diff by focusing on the append-only history of domain machinery tuples.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies this tool is for retrieving historical change-log data for a domain ('Every domain verify appends...'), but it does not explicitly state when to use this tool versus alternatives or provide exclusions. It explains the data source and semantics, but not the decision context for choosing it over other lookup tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ghostroute_ai_lookupAInspect

Checks whether a domain or ASN belongs to a known AI company's infrastructure and what sovereignty it CLAIMS (program, zone, HQ), the baseline GhostRoute scores routing reality against.

Use this tool when:

  • You want to know "whose AI infrastructure is this, and what does it claim?"

  • You are enriching an endpoint before deciding whether to send it inference.

Inputs:

  • entity (path, required): a domain or ASN (AS####).

Returns:

  • matched, match_basis (domain|asn), ai_company, ai_product, sovereign_ai_program, claimed_sovereign_zone, hq_country, verified_sovereign.

Latency:

  • Typical <300ms (cached corpus read).

ParametersJSON Schema
NameRequiredDescriptionDefault
entityYes
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses that this is a cached corpus read with typical <300ms latency, and emphasizes the distinction between claimed and verified sovereignty via the `verified_sovereign` field. This is transparent for a read-only lookup, though it could mention auth or error behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with sections for use cases, inputs, returns, and latency. Every sentence earns its place; there is no fluff, and the main purpose is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter lookup tool with no output schema, the description is remarkably complete: it explains inputs, lists all return fields, notes latency, and gives usage scenarios. It fully equips an agent to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, but the description fully compensates by explaining that `entity` is a domain or ASN in the 'AS####' format, and marks it as path/required. This adds meaning beyond the bare string type in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool checks whether a domain or ASN belongs to a known AI company's infrastructure and reports claimed sovereignty. It specifies the resource (domain/ASN) and outcome, distinguishing it from sibling lookups like ghostroute_asn_lookup by adding sovereignty claims.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit 'Use this tool when' bullets with concrete scenarios (identifying AI infrastructure, enriching endpoints before inference). It does not explicitly mention when not to use or alternative tools, so it falls short of a 5, but it gives clear context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ghostroute_asn_lookupAInspect

Returns GhostRoute's ownership-graph record for an autonomous system: the registrant/parent organisation, its HQ country and sovereign zone, RIR, and cloud/AI-infrastructure flags. The long-term moat — who actually owns the network a route originates from.

Use this tool when:

  • You have an origin ASN and need its corporate owner + jurisdiction.

  • You are assessing whether an ASN belongs to a cloud front or the real operator.

Inputs:

  • asn (path, required): AS#### or a bare AS number.

Returns:

  • registrant_org, parent_org, parent_org_country, sovereign_zone, rir, is_cloud_provider, is_ai_infrastructure, or {matched:false}.

Latency:

  • Typical <300ms (cached corpus read, RDAP fallback on a miss).

ParametersJSON Schema
NameRequiredDescriptionDefault
asnYes
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses the `{matched:false}` return on misses, a cached corpus with RDAP fallback, and typical sub-300ms latency. This adds behavioral depth beyond simply stating 'returns data', though it does not cover auth or error states.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-organized into purpose, usage, inputs, returns, and latency sections. It is front-loaded and efficient, though the 'long-term moat' phrase adds a touch of flourish without being harmful.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter lookup with no output schema, this description is comprehensive: it documents return fields, input format, usage context, latency, and the not-found sentinel. No critical gaps are apparent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero description coverage for the `asn` parameter, so the description compensates by specifying the format ('AS#### or a bare AS number') and that it is a required path parameter. This is more meaningful than the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb ('Returns') plus the resource ('GhostRoute's ownership-graph record for an autonomous system') and enumerates the exact data fields returned. It clearly distinguishes this from sibling lookups by focusing on ASN ownership and jurisdiction rather than AI or domain-specific data.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

An explicit 'Use this tool when' section provides two concrete scenarios: needing corporate owner/jurisdiction from an origin ASN, or assessing whether an ASN belongs to a cloud front vs. real operator. It lacks explicit exclusions or alternative tool names, but the context is sufficiently clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ghostroute_checkAInspect

GhostRoute is TunnelMind's fourth lens: routing-integrity / sovereignty verification. It answers "is this infrastructure where it claims to be, owned by who it claims, routing where it says — and does that match the sovereign jurisdiction it asserts?" It resolves the originating ASN owner, RPKI validity, the certificate-issuing CA's jurisdiction, and matches the subject against a curated AI-infrastructure corpus to recover any sovereignty CLAIM (e.g. an "EU-sovereign" AI service), then scores reality against claim.

Use this tool when:

  • An agent is about to route data/inference to an endpoint that claims a jurisdiction (e.g. EU data residency, FedRAMP, sovereign-AI).

  • You want to detect a US-fronted (Cloudflare/AWS/GCP) endpoint masquerading as sovereign-EU infrastructure, an RPKI-invalid origin (possible hijack), or a sanctioned operator.

Inputs:

  • entity (path, required): an IPv4/IPv6, domain, ASN (AS####), or cert SHA-1/256.

  • receipt (query, optional): when true, issues a signed, persisted GhostRoute receipt (GR-YYYY-NNNNNNN) instead of an ephemeral verdict.

Returns:

  • sovereign_tier: VERIFIED | PLAUSIBLE | MISMATCH | CRITICAL_MISMATCH (or null if no claim).

  • sovereign_integrity: [0,1] score; origin_as, rpki_status, cert_ca, claimed_sovereign_zone, is_ai_infrastructure, ai_owner, sanctions_match.

  • _meta.caveats / _meta.penalties: what was and wasn't determinable.

Latency:

  • Typical 300-900ms on a cold subject (live BGP/RPKI/cert lookups), faster when cached.

ParametersJSON Schema
NameRequiredDescriptionDefault
entityYesAn IPv4/IPv6 address, domain, ASN (`AS####`), or cert SHA-1/256 to check.
receiptNoWhen `true`, issues a signed, persisted GhostRoute receipt (`GR-YYYY-NNNNNNN`) instead of an ephemeral verdict.
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description reveals that it performs live lookups, returns caveats/penalties, and can optionally persist a signed receipt. It also states typical latency, though it doesn't disclose auth or rate limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is structured with sections (use-when, inputs, returns, latency) and front-loaded with purpose, but it's longer than necessary—some elaboration could be tightened.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no output schema and no annotations, this description provides an exceptionally complete picture: return fields, scoring tiers, caveats, latency, and even the receipt identifier format. It leaves little ambiguity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already covers both parameters at 100%; the description adds the accepted formats (IPv4/IPv6, domain, ASN, cert hash) and details the receipt's persistent ID format, going beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb (verifies routing-integrity/sovereignty) and resource (endpoint infrastructure), and clearly distinguishes this 'fourth lens' from sibling tools by explaining the claim-vs-reality scoring.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly lists concrete scenarios ('Use this tool when...') such as routing data to jurisdiction-claiming endpoints or detecting masquerading/hijacked origins. It doesn't mention when not to use it or alternatives, but the guidance is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ghostroute_ct_alertsAInspect

Returns the durable, deduplicated ledger of CT equivocation events the GhostRoute witness worker detects and pushes — a tree_size_rewind (an append-only log shrank), a root_fork (one tree_size witnessed with two different Merkle roots = a split-view log), or an sth_signature_invalid (a log's latest Signed Tree Head failed signature verification). Where /v1/ghostroute/witness shows live computed health, this is the immutable first-detection log: each entry's detected_at is when TunnelMind first raised the alarm. A healthy CT ecosystem returns an empty feed — any row here is a serious trust event.

Use this tool when:

  • You want a chronological record of CT trust violations, not live state.

  • You're polling for new equivocation events (check summary.last_detected_at).

Inputs:

  • limit (query, optional): max recent alerts, 1–200, default 50.

Returns:

  • summary: total, undelivered, rewinds, forks, bad_signatures, last_detected_at.

  • alerts[]: each kind, severity, log_url, log_operator, from_tree_size, to_tree_size, distinct_roots, event_observed_at, detected_at, delivered.

Latency:

  • Typical <200ms (KV-cached 1m).

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden and does well: it discloses durability, deduplication, immutability ('immutable first-detection log'), the meaning of an empty feed ('healthy CT ecosystem returns an empty feed'), and latency (KV-cached 1m, typical <200ms). However, it does not explicitly state read-only semantics or mention auth/rate limits, though the phrasing implies a read operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is moderately long but well-structured: purpose, usage, inputs, returns, latency. It is front-loaded with the core purpose and every section earns its place. It could be tightened slightly, but the structure aids comprehension.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given there is no output schema, the description thoroughly covers the return shape: both the summary fields (total, undelivered, rewinds, forks, bad_signatures, last_detected_at) and the alerts array fields (kind, severity, log_url, log_operator, from_tree_size, to_tree_size, distinct_roots, event_observed_at, detected_at, delivered). It also explains event semantics and latency, making it complete for an agent to select and invoke the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema provides only a parameter named 'limit' with numeric constraints and no description (0% schema coverage). The description compensates by explaining 'limit (query, optional): max recent alerts, 1–200, default 50.' This adds the semantic meaning of limiting recent alerts, which is exactly what the schema lacks.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Returns the durable, deduplicated ledger of CT equivocation events.' It enumerates exact event kinds (tree_size_rewind, root_fork, sth_signature_invalid) and explicitly contrasts with '/v1/ghostroute/witness' (live computed health), clearly distinguishing itself from the sibling ghostroute_ct_witness tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit 'Use this tool when' bullets: for a chronological record of CT trust violations and for polling new events (check summary.last_detected_at). It also implies when not to use it by stating it is 'not live state' and referencing the witness endpoint for live health. This gives clear contextual guidance and an alternative.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ghostroute_ct_proofsAInspect

Returns GhostRoute's per-cert inclusion proofs: each is a cryptographic demonstration that the exact certificate a host serves is included in an append-only CT log whose root TunnelMind signature-verified — upgrading "a monitor said this cert exists" to "proven in a log we witness". Failed attempts are included with a reason; a cert that suddenly cannot be proven is itself a signal.

Use this tool when:

  • You want to know whether a specific AI host's live cert is provably logged (pass domain), or

  • You want the corpus-wide proof rollup across watched hosts (omit domain).

Inputs:

  • domain (query, optional): a hostname to filter to; omit for corpus-wide.

  • limit (query, optional): max recent rows, 1–200, default 50.

Returns:

  • domain (echo, null when corpus-wide).

  • summary: total_attempts, proven, unproven, domains, last_observed_at.

  • recent[]: recent attempts (log_operator, leaf_index, tree_size, sth_root_hash, inclusion_proven, reason, ...).

  • by_domain[]: per-host attempts / proven rollup.

Latency:

  • Typical <300ms (KV-cached 5m).

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
domainNo
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden and does so richly: it discloses failed attempts include a `reason`, that a cert suddenly unprovable is itself a signal, and that results are KV-cached for 5 minutes with typical latency under 300ms. This goes beyond a simple read operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well structured with clear sections (Use, Inputs, Returns, Latency) and front-loaded purpose. Every sentence contributes meaningful context, from the cryptographic explanation to latency boundaries, with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and no annotations, the description provides a complete picture: purpose, when to use, input semantics, output field details, interpretation of failures, and performance expectations. It is self-sufficient for an AI agent to select and invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, but the description fully compensates: `domain` is explained as an optional hostname filter, while `limit` is documented as max recent rows with range 1–200 and default 50. This adds real meaning beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Returns GhostRoute's per-cert inclusion proofs.' It clearly distinguishes this from sibling tools by emphasizing cryptographic demonstration of CT log inclusion, which differs from alerts, witness, and verification tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit 'Use this tool when' bullets provide clear use cases: checking a specific domain's live cert provability or getting a corpus-wide rollup. It doesn't name alternative sibling tools or state when not to use it, but the context is clear and actionable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ghostroute_ct_witnessAInspect

Returns GhostRoute's first-party Certificate-Transparency witness state: the latest signature-verified Signed Tree Head (STH) for every trusted, non-Google CT log TunnelMind independently witnesses, plus a regression scan over our own append-only history. Proof the platform holds its own signature-checked roots rather than reselling crt.sh/certspotter.

Use this tool when:

  • You want corpus-wide CT witness health, not one cert.

  • You need to know whether any CT log misbehaved (rewound, forked, or served an STH whose signature did not verify) — a serious trust event.

Inputs:

  • none.

Returns:

  • summary: logs_witnessed, verified_logs, unverified_logs, all_verified, total_snapshots, regressions, last_observed_at.

  • logs[]: per-log latest STH (log_url, log_operator, tree_size, sth_timestamp, root_hash, signature_verified, snapshots).

  • regressions[]: detected violations — kind is tree_size_rewind, root_fork, or sth_signature_invalid (empty array = healthy).

Latency:

  • Typical <300ms (KV-cached 5m; the witness worker updates twice a day).

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses detailed behavior: returns specific fields for logs and regressions, lists regression violation kinds, states latency (<300ms), caching (KV-cached 5m), and update frequency (twice a day). It also explains the trust context ('Proof the platform holds its own signature-checked roots'). This is a rich, transparent disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections (purpose, when to use, inputs, returns, latency). It is front-loaded with the main function, and every sentence adds value—covering output fields, regression kinds, and performance. No fluff or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite no output schema, the description fully documents the return structure, including the summary fields, per-log array, and regressions array with their possible kinds. It also covers use cases and performance characteristics, making the tool fully actionable for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and an empty input schema, so the baseline is 4. The description explicitly states 'Inputs: none,' confirming there is nothing for the agent to configure. No additional parameter semantics are needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a precise verb, 'Returns GhostRoute's first-party Certificate-Transparency witness state: the latest signature-verified Signed Tree Head (STH) for every trusted, non-Google CT log... plus a regression scan.' This clearly states what the tool does and its scope (corpus-wide), and distinguishes it from per-certificate tools with the phrase 'not one cert.'

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides an explicit 'Use this tool when' section with two specific conditions: 'corpus-wide CT witness health' and detecting log misbehavior. It also excludes per-certificate use with 'not one cert,' but it does not name alternative sibling tools, so it stops short of a full 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ghostroute_verifyAInspect

Retrieves a previously-issued, signed GhostRoute receipt by its GR-YYYY-NNNNNNN id, for independent audit of a past sovereignty verdict.

Use this tool when:

  • You hold a GhostRoute receipt id and want to confirm its contents/signature.

  • You are reconciling an agent's action log against the attestation layer.

Inputs:

  • receipt_id (path, required): GR-YYYY-NNNNNNN.

Returns:

  • The full persisted receipt row (routing, cert, sovereignty fields + signature).

Latency:

  • Typical <200ms (single indexed read).

ParametersJSON Schema
NameRequiredDescriptionDefault
receipt_idYes
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses that the tool returns 'the full persisted receipt row (routing, cert, sovereignty fields + signature)' and notes typical latency (<200ms) and that it is a 'single indexed read'. This implies a read-only, fast operation without needing to state explicit permissions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections (Inputs, Returns, Latency). Each sentence provides necessary information without redundancy. It is appropriately sized for a simple lookup tool and the key purpose is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has only one parameter, no output schema, and no annotations, the description covers all essential aspects: what it does, when to use it, the input format, the return content, and expected performance. It is complete enough for an agent to select and invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema only lists receipt_id as a string with no description, so schema coverage is 0%. The description compensates fully by specifying the exact format 'GR-YYYY-NNNNNNN' and noting it is a required path parameter. This adds critical meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb ('Retrieves'), a specific resource ('signed GhostRoute receipt'), and a precise identifier format ('GR-YYYY-NNNNNNN'). It also states the tool's purpose ('independent audit of a past sovereignty verdict'), which clearly distinguishes it from generic receipt lookups.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes a 'Use this tool when' section with two concrete scenarios: confirming a receipt's contents/signature and reconciling an action log. This gives clear context, though it does not explicitly name alternative tools or state when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

health_checkAInspect

Returns a minimal status object confirming the API is alive. Use this to verify connectivity before chaining other calls, or as a liveness check in a workflow.

Use this tool when:

  • You need to verify the API is reachable before starting a multi-step investigation.

  • A prior call failed with a 503 or 504 and you want to confirm the service recovered.

  • You are debugging connectivity from a new environment.

Do NOT use this tool when:

  • You want actual tracker data — use get_domain or search instead.

  • You want to check a specific domain — this returns nothing domain-specific.

Inputs:

  • None.

Returns:

  • ok: always true if the API is up.

  • ts: ISO 8601 timestamp of the server's current time.

Cost:

  • Free. No API key required. Not rate-limited.

Latency:

  • Typical: <50ms, p99: <200ms.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden and does so admirably. It discloses the exact return fields ('ok', 'ts'), cost ('Free'), authentication needs ('No API key required'), rate limits ('Not rate-limited'), and latency (typical and p99). No contradictions with annotations since none exist.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections (what, when, inputs, returns, cost, latency). Every sentence serves a purpose—no fluff. It is slightly long but highly informative, making efficient use of space.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite the tool's simplicity, the description covers all essential contexts: purpose, use cases, non-use cases, inputs (none), outputs (with descriptions), cost, and performance. It is fully complete for an agent to decide when and how to invoke it, especially given the empty schema and no output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, and the description explicitly states 'Inputs: None.' This aligns with the baseline of 4 for zero-param tools and adds a useful explicit confirmation. Since there are no parameters to document, the description cannot add more value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Returns a minimal status object confirming the API is alive.' It uses a specific verb ('returns') and resource ('status object'), and distinguishes from siblings by explicitly directing away from data retrieval tools like get_domain and search.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit 'Use this tool when' and 'Do NOT use this tool when' sections, with concrete scenarios (connectivity verification, 503/504 recovery) and named alternatives (get_domain, search). This is exemplary usage guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

intel_agentAInspect

Probes a domain for known AI agent integration signals: llms.txt, ai.txt, /.well-known/ai-plugin.json, openapi.json, swagger.json, MCP manifest, MCP SSE endpoint. Returns a score based on the count of signals detected. Use this to assess whether a domain is ready for agent-to-agent interaction.

Use this tool when:

  • You want to know whether a domain exposes an MCP server or OpenAPI spec for agents.

  • You are cataloguing the AI-agent-ready surface of a set of domains.

  • You need to decide whether to attempt programmatic API access to a domain.

Do NOT use this tool when:

  • You need tracker/surveillance data about the domain — use get_domain instead.

  • You need the robots.txt AI crawler policy — use intel_robots instead.

  • You need HTTP security posture — use intel_http instead.

Inputs:

  • domain (query, required): Domain to probe.

Returns:

  • Boolean flags per signal (llms_txt, ai_plugin, openapi, mcp_manifest, mcp_endpoint, mcp_sse).

  • agent_surface_score: integer 0-8, count of signals detected.

Cost:

  • Free. No API key required.

Latency:

  • Typical: 2-5s (parallel probes), p99: 8s.

ParametersJSON Schema
NameRequiredDescriptionDefault
asyncNoWhen true, return a task handle immediately instead of blocking. Poll get_task for the result.
domainYes
receiptNoWhen true, attach a signed Receipt v1.0 committed to the transparency log. Additive — a signing failure never costs you the observation (ADR-014).
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Since no annotations are provided, the description carries the full burden. It transparently discloses the signals probed, return shape (boolean flags plus agent_surface_score 0-8), cost (free), and latency (typical 2-5s, p99 8s). It does not detail failure modes or edge cases (e.g., unreachable domains), but the core behavioral profile is well covered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections: purpose, when to use, when not to use, inputs, returns, cost, and latency. Every section earns its place, and the core purpose is front-loaded. No redundant or filler content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the absence of an output schema, the description fully specifies the output (boolean flags and integer score) and provides cost and latency. It also covers use cases, alternatives, and input requirements. This is complete for a signature probe tool, leaving little ambiguity about behavior or results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is high (67%), and async/receipt already have descriptions in the schema. The description's Inputs section only mentions 'domain' as 'Domain to probe', adding marginal meaning beyond the schema's example. It doesn't comment on the async or receipt parameters at all, but they are adequately documented in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Probes') and resource ('a domain for known AI agent integration signals'), enumerating the exact signals (llms.txt, ai.txt, etc.). Clearly differentiates from siblings like intel_http, intel_robots, and get_domain by naming them in the 'Do NOT use' section.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit 'Use this tool when' and 'Do NOT use this tool when' bullet lists, naming specific alternative tools (get_domain, intel_robots, intel_http) and the exact scenarios that call for them. This gives clear decision guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

intel_httpAInspect

Makes a live HEAD request to the target domain from the Cloudflare edge, follows up to 5 redirects, and returns the full redirect chain, final HTTP status, key response headers, a security header score, and any third-party surveillance actors referenced in the Content-Security-Policy header.

Use this tool when:

  • You want to verify whether a site enforces HTTPS and HSTS.

  • You need to inspect what third-party scripts a site loads via its CSP header.

  • You are assessing a domain's security posture before trusting it.

  • You want to detect surveillance actors embedded in a site's CSP.

Do NOT use this tool when:

  • You need tracker database data (category, score, entity) — use get_domain instead.

  • You need the technology stack (CMS, framework) — use intel_stack instead.

  • You need robots.txt AI crawler policy — use intel_robots instead.

Inputs:

  • domain (query, required): Domain to probe. Can include or omit https://. Examples: nytimes.com, https://example.com.

Returns:

  • reachable: false if the domain did not respond within 6 seconds.

  • redirect_chain: each hop with URL, status code, and Location header.

  • security_headers.score: 0-100 based on presence of HSTS, CSP, X-Content-Type, X-Frame-Options, Referrer-Policy.

  • security_headers.missing: list of headers absent.

  • csp_actors: known surveillance actors detected in the CSP header.

  • error: set if the connection failed.

Cost:

  • Free. No API key required.

Latency:

  • Typical: 1-3s (outbound fetch), p99: 6s (timeout). Plan for async if chaining calls.

ParametersJSON Schema
NameRequiredDescriptionDefault
asyncNoWhen true, return a task handle immediately instead of blocking. Poll get_task for the result.
domainYes
receiptNoWhen true, attach a signed Receipt v1.0 committed to the transparency log. Additive — a signing failure never costs you the observation (ADR-014).
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the transparency burden. It discloses the live network request nature, 5-redirect limit, 6-second timeout, return schema details, free cost, and 1-3s typical latency. It even notes that async may be needed for chaining calls, making behavior predictable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but organized with labeled sections (Use this tool when, Do NOT use, Inputs, Returns, Cost, Latency), each earning its place. Information is scannable and front-loaded with the core action.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and high behavioral complexity, the description provides complete operational context: return fields defined, timeout, cost, and explicit alternative routing. An agent could confidently decide to invoke or avoid this tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 67% (async/receipt described; domain only has an example). The description compensates by explaining domain format ('Can include or omit https://') with examples. Async and receipt already have schema descriptions, so the tool covers all parameters adequately.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource: 'Makes a live HEAD request to the target domain' and enumerates unique outputs (redirect chain, security header score, CSP actors). It distinguishes itself from siblings through the 'Do NOT use' section, naming intel_stack and intel_robots as alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Lists explicit use cases ('verify whether a site enforces HTTPS and HSTS', 'inspect third-party scripts via CSP') and explicit exclusions with tool alternatives ('use get_domain', 'use intel_stack', 'use intel_robots'). This leaves no ambiguity about placement among the sibling set.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

intel_injectAInspect

Fetches a domain's homepage and checks for content patterns that could constitute prompt injection attacks against AI agents that visit and ingest the page. Signals include hidden text, invisible divs, <!-- AI: ignore --> style comments, and known injection patterns.

Use this tool when:

  • You are vetting a domain before feeding its content into an LLM context.

  • You want to assess the prompt injection risk of a URL before browsing it with an agent.

  • You are auditing a set of domains for adversarial AI content.

Do NOT use this tool when:

  • You want tracker surveillance data — use get_domain instead.

  • You want AI training opt-out signals — use intel_optout instead.

  • You want the agent surface (MCP/OpenAPI) — use intel_agent instead.

Inputs:

  • domain (query, required): Domain to scan.

Returns:

  • injection_signals: list of signal types detected (e.g., hidden_text, ai_instruction_comment, invisible_div).

  • risk_level: none, low, medium, or high based on signal count and type.

Cost:

  • Free. No API key required.

Latency:

  • Typical: 2-4s (HTML fetch), p99: 7s.

ParametersJSON Schema
NameRequiredDescriptionDefault
asyncNoWhen true, return a task handle immediately instead of blocking. Poll get_task for the result.
domainYes
receiptNoWhen true, attach a signed Receipt v1.0 committed to the transparency log. Additive — a signing failure never costs you the observation (ADR-014).
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It covers the operation (fetching homepage, scanning for patterns), return values (injection_signals, risk_level), cost (free, no API key), and latency (2-4s typical, p99 7s). It also explains the risk level scale. This is comprehensive and transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections (Purpose, Use when, Do NOT use when, Inputs, Returns, Cost, Latency). It is front-loaded with the primary purpose and every sentence adds value without fluff. Despite being moderately long, it remains highly readable and organized.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description fully explains return values (injection_signals, risk_level) and the risk scale. It covers cost, latency, use cases, and exclusions. It also explicitly states the scope (domain's homepage) and does not overreach. For a tool with this complexity, the description is complete and leaves no significant gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema covers async and receipt with descriptions, but domain lacks a description. The tool description adds 'Domain to scan' for domain and provides overall context for using the tool. It doesn't elaborate on the optional parameters, but the schema does, so the description adds meaningful value to the required parameter and compensates for the missing schema description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose with a specific verb and resource: 'Fetches a domain's homepage and checks for content patterns that could constitute prompt injection attacks against AI agents.' It lists concrete signals like hidden text, invisible divs, and AI-ignore comments, and explicitly distinguishes from sibling tools by naming alternatives for related but different tasks (tracker surveillance, opt-out signals, agent surface).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit 'Use this tool when' and 'Do NOT use this tool when' sections, listing concrete scenarios and alternative tools (get_domain, intel_optout, intel_agent). This makes the decision boundary crystal clear for an agent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

intel_optoutAInspect

Checks a domain for all known AI training data opt-out mechanisms beyond robots.txt: TDM (Text and Data Mining) reservation headers, <meta name="ai"> tags, Creative Commons NonCommercial licenses, and other machine-readable opt-out signals.

Use this tool when:

  • You need to determine whether a domain has opted out of AI training data collection.

  • You are checking compliance before using a domain's content in a training dataset.

  • You want a comprehensive opt-out status (robots.txt + TDM + meta tags combined).

Do NOT use this tool when:

  • You only need robots.txt crawler policy — use intel_robots instead (faster).

  • You need tracker data — use get_domain instead.

  • You want injection risk assessment — use intel_inject instead.

Inputs:

  • domain (query, required): Domain to probe.

Returns:

  • tdm_reservation: true if the domain sends a TDM-Reservation: 1 header.

  • noai_meta: true if the HTML contains <meta name="robots" content="noai">.

  • license_detected: string if a CC NonCommercial or similar license is detected, otherwise null.

  • opted_out: true if any opt-out signal is present.

Cost:

  • Free. No API key required.

Latency:

  • Typical: 2-4s, p99: 7s.

ParametersJSON Schema
NameRequiredDescriptionDefault
asyncNoWhen true, return a task handle immediately instead of blocking. Poll get_task for the result.
domainYes
receiptNoWhen true, attach a signed Receipt v1.0 committed to the transparency log. Additive — a signing failure never costs you the observation (ADR-014).
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so the description carries the full burden. It discloses cost, latency (typical and p99), and the exact output fields. It implies a read-only check (no mutation implied). Missing minor details like rate limits or error behavior, but for a simple probe tool this is strong transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-structured with clear sections (purpose, when to use, when not, inputs, returns, cost, latency). The text is longer than a bare-bones description but every line earns its place, and the format makes it easy to scan. Slightly verbose for a simple lookup, but justified by the need to explain the different opt-out signals.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema is present, so the description fully compensates by listing and explaining each return field (tdm_reservation, noai_meta, license_detected, opted_out). It also covers cost, latency, and alternatives. For a tool of this complexity, the description is complete enough for an agent to invoke and interpret results without further context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema already describes async and receipt parameters (67% coverage); description only repeats 'domain: Domain to probe' without adding semantic detail beyond the example in the schema. The description does clarify the domain is the probe target, but this is minimal added value given schema coverage is already moderate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb+resource ('Checks a domain for all known AI training data opt-out mechanisms') and clearly enumerates the signal types (TDM headers, meta tags, CC licenses). It explicitly distinguishes from sibling tools like intel_robots and intel_inject, making the purpose unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit 'Use this tool when' and 'Do NOT use this tool when' sections with named alternatives (intel_robots, get_domain, intel_inject). This is the gold standard for usage guidance, telling the agent not just when but when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

intel_robotsAInspect

Retrieves the target domain's robots.txt file and parses it for AI crawler disallow rules. Specifically detects policies for known AI crawlers (GPTBot, ClaudeBot, CCBot, Bytespider, etc.) and returns a structured summary of the crawling policy.

Use this tool when:

  • You need to know whether a domain has opted out of AI training data collection.

  • You want to check if a specific AI crawler is blocked before citing the domain.

  • You are building a dataset of AI-accessible vs AI-blocked domains.

Do NOT use this tool when:

  • You want training opt-out signals beyond robots.txt (TDM reservation, noai meta) — use intel_optout instead.

  • You want the full technology stack — use intel_stack instead.

  • You need tracker database data — use get_domain instead.

Inputs:

  • domain (query, required): Domain to probe.

Returns:

  • robots_txt_found: false if the domain returned 404 or the file is empty.

  • ai_crawlers_blocked: list of AI crawler user-agent names that are disallowed.

  • all_blocked: true if User-agent: * with Disallow: / is present.

  • raw: first 4096 characters of the robots.txt file.

Cost:

  • Free. No API key required.

Latency:

  • Typical: 1-2s, p99: 6s.

ParametersJSON Schema
NameRequiredDescriptionDefault
asyncNoWhen true, return a task handle immediately instead of blocking. Poll get_task for the result.
domainYes
receiptNoWhen true, attach a signed Receipt v1.0 committed to the transparency log. Additive — a signing failure never costs you the observation (ADR-014).
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full behavioral burden. It discloses cost ('Free. No API key required.'), latency (typical 1-2s, p99 6s), return value details, and the truncation of raw output to 4096 characters. It does not explicitly mention rate limits or other failure modes, but the disclosed information is meaningful and goes beyond what annotations would provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections: overview, use cases, exclusions, inputs, returns, cost, latency. Every section adds useful information without redundancy or padding. It is longer than a minimal description but earns its length by providing actionable detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having no output schema, the description enumerates the exact return fields (robots_txt_found, ai_crawlers_blocked, all_blocked, raw) with explanations, which is essential for an agent to interpret results. Combined with usage guidance, cost, latency, and parameter info, the description fully compensates for missing annotations and schema detail.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 67% (domain lacks a description, async/receipt have descriptions). The description adds context for the primary `domain` parameter ('Domain to probe') but does not mention async or receipt at all. The schema already covers those, and the description's domain context is marginal, so the value added beyond structured fields is limited.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description opens with a specific verb+resource: 'Retrieves the target domain's robots.txt file and parses it for AI crawler disallow rules.' It clearly distinguishes from sibling tools by naming alternatives like intel_optout, intel_stack, and get_domain. This is precise and unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit 'Use this tool when' and 'Do NOT use this tool when' sections give concrete decision criteria and name specific alternative tools (intel_optout, intel_stack, get_domain). This is exactly the level of guidance needed for an agent to choose correctly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

intel_stackAInspect

Fetches up to 32KB of the domain's HTML and response headers from the edge, then fingerprints the content for known CMS platforms, JavaScript frameworks, CDN providers, and analytics tools. Detection is based on meta generator tags, script src patterns, response headers, and cookie names.

Use this tool when:

  • You need to know what CMS (WordPress, Drupal, Shopify) a site runs.

  • You are assessing a domain's infrastructure before a security review.

  • You want to identify analytics or marketing tools a site embeds.

Do NOT use this tool when:

  • You want HTTP headers and security posture — use intel_http instead.

  • You want tracker database classification — use get_domain instead.

  • You need robots.txt AI policy — use intel_robots instead.

Inputs:

  • domain (query, required): Domain to fingerprint.

Returns:

  • cms: detected content management system, or null.

  • frameworks: JavaScript/backend frameworks detected.

  • cdn: CDN provider detected, or null.

  • analytics: analytics and tracking tools detected.

  • meta_generators: raw meta generator tag values.

Cost:

  • Free. No API key required.

Latency:

  • Typical: 2-4s (HTML fetch), p99: 7s.

ParametersJSON Schema
NameRequiredDescriptionDefault
asyncNoWhen true, return a task handle immediately instead of blocking. Poll get_task for the result.
domainYes
receiptNoWhen true, attach a signed Receipt v1.0 committed to the transparency log. Additive — a signing failure never costs you the observation (ADR-014).
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the transparency burden. It discloses the 32KB limit, detection signals (meta tags, script src, headers, cookies), cost (free, no API key), and latency (typical/p99). It does not explicitly state read-only/non-destructive, but the fetching and fingerprinting behavior implies it. This is strong disclosure for a read-like tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections: main purpose, usage conditions, input list, return fields, cost, and latency. Every section adds essential information without unnecessary verbosity. Front-loaded with the core purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the tool's purpose, inputs, return values, cost, latency, and exclusions. It even details the detection methods. Given no output schema, the 'Returns' section is especially valuable for setting expectations. This is a comprehensively specified tool description.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 67%, leaving 'domain' without a schema description. The description compensates by listing 'domain (query, required): Domain to fingerprint.' It does not describe async or receipt beyond what the schema already provides, but the key required parameter gets semantic clarity.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states the tool fetches HTML and response headers then fingerprints for CMS, frameworks, CDN, and analytics. It uses a specific verb ('fetches', 'fingerprints') and names the resource (domain's HTML/headers), clearly distinguishing its role from sibling tools like intel_http.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit 'Use this tool when' and 'Do NOT use this tool when' sections, naming specific alternatives (intel_http, get_domain, intel_robots). This gives clear decision guidance for tool selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_domainsAInspect

Returns a paginated list of domains from the tracker database. Results are ordered alphabetically by domain name and support cursor-based pagination for full traversal. Filtering by category and minimum score allows targeted data extraction.

Use this tool when:

  • You want to enumerate all known ad-tech or analytics domains above a risk threshold.

  • You need a dataset of tracker domains for offline analysis.

  • You are paginating through a category to build a block list.

Do NOT use this tool when:

  • You need data for a specific domain — use get_domain instead.

  • You are searching by keyword — use search instead.

  • You want domains belonging to a specific company — use get_entity instead.

Inputs:

  • category (query, optional): Filter by surveillance category. One of: ad_tech, analytics, social, fingerprinting, content, cdn, other.

  • min_score (query, optional): Integer 0-100. Exclude domains scoring below this value.

  • limit (query, optional): Number of results per page. Max 100 (paid), 20 (free). Default 50.

  • cursor (query, optional): Pagination cursor from the previous response's next_cursor field.

Returns:

  • Array of domain list items (domain, category, score, prevalence, entity summary).

  • meta.has_more: true if more pages exist.

  • meta.next_cursor: pass as cursor to get the next page.

  • meta.count: number of results in this page.

Cost:

  • Free tier: up to 20 results/page, 50 req/day. Pro/enterprise: up to 100 results/page.

Latency:

  • Typical: <200ms, p99: <500ms.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
cursorNo
categoryNo
min_scoreNo
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description fully discloses behavior: pagination mechanism (cursor-based), ordering, filtering semantics, return structure including meta fields, cost/free-tier limits, and latency expectations. No hidden side effects or prerequisites are omitted.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-organized with clear sections (overview, when to use, inputs, returns, cost, latency). It is slightly longer than necessary but every sentence adds value, and the structure aids comprehension. A minor trim could make it more concise, but it earns a strong score.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 4 parameters, no output schema, and no annotations, the description covers all necessary context: usage scenarios, parameter details, return format, pagination, rate limits, and performance. The agent has everything needed to call the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description explains every parameter in detail: category enum values, min_score semantics (exclude below), limit max/default, and cursor usage. This fully compensates for the schema's lack of descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Returns a paginated list of domains from the tracker database.' It clearly states ordering and filtering capabilities, and distinguishes from siblings by explicitly naming alternatives like get_domain, search, and get_entity in the 'Do NOT use' section.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit 'Use this tool when' and 'Do NOT use this tool when' lists with concrete scenarios and named alternatives. This gives the agent clear decision criteria for selection versus other tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_entitiesAInspect

Returns a paginated list of corporate entities in the TunnelMind surveillance database. Includes data categories, estimated data value, and industry classification. Useful for enumerating the surveillance ecosystem by sector.

Use this tool when:

  • You want to enumerate all entities in a specific industry (e.g., all ad-tech companies).

  • You need a dataset of surveillance entities for analysis or reporting.

  • You are building a comprehensive surveillance landscape map.

Do NOT use this tool when:

  • You need the full profile of a specific entity — use get_entity instead.

  • You are searching by entity name — use search instead.

  • You need domain-level data — use list_domains instead.

Inputs:

  • industry (query, optional): Filter by industry classification. Examples: ad_tech, analytics, data_broker, social, crm.

  • limit (query, optional): Results per page. Max 100 (paid), 20 (free). Default 50.

  • cursor (query, optional): Pagination cursor from previous response's next_cursor.

Returns:

  • Array of entity list items (slug, name, parent_company, industry, data_categories, data_cost_usd).

  • meta.has_more and meta.next_cursor for pagination.

Cost:

  • Free tier: up to 20 results/page, 50 req/day. Pro/enterprise: up to 100 results/page.

Latency:

  • Typical: <150ms, p99: <400ms.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
cursorNo
industryNo
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and excels: it discloses pagination behavior (next_cursor, has_more), rate limits (free tier limits, request per day), latency expectations, and return fields. This is rich behavioral context beyond a simple read-only hint.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections (purpose, when to use/not use, inputs, returns, cost, latency). Each sentence adds value, and the formatting makes it easy for an agent to parse quickly without unnecessary fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no annotations or output schema, the description independently covers purpose, usage guidance, parameter details, return format, pagination, cost, and latency. It is complete for an agent to know exactly what this tool does and when to invoke it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description fully explains all three parameters: `industry` with examples, `limit` with tier-dependent max/default, and `cursor` with source from previous response. This compensates completely for the schema's lack of descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Returns a paginated list of corporate entities in the TunnelMind surveillance database.' It clearly states what data is included and explicitly differentiates from siblings by naming `get_entity`, `search`, and `list_domains` in the 'Do NOT use' section.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit 'Use this tool when' and 'Do NOT use this tool when' sections, listing concrete scenarios and naming the alternative tools for each exclusion case. This gives clear, actionable guidance for tool selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_subscriptionsAInspect

Returns the caller's active and inactive subscriptions (signing_key redacted). Requires an API key.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds value beyond the absence of annotations by disclosing that the signing_key is redacted and that an API key is required. However, it does not explicitly state the read-only nature, error behavior, or response format. Given no annotations, more could be disclosed, but the 'Returns' phrasing strongly implies a safe read operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences with no wasted words. It front-loads the action ('Returns the caller's...') and adds essential detail (redaction and auth) without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list tool with no parameters and no output schema, the description covers the core purpose, the scope (caller's subscriptions), the statuses (active/inactive), and important behavioral notes (signing key redacted, API key required). It is slightly sparse on the exact return shape (e.g., array of objects), but given the tool's simplicity, it is adequately complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, and the schema coverage is 100%, so there are no parameter semantics to document. The description correctly avoids inventing parameters, and the baseline for 0-param tools is 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function with a specific verb ('Returns'), the resource ('subscriptions'), and a scoping qualifier ('caller's') that distinguishes it from sibling tools like get_subscription, create_subscription, and delete_subscription. It also specifies it covers both active and inactive subscriptions, leaving no ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context by indicating this returns the caller's own subscriptions, implying a listing operation, and notes the prerequisite of an API key. It doesn't explicitly exclude alternatives, but the context plus the presence of sibling tools like get_subscription (single) and delete_subscription makes the intended usage evident.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

preflight_should_i_actAInspect

The single call an agent makes before transacting with a destination on the open web. Composes the cross-lens verdict with a bounded Tracker-presence bonus, maps the adjusted trust score to a tri-state decision (allow / caution / deny), and returns a 5-minute signed consultation receipt (sigil_token with sub: preflight:consulted).

The receipt is the load-bearing artifact: the agent attaches it to its action log as cryptographic proof that the destination was consulted before action. The decision itself is commodity-shaped; the receipt of having asked is what accountability requires.

When ait is supplied, the consultation additionally chains a witness-tier preflight:consulted event onto the ATAP AIT, signed by OAI-2026-0000201 — turning the consultation into a hash-chained, replayable artifact.

Tracker presence applies a bounded +0.05 trust bonus before decision mapping (capped at 1.0). Absence is never a penalty — most of the open web is not in the tracker corpus and that's expected.

Defaults: allow >= 0.70, caution >= 0.40, else deny. Thresholds are overridable per request; weights are inherited from cross_lens_verify.

ParametersJSON Schema
NameRequiredDescriptionDefault
aitNoOptional ATAP AIT id. When present, chains a witness-tier `preflight:consulted` event onto the AIT.
nodeYesIPv4/IPv6 address, domain, ASN with optional `AS` prefix, or entity_slug.
intentNoFree-form context — recorded in the receipt, never affects the decision. Validated against /^[A-Za-z0-9._:-]{1,64}$/.
agent_idNoCaller's stable agent identifier, recorded in the receipt. Validated against /^[A-Za-z0-9._:-]{1,128}$/.
thresholdsNoOptional overrides; must satisfy 0 <= caution < allow <= 1.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description fully carries the transparency burden. It goes well beyond basics by disclosing the bounded +0.05 tracker bonus, the fact that absence is never a penalty, default thresholds, override capability, the 5-minute signed receipt with sub claim, and optional AIT witness chaining.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is denser than typical MCP tools but well-structured: purpose is front-loaded, followed by receipt rationale, AIT behavior, tracker semantics, and defaults. The 'commodity-shaped' phrasing is a bit stylistic but not wasteful.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

It covers decision logic, thresholds, tracker behavior, AIT chaining, receipt purpose and TTL. However, with no output schema, it does not explicitly specify the full response shape beyond sigil_token and sub, nor potential error/edge conditions, leaving slight ambiguity for a complex tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already covers all 5 parameters with 100% coverage, giving a baseline of 3. The description adds meaningful semantics: default allow/caution thresholds, threshold ordering constraints, intent being recorded-but-neutral, agent_id being recorded, AIT side effects, and inherited weights from cross_lens_verify.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states this is 'the single call an agent makes before transacting with a destination on the open web' and explains it composes a cross-lens verdict with a tracker bonus, maps to allow/caution/deny, and returns a signed receipt. This clearly distinguishes it from sibling tools like cross_lens_verify, verdict_lookup, and generate_receipt.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly tells agents when to use this tool: before any transaction with an open-web destination, and frames the receipt as the load-bearing accountability artifact. It does not enumerate explicit when-not or alternative scenarios, so it stops short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

profile_entityAInspect

Call this before routing traffic, bidding on inventory, or trusting a counterparty. It fuses ALL THREE TunnelMind lenses for one subject — Scry (attacker intelligence + threat feeds + open ports), Sigil (ad-supply-chain position + trust score + ATAP witness count), and Tracker (DDG/IAB catalog + prevalence + categories) — into a single confidence-scored profile plus a signed P38 receipt.

The cross_lens.hits field tells you if the same infrastructure appears in attack data AND supply-chain data — that's your highest-confidence signal, and the one no siloed competitor can give you. cross_lens.flags surfaces the actionable highlights (cross_lens_overlap:scry+sigil, in_threat_intel:..., high_prevalence_tracker, corroborated_by_N_lenses).

Confidence weighting: each lens contributes a base score; a 1.5× multiplier applies when ≥2 lenses corroborate the same subject; and the Scry contribution is weighted by the attestation tier of the sensors that observed it (silicon_root 1.0 → self_asserted 0.5). Bounded [0,1] and carried into the receipt.

Unlike cross_lens_verify (one node → one verdict) and cross_lens_lookup (one node → raw three-lens view), profile_entity takes the SUBJECT as any combination of ip / domain / entity and returns the richest fused detail for a pre-transaction decision. At least one of ip / domain / entity is required.

ParametersJSON Schema
NameRequiredDescriptionDefault
ipNoIPv4 or IPv6 address of the subject (Scry lens).
domainNoDomain of the subject (Sigil + Tracker lenses).
entityNoentity_slug of the subject (Sigil + Tracker lenses).
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It discloses the confidence scoring mechanism, the 1.5× corroboration multiplier, the Scry attestation tier weighting, bounded output [0,1], the cross_lens.hits field semantics, and the signed P38 receipt. This goes far beyond a typical description.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is longer than average, but every sentence contributes meaningful content and is front-loaded with the most critical context. The structure flows well from invocation to details to alternatives, though it could be trimmed slightly without losing value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given there is no output schema and no annotations, the description fully compensates by explaining key return fields (cross_lens.hits, cross_lens.flags), confidence weighting, and examples of flag values. It also covers parameter constraints, making it complete for an AI agent to invoke confidently.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and each parameter has its own description, but the tool description adds meaning by mapping each parameter to the relevant lens (ip → Scry, domain → Sigil+Tracker, entity → Sigil+Tracker) and explaining the combination flexibility. This exceeds schema-only semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a clear invocation context ('before routing traffic, bidding on inventory, or trusting a counterparty') and explicitly states it fuses all three lenses (Scry, Sigil, Tracker) into a confidence-scored profile. It distinguishes itself from siblings by naming cross_lens_verify and cross_lens_lookup and contrasting its richer subject handling.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use guidance ('before routing traffic...') and explicit exclusion/alternatives ('Unlike cross_lens_verify... and cross_lens_lookup...'). Also states the input requirement of at least one of ip/domain/entity.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

receipt_log_consistency_proofAInspect

Proves the log at size second is an append-only extension of the log at size first — history was never rewritten. Returns both roots and the proof path. Verify offline with scripts/verify-log.mjs consistency <proof.json>.

ParametersJSON Schema
NameRequiredDescriptionDefault
firstYes
secondYes
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Since no annotations are provided, the description carries full burden. It discloses that the tool returns both roots and the proof path, and suggests offline verification, clearly indicating read-only behavior. It does not mention prerequisites or side effects, but is sufficiently transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three concise sentences: first states core purpose, second describes output, third suggests next step. No irrelevant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description adequately covers return values (roots and proof path). It lacks differentiation from similar sibling tools and assumes domain knowledge, but is complete for the intended use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description provides necessary context: it explains the roles of `first` and `second` as log sizes and their relationship. This adds value beyond the schema's type and minimum constraints.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it proves the log at size `second` is an append-only extension of the log at size `first`, using a specific verb and resource. It distinguishes from sibling tools like receipt_log_inclusion_proof which serve a different purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for verifying log consistency but does not explicitly state when to use this tool versus alternatives like receipt_log_inclusion_proof or receipt_log_sth. It provides a verification script instruction, which offers some guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

receipt_log_inclusion_proofAInspect

Proves a specific receipt (by unified receipt_id, lens alias, or raw leaf_index) is included in the tree at tree_size (default: the latest STH's). Returns leaf_hash, the audit_path, the recomputed root_hash, and the matching STH. What this proves: the receipt in your hand is byte-identical to the one sequenced into the log — not that the observation inside it was correct (ADR-010).

Verify offline with scripts/verify-log.mjs inclusion <proof.json>.

ParametersJSON Schema
NameRequiredDescriptionDefault
tree_sizeNo
leaf_indexNo
receipt_idNo
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It discloses return values, default behavior (latest STH), and what is proven vs. not. This is transparent for a proof-of-inclusion tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and front-loaded with the main purpose. Two paragraphs efficiently convey functionality, return values, limitations, and offline usage.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and moderate complexity, the description covers return values, default behavior, proof semantics, and references ADR. Lacks error conditions but is fairly complete for the tool's purpose.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, but description explains purpose of parameters: receipt_id unifies identifiers, tree_size defaults, leaf_index as alternative. Adds meaning beyond the schema, though lacks detailed parameter descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool proves a specific receipt is included in the tree, specifying identifiers and what it proves vs. does not prove. It distinguishes from siblings like receipt_log_consistency_proof and receipt_lookup.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implicitly distinguishes usage by focusing on inclusion proof, but does not explicitly state when to use this vs. alternatives like consistency proof. However, it provides a practical offline verification step.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

receipt_log_sthAInspect

P72 RFC 6962 transparency log over the unified receipt ledger (ADR-010). The STH commits to the entire log: tree_size, root_hash (0x + SHA-256), timestamp, and an Ed25519 signature (with key_id and embedded public key) over the RFC 8785 canonicalization of the body. Hashes only — receipt bodies are never on this surface.

Verify offline with scripts/verify-log.mjs sth (zero TunnelMind library code) against the published receipt-signing key.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description provides good behavioral context: it explains that the tool returns a commitment (hashes only, no receipt bodies), lists the fields, and mentions offline verification. While it doesn't explicitly state that it is a read-only operation with no side effects, the technical detail sufficiently conveys the tool's behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise (three sentences) and front-loaded with key information about the log standard and the STH content. It could be slightly trimmed (e.g., the verification script detail might be secondary), but it remains clear and focused.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given zero parameters and no output schema, the description is fairly complete: it defines what the tool returns, what it excludes, and how to verify offline. It could be more explicit about the output structure or the fact that no input is needed, but overall it provides sufficient context for an AI agent to understand the tool's role.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the baseline score is 4. The description does not need to add parameter semantics, and it correctly stays focused on the tool's purpose and output.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool provides the Signed Tree Head (STH) of a P72 RFC 6962 transparency log over the unified receipt ledger. It specifies the exact data fields (tree_size, root_hash, timestamp, Ed25519 signature) and distinguishes itself from siblings by noting that receipt bodies are not included, implying this is for the log's commitment rather than proofs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implicitly tells when to use this tool (to get the STH) and hints at alternatives by mentioning that receipt bodies are never on this surface and that offline verification uses a separate script. However, it does not explicitly contrast it with siblings like receipt_log_inclusion_proof or receipt_log_consistency_proof, leaving room for clearer usage boundaries.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

receipt_lookupAInspect

P72 unified receipt ledger (ADR-010): every receipt-issuing surface (cross-lens verify, tracker verify, verdict, profile, explain, GhostRoute, Sigil/ATAP, compliance export) records the exact signed document it returned, keyed by one ID space.

Use this tool when:

  • An agent holds a receipt and wants to confirm TunnelMind logged it (existence + canonical hash) before trusting it in an audit trail.

  • The owning customer wants to re-fetch a receipt body by id.

Inputs:

  • id (path, required): the unified receipt_id (UUIDv7, GR-YYYY-NNNNNNN, or ATAP-RCPT-…) or a lens-native alias.

Returns:

  • Always: receipt_id, lens, payload_hash (0x + SHA-256 of the RFC 8785 canonicalization of the stored document), key_id, attestation_strength, issued_at, and leaf_index (null until the transparency-log sequencer enrolls the row).

  • Owner only (authenticated caller matching the receipt's customer): subject and the full stored receipt document. Receipt bodies are never public.

Cost:

  • Counts as one request against the daily rate limit.

Latency:

  • Typical: <300ms (one Supabase read).

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses return fields, owner-only data, cost counting, and latency. No annotations present, so description carries full burden. Could mention authentication specifics, but sufficient.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-structured with sections and bullet points. Front-loaded with purpose. Slightly long but every sentence is informative. No redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Explains return values in detail with no output schema, and covers cost and latency. Minor omission: what happens on missing ID, but overall complete for a lookup tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Since input schema has 0% description coverage and only one parameter, the description adds significant value by enumerating valid ID formats (UUIDv7, GR-YYYY-NNNNNNN, ATAP-RCPT-…, lens-native alias).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool is a unified receipt ledger for looking up receipts by ID across multiple surfaces. It distinguishes itself from sibling tools by emphasizing the unified nature and specific ID space.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly provides two use cases: confirming receipt existence/hash and re-fetching by owner. Does not list when not to use or alternatives, but context is clear enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

revoke_api_keyAInspect

Permanently deactivates the API key used to make this request. This action is irreversible. After revocation, the key will return 401 on all subsequent calls. If you have an active Stripe subscription, you must separately cancel it at stripe.com — revoking the key does not cancel billing.

Use this tool when:

  • You want to rotate your API key (revoke old, then provision a new one).

  • You believe your key has been compromised.

Do NOT use this tool when:

  • You want to check quota — use get_api_key instead.

  • You intend to keep using the API — this is permanent.

Inputs:

  • No body or query parameters. Auth is from the Authorization: Bearer header.

Returns:

  • revoked: true.

  • note: reminder about Stripe subscription cancellation.

Cost:

  • Free. Does not count against the daily request limit.

Latency:

  • Typical: <150ms, p99: <400ms.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description fully discloses the irreversible nature, the 401 response, the separate Stripe cancellation requirement, return fields, cost, and latency. This exceeds typical disclosure for a destructive action.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Every sentence earns its place: purpose, irreversibility, billing caveat, usage guidance, input clarification, return values, cost, and latency. The structured bullet format enhances readability without unnecessary fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the absence of annotations and output schema, the description is remarkably complete. It covers what, why, when, when not, parameters, return values, cost, and performance, leaving no critical operational gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema is empty, and the description explicitly states no body or query parameters are needed, while clarifying that authentication comes from the Authorization: Bearer header. This adds meaning beyond the empty schema and prevents confusion.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the tool 'permanently deactivates the API key used to make this request' with specific consequences (401 on subsequent calls). It distinguishes itself from related tools like get_api_key and create_free_key by emphasizing irreversibility and the billing nuance.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly lists when to use (rotate key, compromised key) and when not to use (check quota → use get_api_key, intend to keep using API). This provides clear decision guidance and names an alternative tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scan_injectionAInspect

Runs a curated signature corpus over a piece of untrusted text — content an agent is about to consume, a retrieved document, a tool result, an email body — and returns the matched injection patterns plus a bounded 0..1 risk score. This is a signal, never a policy decision: the caller decides what to do with a flagged input.

Detected classes: instruction_override (ignore/override previous rules), role_reassignment (you are now DAN / developer mode), exfiltration (leak the system prompt or a secret to a URL), tool_smuggling (covertly invoke a tool, delete/destroy data), boundary_spoof (fake system/assistant turn delimiters). Input is normalized first to blunt cheap evasions (zero-width characters, smart quotes, whitespace padding).

Use this tool when:

  • You are an agent about to feed retrieved or third-party text into a model and want to check it for embedded instructions first.

  • You are triaging why a tool description or web page looks suspicious.

Do NOT use this tool when:

  • You want a trust verdict on a domain or entity — use cross_lens_verify.

  • You want to scan a whole MCP server's tools — use scan_mcp.

Inputs:

  • text (body, required): the untrusted text to scan. Max 200,000 chars.

Returns:

  • flagged: true if any signature matched.

  • score: bounded 0..1 risk score (saturating — one high-severity hit is already strongly flagged; many hits approach but never exceed 1).

  • severity_max: highest severity among matches (high/medium/low) or null.

  • classes: distinct injection classes matched.

  • matches: each matched signature { id, class, severity, excerpt }.

Cost:

  • Free. No API key required. Pure edge computation, no external calls.

Latency:

  • Typical <20ms.

ParametersJSON Schema
NameRequiredDescriptionDefault
textYesUntrusted text to scan for injection signatures.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full behavioral burden. It discloses input normalization (zero-width chars, smart quotes), saturating risk score, pure edge computation with no external calls, and cost/latency. It also clarifies it is a signal, not a policy decision, providing rich behavior context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but well-structured with clear sections (purpose, classes, use cases, inputs, returns, cost, latency). It front-loads the core purpose in the first sentence and uses bullet-like lists for readability. Every section adds necessary value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having no output schema, the description fully specifies all returned fields (flagged, score, severity_max, classes, matches) and their semantics. It also covers operational context (free, <20ms latency) and limitations, making it complete for an agent to decide and invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although schema covers the text parameter's name and description, the tool description adds significant meaning: examples of untrusted text (retrieved document, email body), max length, normalization details, and what constitutes injection classes. This goes well beyond the schema's minimal 'Untrusted text to scan'.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool scans untrusted text for injection patterns and returns matched signatures plus a risk score. It explicitly distinguishes itself from siblings like cross_lens_verify (trust verdict) and scan_mcp (scan MCP server), making the purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes dedicated 'Use this tool when' and 'Do NOT use this tool when' sections with specific examples and alternatives. This gives explicit guidance on when to use scan_injection versus other tools, which is exemplary.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scan_mcpAInspect

Connect to a caller-supplied MCP server (Streamable-HTTP transport), read its advertised tools, and run the injection corpus over every tool name / description / input schema — plus a capability heuristic that flags broad, dangerous powers (shell execution, filesystem write, credential access, arbitrary network, destructive DB ops). Returns a per-tool safety report. A caution to review, never a verdict.

This is a single-target, caller-initiated scan. It is NOT a crawler and does not follow links or enumerate other servers. Loopback / private / internal hosts are rejected.

Use this tool when:

  • You are about to connect an agent to a third-party MCP server and want to inspect its tools for embedded instructions or excessive powers first.

Do NOT use this tool when:

  • You only have a blob of text — use scan_injection.

  • You want a trust verdict on a domain or entity — use cross_lens_verify.

Inputs:

  • url (body, required): the MCP server endpoint (http/https).

Returns:

  • server: { name, version } reported by the server, if any.

  • tools_scanned: number of tools inspected.

  • flagged_count: tools with an injection hit or a flagged capability.

  • risk: worst per-tool risk across the server (high/medium/low/none).

  • score: max injection score across tools (0..1).

  • tools: per tool { name, risk, injection{...}, capabilities[] }.

Cost:

  • Free. No API key required.

Latency:

  • Bounded by the target server's handshake; typically <2s.

ParametersJSON Schema
NameRequiredDescriptionDefault
urlYesMCP server endpoint (Streamable-HTTP). http or https.
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses key behaviors: single-target, not a crawler, rejects loopback/private/internal hosts, and returns a 'caution to review, never a verdict'. It also covers cost, latency, and what the scan does not do (does not follow links). Minor gap: it doesn't explicitly state whether it invokes the scanned tools, but 'read its advertised tools' implies static analysis.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections (overview, limitations, when to use/not use, inputs, returns, cost, latency). It's somewhat long but every section earns its place, and the main purpose is front-loaded. No redundant wording beyond necessary clarification.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having no output schema, the description fully documents return fields with types (`server`, `tools_scanned`, `flagged_count`, `risk`, `score`, `tools`). It also covers cost, latency, and safety limitations, making it significantly more complete than typical for a single-parameter tool. The only minor omission is an example, but that's not essential.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% for the single `url` parameter, and the description's input section mostly restates the schema ('MCP server endpoint (http/https)'). It adds the note that `url` is in the body, but this is a minor addition. Baseline 3 is appropriate given high schema coverage; the description adds minimal new semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool scans a caller-supplied MCP server for injection vulnerabilities and dangerous capabilities, using specific verbs ('Connect', 'read', 'run', 'flags') and resources ('MCP server', 'tool name / description / input schema'). It explicitly distinguishes from siblings by noting it is NOT a crawler and provides alternative tools for other use cases.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit 'Use this tool when' and 'Do NOT use this tool when' sections, with named alternatives (`scan_injection` for text blobs, `cross_lens_verify` for trust verdicts). It also clarifies limitations like single-target and caller-initiated, making the appropriate context unmistakable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sigil_ads_txt_historyAInspect

Returns a publisher's ads.txt change log — one entry per crawl in which its authorized-seller set changed. A publisher quietly adding a reseller line is a real fraud signal; this is how a buyer audits supply over time.

Inputs:

  • domain (path, required): publisher domain.

  • since (query, optional): ISO date / date-time lower bound on observed_at.

  • limit (query, optional): max entries — default 50, max 200.

Returns changes[], newest first — each with observed_at, added_count, removed_count, additions, removals, directive_changes.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
sinceNo
domainYes
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden and discloses key behaviors: only entries where the authorized-seller set changed are included, results are newest first, and `since` bounds `observed_at`. This adds useful context beyond the raw schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Structured efficiently: first paragraph states purpose and context, then parameter list, then return format. Each sentence adds necessary information without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and no annotations, the description fully covers parameter semantics, return structure (`changes[]` with fields), and usage context. It is self-sufficient for an agent to invoke and interpret results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Despite 0% schema coverage, the description fully explains all three parameters: `domain` as required path parameter, `since` as ISO date-time lower bound on `observed_at`, and `limit` with default and maximum. This exceeds what the schema alone provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool returns a publisher's ads.txt change log, with the verb 'Returns' and a specific resource. It distinguishes itself from sibling verification tools by focusing on historical changes and fraud auditing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'this is how a buyer audits supply over time' provides clear context for when to use the tool, implying historical analysis rather than current-state verification. It does not explicitly name alternatives or exclusions, but the intent is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sigil_atap_ait_statusAInspect

Returns an AIT's status, chain head hash, event count, pending-event count, per-tier event counts, and the anchored-bid coverage ratio.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. The verb 'Returns' implies a read-only operation and it details the output fields, but it does not disclose error behavior, permissions, or any side effects. This partial transparency is adequate but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence that lists all relevant output fields without redundancy. Every word contributes to understanding, making it highly concise and well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple single-parameter status lookup, the description covers the main purpose and enumerates all returned data points, compensating for the lack of an output schema. However, it leaves domain-specific terms like 'anchored-bid coverage ratio' undefined, which slightly reduces completeness for unfamiliar agents.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema only provides 'id' as a required string with no description. The description implies that 'id' identifies the AIT being queried, but it does not explicitly define it or specify format/constraints. This adds minimal meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses the specific verb 'Returns' and clearly identifies the resource (an AIT's status) plus enumerates the exact data fields. This distinguishes it from sibling tools like sigil_atap_register_ait or sigil_atap_witness, which handle different operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no explicit guidance on when to use this tool versus alternatives. It neither mentions preconditions nor points to sibling tools for related operations, leaving the agent to infer usage solely from the name and output description.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sigil_atap_register_aitAInspect

Registers an ATAP v0.1 AIT for a media-buying agent under the sigil:media_buyer:v1 profile. Sigil validates the capability set and constraints against the published profile, signs the AIT as the witness (OAI-2026-0000201), stores it, and returns the signed token.

Sigil is the ATAP witness — there is no kernel observer. See https://github.com/TunnelMind/atap-profiles.

ParametersJSON Schema
NameRequiredDescriptionDefault
profileYes
operatorYesThe agent operator's canonical OAI.
agent_typeNomedia-buyer
expires_atYes
constraintsYes
capabilitiesYes
attestation_policyYes
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses the key behavioral steps: validation of capability set and constraints, signing as witness (with specific OAI), storage, and return of the signed token. It also adds an important trust-model caveat: 'Sigil is the ATAP witness — there is no kernel observer.' This goes beyond a simple update statement, though it doesn't cover failure modes, idempotency, or permissions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise paragraphs, front-loaded with the core action, followed by a process summary and a relevant trust-model note. Every sentence adds value, and there's no fluff or repetition. The link provides additional reference without bloating the description.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is complex (7 parameters, nested objects, no output schema), and the description only covers the high-level flow. It doesn't explain the meaning of all parameters, expected formats, error scenarios, or the structure of the returned token. The low schema coverage means the description should fill these gaps, but it leaves too much to inference.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 14%, so the description must compensate. It explains capabilities and constraints indirectly through the validation sentence, and mentions the profile example, but it leaves operator, agent_type, expires_at, and attestation_policy entirely unexplained. This is insufficient for a 7-parameter tool with nested objects.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Registers an ATAP v0.1 AIT for a media-buying agent under the sigil:media_buyer:v1 profile.' This clearly states the action and scope, and the registration action is distinct from sibling tools like sigil_atap_ait_status and sigil_atap_witness. It fully answers what the tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context: it's for registering ATAP AITs when Sigil is the witness, validates capabilities/constraints, and returns a signed token. It doesn't explicitly mention when not to use it or name alternative tools, but the specialized nature and workflow context make the usage scenario clear. This is more than implied usage, though not fully explicit about exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sigil_atap_roll_blockAInspect

Rolls every not-yet-blocked Witness Event for an AIT into one signed ATAP Attestation Block with a profile period_summary, chained onto the prior block.

ParametersJSON Schema
NameRequiredDescriptionDefault
aitYes
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description discloses the core state-changing behavior: it creates and signs a block, chains it, and consumes outstanding events. However, it does not disclose prerequisites (e.g., registered AIT) or potential failures, and it is silent on permissions or reversibility.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is one dense sentence with no fluff; it front-loads the action and packs in the profile name and chaining behavior. All words contribute meaning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is moderately complex but the description omits return behavior (no output schema) and usage timing (e.g., after witnessing events). It does convey the key state transition but leaves the agent without enough context to fully anticipate side effects or results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The only parameter `ait` is not described in the schema, and the description only references 'for an AIT' without explaining the expected format or identifier semantics. This is partial compensation for the 0% schema coverage but leaves room for ambiguity.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific action: rolls not-yet-blocked witness events into a signed block with the `period_summary` profile, chained to the prior block. It distinguishes the tool from siblings like `sigil_atap_witness` and `sigil_atap_register_ait` by naming the exact resource and process.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit usage guidance or alternatives are provided. The description implies the tool is used when there are pending witness events to consolidate, but it does not state when not to use it or direct the agent to sibling tools for related tasks.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sigil_atap_witnessAInspect

Ingests one agent-reported event (bid:submitted, bid:won, bid:lost, budget:decremented) into an AIT's hash-chained attestation log. Sigil validates the payload (rejecting any PII per ATAP §7.6), classifies the evidence tier — anchored if a bid:submitted cites a valid Sigil token issued for this AIT and matching the bid's supply path, otherwise asserted — derives any constraint:violated events, then chains and signs each event.

supply:verified / supply:rejected are witness-emitted by sigil_verify_supply_path, never accepted here — that is what makes the witnessed tier non-bypassable.

ParametersJSON Schema
NameRequiredDescriptionDefault
aitYes
payloadYes
event_typeYes
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses validation behavior (PII rejection per ATAP §7.6), evidence tier classification (anchored vs asserted), derivation of constraint:violated events, and the chaining/signing process. This goes well beyond the schema and gives the agent a clear model of the tool's side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the main action and event list, then compactly explains the processing pipeline and the critical exclusion. Every sentence adds necessary context—no fluff. The density is appropriate for the complexity of the tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex tool with no output schema and no annotations, the description covers input semantics, validation, classification, and the non-bypassability design. The only notable gap is the lack of any mention of the return value or response format, which would help the agent know what to expect after ingestion.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate. It adds meaningful semantics for event_type (accepted enum values and their anchoring implications) and payload (validation and PII rejection), but leaves the 'ait' parameter and the exact payload structure underspecified. Still, it provides substantial value beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('ingests') and clearly identifies the resource ('an AIT's hash-chained attestation log'). It enumerates the exact event types accepted, distinguishing it from sibling sigil tools by explicitly stating that supply:verified/supply:rejected are handled elsewhere.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear when-not guidance: supply:verified and supply:rejected events must never be passed here, and it names the alternative tool (sigil_verify_supply_path) that emits those events. This gives an explicit exclusion and alternative, meeting the highest bar.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sigil_receipt_generateAInspect

Assembles the ATAP v0.1 §7.5 Receipt ZIP for an AIT — the signed Receipt (manifest.json), the AIT, the Attestation Block chain, the witness public key, a tier-graded summary.json, the bundled verify.sh reference verifier, and the witness events + sigil_tokens as profile artifacts. Any pending events are rolled into a final block first.

The ZIP verifies offline — unpack it and run verify.sh; keys are at https://tunnelmind.ai/atap/keys. The summary grades every event as witnessed, anchored, or asserted and reports the anchored-bid coverage ratio.

ParametersJSON Schema
NameRequiredDescriptionDefault
aitYes
formatNofull
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden and delivers rich behavioral detail: it lists all ZIP components, states that 'any pending events are rolled into a final block first', explains offline verification, and describes the summary grading scheme.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two focused paragraphs: first the package contents, then verification + summary behavior. It is slightly dense but every sentence adds information; no fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with only 2 params and no output schema, the description is largely complete in explaining behavior and output contents. However, the unexplained 'format' parameter prevents a higher score, and the return value (e.g., ZIP file location) is not addressed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has 0% description coverage, so the description must explain parameters, but it only mentions the AIT implicitly ('for an AIT') and never explains the 'format' enum (full vs summary), leaving a significant gap for one of the two parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb ('Assembles') and resource ('ATAP v0.1 §7.5 Receipt ZIP for an AIT'), clearly distinguishing it from sibling verification/lookup tools by detailing the ZIP's full contents and offline verification purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly communicates what the tool produces and how to use the output ('unpack it and run verify.sh'), but does not explicitly contrast it with sibling tools like generate_receipt, get_receipt, or verify_receipt, leaving the 'when to use vs alternatives' implicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sigil_score_batchAInspect

Scores up to 200 entities in one round-trip — built for agents evaluating many supply sources during campaign setup. Per-item parse failures are returned inline; the batch never fails as a whole.

An optional weights object re-weights every entity in the call.

ParametersJSON Schema
NameRequiredDescriptionDefault
weightsNoOptional custom weights: an object of `{ type: { component: weight } }`.
entity_idsYes
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It explicitly discloses that per-item parse failures are returned inline and that the batch never fails as a whole, which is crucial for error handling. It also explains that weights apply to every entity, going beyond the schema's basic type description.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences plus a short fragment, with the most important information (batch scoring, capacity) front-loaded. There is no redundant or filler content; every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the moderate complexity (batch scoring with optional weights) and the absence of an output schema, the description covers the key behaviors: capacity, inline parse failure handling, overall failure semantics, and the meaning of the optional weights. It does not specify the success return format, which is a minor gap, but overall it is sufficiently complete for reliable use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema description coverage is 50% (only `weights` has a description). The description adds behavioral meaning to `weights` ('re-weights every entity in the call') and clarifies `entity_ids` by stating 'up to 200 entities', which aligns with the maxItems constraint. This compensates for the schema gaps without fully detailing the entity ID format (though the example helps).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific action ('Scores up to 200 entities') and resource ('entities'), and distinguishes it from single-entity scoring tools like sigil_score_entity via the 'one round-trip' batch scope. It also adds contextual framing ('supply sources during campaign setup') that reinforces its unique role.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a usage context ('evaluating many supply sources during campaign setup') that implies when to use the batch tool over a single-entity alternative. However, it does not explicitly state exclusions or directly name alternatives, so it stops short of full guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sigil_score_entityAInspect

Returns the pre-computed 0.0–1.0 trust score for one entity, its component breakdown, and the 14-day trend. Scores are refreshed daily by a database job — this endpoint never recomputes from raw data, so it is fast and deterministic.

entity_id is {entity_type}:{key} — e.g. publisher:nytimes.com or ssp:pubmatic.com. Entity types: publisher, ssp, dsp, app_bundle (publishers and SSPs are scored today).

v1 evaluates structural components only (ads_txt_health, supply_chain_directness, historical_stability for publishers; supply_reach, directness for SSPs). The not_evaluated list names spec components without an enrichment path yet.

Optional weights query param (URL-encoded JSON) re-weights the stored components for this call.

ParametersJSON Schema
NameRequiredDescriptionDefault
weightsNoURL-encoded JSON: an object of `{ type: { component: weight } }`.
entity_idYes
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full behavioral disclosure burden. It meaningfully discloses the daily refresh model, determinism, v1's structural-only component scope, the purpose of the not_evaluated list, and the weights parameter's one-call effect. This is strong context, though it stops short of covering auth, rate limits, or error conditions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four dense paragraphs, each earning its place: return value, identifier format, v1 component scope, and optional reweighting. The core purpose is front-loaded in the first sentence, and there is no filler or repetition of schema content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given there is no output schema, the description fully covers return elements (score, breakdown, 14-day trend, not_evaluated list), input format, and optional behavior. For a 2-parameter tool, this is effectively complete — the only minor gap is trend shape details, which is non-critical.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is only 50% (weights has a description; entity_id does not). The description compensates by fully specifying entity_id's `{entity_type}:{key}` format with concrete examples ('publisher:nytimes.com', 'ssp:pubmatic.com') and valid entity types. It also adds behavioral meaning to weights ('re-weights the stored components for this call') beyond the schema's bare type definition.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Returns the pre-computed 0.0–1.0 trust score for one entity, its component breakdown, and the 14-day trend.' It clearly distinguishes from siblings by scoping to a single entity and explicitly noting 'this endpoint never recomputes from raw data,' contrasting with batch or verification tools like sigil_score_batch.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear usage context — this is the fast, deterministic single-entity lookup ('scores are refreshed daily... never recomputes... fast and deterministic'). It implies when to use it (single entity, cached data) but does not explicitly name alternatives or exclusion cases, such as directing to sigil_score_batch for multiple entities or sigil_score_weights for weight management.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sigil_score_weightsAInspect

Returns the active, versioned default weights used to combine an entity's trust-score components, plus the list of spec components that are not yet evaluated. Pass a custom weights object to sigil_score_batch to re-weight without changing the defaults.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. 'Returns' communicates a read-only operation, and the note that re-weighting is done via sigil_score_batch reinforces that this tool does not modify defaults. However, it does not mention any potential side effects or permissions, though for a zero-parameter getter this is largely non-critical.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the main verb and resource. Every sentence adds value, and the pointer to sigil_score_batch is relevant. There is no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter read-only tool with no output schema, the description fully covers what it returns (active default weights and unevaluated components) and how it fits with sibling tools. This is complete for the tool's simplicity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero properties (100% schema coverage), so there are no parameters to describe. The baseline for zero parameters is 4, and the description appropriately references a custom weights object only in the context of another tool, not this one.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool 'Returns the active, versioned default weights used to combine an entity's trust-score components, plus the list of spec components that are not yet evaluated.' This is a specific verb+resource and distinguishes itself from siblings by mentioning how to re-weight via sigil_score_batch.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives an explicit pointer to an alternative ('Pass a custom weights object to sigil_score_batch to re-weight without changing the defaults'), which tells the agent when to use this getter vs. the sibling tool. It does not explicitly state 'use this when you need to inspect defaults,' but the context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sigil_traverseAInspect

Reconstructs the supply paths for a publisher domain from Sigil's own crawl and returns them ITEMIZED — distinct from sigil_verify_supply_chain (which verifies a schain the caller brings) and from signal_dark_pool_risk (which returns only aggregate counts). Every SSP the publisher declares it sells through is joined to that SSP's identity and classified two-sided against the SSP's sellers.json: corroborated (seat present), contradicted (SSP crawled but seller_id absent — real risk), unchecked (SSP not yet crawled — not risk). Each returned path also carries resells_to, one level of downstream reseller expansion.

The list is ordered riskiest-first (contradicted, then reseller) so a truncated page is still the most useful; the supply_paths counts are always over the FULL set. in_supply_graph:false when the domain is not a known publisher.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMax paths returned (default 200, hard cap 500).
domainYesPublisher hostname to traverse.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, but the description compensates with rich behavioral detail: the three-way classification (corroborated/contradicted/unchecked), the inclusion of `resells_to`, risk-first ordering, and the `in_supply_graph:false` sentinel for unknown domains. It also notes that counts are over the full set even when results are truncated, which is important for interpretation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is information-dense but every sentence earns its place: differentiation, classification, ordering, sentinel value, and full-set counts. It is organized into two logical paragraphs with no filler, tautology, or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description adequately explains the key return semantics: itemized paths, classification categories, the `resells_to` field, and the unknown-domain flag. It also explains the ordering rationale for truncated results, which is essential for agents acting on partial data. The tool is fully contextualized despite lacking annotations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already documents both parameters at 100% (domain and limit), so the description carries less burden. It adds contextual meaning by explaining what the tool does with the domain and how the limit affects ordering, but does not introduce new parameter-level syntax beyond the schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Reconstructs') and clearly names the resource ('supply paths for a publisher domain from Sigil's own crawl'). It explicitly distinguishes itself from two sibling tools by naming them and describing their different purposes, making selection unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit exclusions: 'distinct from sigil_verify_supply_chain (which verifies a schain the caller brings) and from signal_dark_pool_risk (which returns only aggregate counts).' This tells the agent exactly when not to choose this tool and explains what the alternatives do, offering clear context for selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sigil_verify_adscertAInspect

Reports whether a domain publishes ads.cert (IAB Tech Lab Authenticated Connections) DNS records — a readiness signal showing the domain supports cryptographically authenticated ad-tech connections. This is not signature verification: ads.cert is pairwise, so verifying a signed bid request requires Sigil to be a delegated participant (a future build). DNS-only and stateless.

Inputs:

  • domain (query, required): Domain to check.

Returns:

  • adscert_ready: true | false | null (DNS lookup failed).

  • adscert_records: TXT values at _adscert.{domain}.

  • delegation_records: TXT values at _delegated._adscert.{domain}.

ParametersJSON Schema
NameRequiredDescriptionDefault
domainYes
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses that it is DNS-only, stateless, returns null on DNS lookup failure, and is not signature verification. It also explains the pairwise nature and future build dependency, providing meaningful behavior beyond a simple check.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is structured with clear sections for purpose, distinction, inputs, and returns. While longer than minimal, every part adds value, especially the return field explanations which are essential given no output schema. It could be slightly more concise but remains well-organized.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and minimal parameter schema, this description fully covers the tool's semantics: it lists all return fields, their possible values, meaning of null, and the underlying DNS behavior. It also explains the conceptual background (pairwise ads.cert) and limitations, making the description complete for effective use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description compensates by stating the domain is a query parameter and required. It also implicitly defines the domain format by showing how it's used in the DNS lookup pattern (`_adscert.{domain}`), but lacks explicit format constraints like protocol or trailing dot.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool reports whether a domain publishes ads.cert DNS records, a specific readiness signal. It also explicitly distinguishes itself from signature verification and sibling tools by noting it is DNS-only and stateless.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives clear context: this is for checking ads.cert readiness, not for verifying signed requests (which would require delegation). It also notes DNS-only and stateless, implying when this tool is appropriate, though it doesn't enumerate alternative tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sigil_verify_ads_txtAInspect

Confirms whether an SSP/exchange is authorized to sell a publisher's inventory according to that publisher's ads.txt. This is a cache lookup against ads.txt files crawled daily across the top 10,000 publisher domains — it does NOT fetch the publisher's ads.txt live, so it is fast and adds no latency to a real-time bidding decision.

Use this tool when:

  • You are an ad-buying agent and want to confirm, pre-bid, that a supply path (publisher → exchange → seller_id) is legitimate.

  • You are detecting domain spoofing or unauthorized resale in a bid stream.

  • You want to check whether a seller is listed DIRECT or RESELLER.

Do NOT use this tool when:

  • You want a full supply-path trust score — that endpoint is Sigil P31.

  • You want surveillance tracker data for the domain — use get_domain.

Inputs:

  • publisher_domain (body, required): Publisher domain, e.g. nytimes.com. A www. prefix and scheme/path are stripped automatically.

  • exchange_domain (body, required): The exchange/SSP domain as it appears in ads.txt, e.g. google.com, amazon-adsystem.com.

  • seller_id (body, required): The publisher's seller/account ID at that exchange, e.g. pub-4177862836555934. Matched exactly.

  • seller_type (body, optional): DIRECT or RESELLER. When supplied it is checked against the ads.txt entry; a mismatch is reported as a warning.

  • resolve_chain (body, optional): When true, a matched RESELLER entry is cross-checked against the exchange's sellers.json (one authoritative hop).

Returns:

  • verified: true (entry found), false (confidently not listed), or null (ads.txt could not be retrieved — indeterminate).

  • confidence: high | degraded | low | unknown.

  • seller_entry: the matched ads.txt line (line number, raw text, parsed fields) when verified is true; otherwise null.

  • ads_txt_parse_status, ads_txt_last_parsed, stale: provenance of the cached crawl this answer is derived from.

  • reseller_chain: empty unless resolve_chain: true and the matched entry is RESELLER — then it carries the sellers.json cross-check for the seller.

  • warnings: actionable flags, e.g. publisher_not_in_corpus, publisher_has_no_ads_txt, seller_type_mismatch, ads_txt_cache_stale.

Cost:

  • Counts as one request against the daily rate limit.

Latency:

  • Typical: <50ms (single cache lookup, no outbound fetch). p99: <120ms.

ParametersJSON Schema
NameRequiredDescriptionDefault
receiptNoWhen true, attach a signed Receipt v1.0 committed to the transparency log. Additive — the response shape is otherwise unchanged, and a signing failure never costs you the verdict (ADR-014).
seller_idYesPublisher's seller/account ID at the exchange
seller_typeNoOptional — checked against the ads.txt entry
resolve_chainNoWhen true, a matched RESELLER entry is cross-checked against the exchange's sellers.json
exchange_domainYesExchange/SSP domain as listed in ads.txt
publisher_domainYesPublisher domain (www. prefix and scheme stripped)
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden and delivers richly. It discloses that this is a cached lookup (not live fetch), fast, adds no latency, and explains behavior for edge cases (null when ads.txt unavailable), seller_type mismatch warnings, resolve_chain cross-checking, and stale cache provenance. It even adds cost and latency expectations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but perfectly structured with clear sections (Purpose, Use/Don't use, Inputs, Returns, Cost, Latency). Every sentence adds necessary information—no filler. The front-loading of the purpose ensures immediate comprehension, and the bullet-style formatting aids scanning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Without an output schema, the description fully explains all return fields (verified, confidence, seller_entry, provenance, reseller_chain, warnings) with semantics. It also covers failure modes, actionable warnings, cost, and latency, making it complete for a tool with this complexity (6 params, nuanced behavior).

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Despite 100% schema coverage, the description adds substantial semantic value beyond the schema. It explains that www. prefix and scheme/path are stripped, seller_id is 'matched exactly', seller_type mismatch is 'reported as a warning', and resolve_chain does 'one authoritative hop' against sellers.json. These clarifications are not present in the schema and are crucial for correct invocation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific, unambiguous statement: 'Confirms whether an SSP/exchange is authorized to sell a publisher's inventory according to that publisher's ads.txt.' The verb+resource structure clearly identifies the tool's function, and the scope (cache lookup, pre-bid verification) distinguishes it from sibling tools like sigil_verify_ads_txt_batch and sigil_verify_supply_chain.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit 'Use this tool when' and 'Do NOT use this tool when' sections provide clear context for invocation versus alternatives. It names Sigil P31 for supply-path trust scores and get_domain for tracker data, giving concrete exclusions and alternatives. This is above-and-beyond guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sigil_verify_ads_txt_batchAInspect

Runs up to 100 ads.txt verifications in a single call — the endpoint an ad-buying agent uses for pre-bid checks across a whole campaign's supply. Each item is the same shape as sigil_verify_ads_txt. Per-item validation failures are reported inline; the batch never fails as a whole. Publisher records are fetched once per unique domain.

Use this tool when:

  • You are evaluating many supply paths at once (campaign setup, SPO sweep).

  • You want one round-trip instead of N calls to sigil_verify_ads_txt.

Inputs:

  • items (body, required): Array of 1–100 verification requests, each { publisher_domain, exchange_domain, seller_id, seller_type? }.

  • resolve_chain (body, optional): Applies to every item — when true, a matched RESELLER entry is cross-checked against the exchange's sellers.json.

Returns:

  • count: number of result entries (matches items length, in order).

  • verified_count: how many resolved to verified: true.

  • results: array aligned to items. Each entry is either a verification result with ok: true and input_index, or { ok: false, input_index, error, message } for an invalid item.

Cost:

  • Counts as one request against the daily rate limit.

Latency:

  • Typical: <150ms. With resolve_chain: true, add one sellers.json fetch per unique exchange (edge-cached 12h after the first fetch).

ParametersJSON Schema
NameRequiredDescriptionDefault
itemsYes1–100 verification requests
resolve_chainNoResolve reseller chains for every RESELLER item
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It reveals several critical traits: the batch never fails as a whole (per-item failures are inline), publisher records are fetched once per unique domain, and it includes cost and latency details. This goes far beyond minimal requirements and gives an agent a realistic expectation of behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-organized with clear sections (Use this tool when, Inputs, Returns, Cost, Latency) and uses bullet lists for scannability. Every sentence earns its place, providing directly actionable information without fluff. The structure front-loads the core purpose and use case, then details operational behavior.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description must explain return values, which it does thoroughly (count, verified_count, results with ok/error details). It also covers cost, latency, and edge-case behavior. For a batch tool with this complexity, the description is comprehensive and leaves minimal gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already covers both parameters at 100%, so the baseline is 3. The description adds meaningful value by showing the exact shape of `items` (including the optional `seller_type?`), explaining that `resolve_chain` applies globally and cross-checks against sellers.json, and detailing the return object. This enriches the schema without being redundant.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource+scope: 'Runs up to 100 ads.txt verifications in a single call.' It explicitly names the batch behavior and distinguishes itself from the sibling `sigil_verify_ads_txt` by framing this as the multi-item counterpart. This makes the tool's purpose unambiguous and distinct.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The 'Use this tool when' section provides explicit conditions: evaluating many supply paths at once (campaign setup, SPO sweep) and wanting one round-trip instead of N calls to `sigil_verify_ads_txt`. This clearly tells an agent when to choose this tool over the singular variant, fulfilling the when/alternatives guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sigil_verify_app_bundleAInspect

Verifies that a mobile or CTV app bundle ID actually exists in the relevant app store — used to detect bundle spoofing in bid requests.

Platform support (v1):

  • ios: verified live via Apple's iTunes Lookup API.

  • android: verified live via the Google Play store listing page.

  • ctv_* / web: no public store API — returns verified=null.

Inputs:

  • bundle_id (body, required): e.g. com.nytimes.NYTimes.

  • platform (body, required): ios | android | ctv_roku | ctv_fire | ctv_samsung | ctv_lg | ctv_vizio | web.

  • claimed_developer (body, optional): checked against the store listing.

Returns:

  • verified: true | false | null (not checkable on this platform).

  • store_listing: name, developer, developer_match, store_url.

ParametersJSON Schema
NameRequiredDescriptionDefault
platformYes
bundle_idYes
claimed_developerNo
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It reveals that ios verification uses Apple's iTunes Lookup API and android uses Google Play's listing page, that ctv_*/web platforms return verified=null, and that claimed_developer is checked against the store listing. It does not mention error/exception handling or rate limits, but the disclosed behavior is substantial and useful.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-organized into purpose, platform support, inputs, and returns sections. It front-loads the core purpose and uses concise, informative bullets. Every sentence contributes useful information without redundant filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity, no output schema, and no annotations, the description is complete: it explains what the tool does, platform limitations, all input parameters, and the shape of the return value (verified, store_listing fields). This gives an agent enough context to invoke the tool and interpret results correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description compensates by listing each parameter, marking bundle_id and platform as required, and explaining that claimed_developer is checked against the store listing. It also provides an example bundle_id and lists the platform enum values. This adds clear meaning beyond the schema's raw type/enum declarations.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool verifies that a mobile or CTV app bundle ID exists in the relevant app store, with the specific use case of detecting bundle spoofing. This clearly differentiates it from sibling tools like sigil_verify_domain or sigil_verify_ads_txt by focusing on app bundles.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides concrete guidance on when the tool is usable: it lists supported platforms (ios, android) and explicitly notes that ctv_* and web platforms are not verifiable and return verified=null. It also states the intended use case (detecting bundle spoofing in bid requests), though it does not name alternative tools to use instead.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sigil_verify_domainAInspect

Confirms a publisher controls a domain by checking for a DNS TXT record the owner publishes under _tunnelmind.{domain}. A DNS record can only be set by whoever controls the zone, so its presence proves control — a stronger signal than ads.txt, which is just a file anything in the request path can serve.

Use this tool when:

  • You want proof a publisher actually owns the domain it claims.

  • You are distinguishing publishers who have opted into Sigil verification.

Inputs:

  • domain (query, required): Publisher domain. www. and scheme stripped.

Returns:

  • verified: true (record found), false (absent), or null (DNS lookup failed).

  • expected: the exact TXT record the owner must publish to verify.

  • found_records: TXT values currently present at _tunnelmind.{domain}.

  • checked_at: ISO 8601 timestamp of the live DNS lookup.

Cost:

  • Counts as one request against the daily rate limit.

Latency:

  • Typical: <300ms (one DNS-over-HTTPS lookup).

ParametersJSON Schema
NameRequiredDescriptionDefault
domainYes
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fully discloses behavior: it performs a live DNS lookup, returns true/false/null semantics for verification, exposes expected and found records, counts against a rate limit, and provides typical latency. This goes well beyond minimal requirements.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections for purpose, when to use, inputs, returns, cost, and latency. Every sentence contributes useful information, and the purpose is front-loaded for quick agent scanning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has no annotations, no output schema, and only one parameter, the description is exceptionally complete. It covers purpose, input semantics, output fields, rate-limit cost, and latency, leaving no significant ambiguity for an agent deciding to invoke the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema only specifies a bare 'domain' string with no description, so the description carries the full burden. It explains that the domain is a query parameter, required, and that 'www.' and scheme are stripped, adding crucial semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool confirms domain ownership via a DNS TXT record under `_tunnelmind.{domain}`, which is a specific verb+resource+mechanism. It also distinguishes itself from ads.txt verification by emphasizing DNS record control is a stronger signal.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit 'Use this tool when' conditions are given, and the description contrasts this with ads.txt, implying when the alternative is weaker. However, it does not name a specific sibling tool or state explicit 'when not to use' scenarios, so it falls just short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sigil_verify_ip_typeAInspect

Classifies an IPv4 or IPv6 address by network type — the high-value ad-fraud signal being datacenter traffic posing as residential or living-room (CTV) devices. IP→ASN resolution uses Team Cymru's public service; the ASN is then classified by its registered organization name.

It also cross-references the Scry attacker-observation corpus to detect anonymizing EGRESS — the thing a rotating-residential proxy provider is built to hide. A residential- or mobile-looking IP that Scry has observed acting as a hostile actor is a residential-proxy exit node (home devices don't scan honeypots); tor and vpn egress are named outright.

It also identifies the proxy COMPANY by network: if the IP's ASN belongs to a known VPN/anonymizing-egress provider (X4BNet's curated list), the verdict is vpn and scry_signals carries vpn_provider_asn — even when Scry has never observed the IP acting. Datacenter and residential proxy verdicts still require observed conduct.

PRIVACY: the IP is used for lookup only — never logged, never stored. The Scry cross-reference is likewise a read-only corpus lookup.

Inputs:

  • ip (query, required): IPv4 or IPv6 address.

Returns:

  • ip_type: datacenter | residential | mobile | unknown.

  • confidence: high | medium | low.

  • asn, asn_name: the resolved autonomous system.

  • proxy_suspected: boolean — the IP is an anonymizing egress.

  • proxy_type: tor | vpn | residential_proxy | datacenter_proxy | null.

  • scry_signals: evidence strings from the corpus (actor_class, threat feeds, observation counts); empty when the IP is unknown to Scry.

Latency:

  • Typical: 100-250ms (DNS + a parallel corpus lookup).

ParametersJSON Schema
NameRequiredDescriptionDefault
ipYes
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It transparently discloses the use of Team Cymru's public service, the Scry cross-reference read-only lookup, privacy guarantees (IP not logged/stored), and latency (100-250ms). It also explains the decision logic for classifying verdicts, which is far beyond minimal.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but well-structured with sections for inputs, returns, and latency. Every sentence adds value, though it could be tightened. The front-loaded purpose is clear, and the structure aids readability, but it is less concise than a minimal example.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and no annotations, the description covers all necessary aspects: what it does, how it works, return fields (ip_type, confidence, asn, scry_signals, etc.), privacy, and latency. It even explains edge cases like 'unknown' when the IP is not in Scry, making it complete for the tool's complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema only declares `ip` as a string with no description. The description compensates fully by stating 'Inputs: ip (query, required): IPv4 or IPv6 address.' This gives the exact type and expected format, which is essential for correct invocation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Classifies an IPv4 or IPv6 address by network type.' It clearly distinguishes this tool from siblings by focusing on IP classification and ad-fraud signals, which is distinct from domain verification or ASN lookup tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for when to use the tool (e.g., detecting datacenter traffic posing as residential, proxy detection) but does not explicitly name alternatives or state when not to use it. It implies usage for ad-fraud investigation and proxy detection, which is enough for a high score but lacks explicit exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sigil_verify_supply_chainAInspect

The bid-time contract. Pass the SupplyChain object from an OpenRTB bid request (source.ext.schain) verbatim, plus the originating site domain or app bundle. Sigil verifies, per node and in aggregate:

  • origin ads.txt — the publisher's ads.txt authorizes node[0] (asi + sid).

  • per node — the node's asi sellers.json declares the node's sid.

  • owner-domain — node[0]'s sellers.json seller domain matches the publisher's ads.txt OWNERDOMAIN / MANAGERDOMAIN (spec §3.5.1).

  • schain.complete — an incomplete chain caps the verdict at warn.

OpenRTB field mapping: site.domainsite_domain; app.bundleapp_bundle; source.ext.schainschain. An app_bundle origin's ads.txt check is not_evaluated pending app-ads.txt resolution.

Returns a per-node result array, an aggregate verdict (pass/warn/fail/unknown), recommendations, and a signed sigil_token.

ParametersJSON Schema
NameRequiredDescriptionDefault
buyerNoOptional. When present and the verdict is not `fail`, Sigil opportunistically records a `buys_through` edge linking the buyer entity to the resolved DSP. Side-effect persistence only — never affects the verdict or response shape, silent on every failure path. Requires `entity_slug` plus one of `dsp_domain` / `dsp_id`.
schainYes
app_bundleNo
site_domainNo
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden and does well: it discloses the verdict levels (pass/warn/fail/unknown), the effect of incomplete schain.complete, the app_bundle origin behavior ('not_evaluated'), and the components of the return object. It omits explicit side-effect disclosure (e.g., the optional buyer recording is only in schema) and network dependencies, but overall it is transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact yet information-dense: it opens with a clear context, uses bullet points for the four checks, and ends with the return summary. Each sentence adds value without waste, appropriate for a tool of this complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having no output schema, the description states the return types (per-node array, aggregate verdict, recommendations, sigil_token) and key edge cases (app_bundle ads.txt, schain.complete). It could provide more detail on the per-node result structure or failure modes, but the essential information is present.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is only 25%, but the description compensates by explaining the meaning and source of schain, site_domain, and app_bundle, as well as the mapping from OpenRTB fields. It also clarifies schain.complete semantics. The buyer parameter is already documented in the schema, so the distribution is balanced.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description specifies the tool's function with a concrete verb ('verifies') and a unique resource ('SupplyChain object from an OpenRTB bid request'), and enumerates four specific checks (origin ads.txt, per node, owner-domain, schain.complete). This clearly distinguishes it from sibling sigil_verify_* tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'bid-time contract' establishes the intended context (verification during bid processing), and the description explains required inputs (schain, site_domain or app_bundle) and provides OpenRTB field mapping. It does not explicitly name alternatives or exclusion criteria, but the context is sufficiently clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sigil_verify_supply_pathAInspect

The core Sigil pre-bid call. Submit a supply path; Sigil composes its individual checks into one trust verdict and returns a signed sigil_token the agent can attach to its bid as proof of verification.

Checks composed:

  • ads_txt — exchange authorized in the publisher's ads.txt.

  • datacenter_ip — is the IP a datacenter posing as a real user.

  • fraud_signals — is the IP in Scry's attacker-intelligence corpus.

  • bundle_verified — does the app bundle exist in its store.

  • domain_authenticity / entity_reputation — reserved, not evaluated in v1.

Each evaluated check yields pass/warn/fail; trust_score is their weighted mean (override weights per request); verdict is pass/warn/fail/unknown (override thresholds).

PRIVACY: ip_address is used for lookup only — never logged, never stored, never placed in the sigil_token. geo is accepted but unused.

Returns: trust_score (0-1 or null), verdict, checks, recommendations, sigil_token (signed, 5-minute lifetime).

ParametersJSON Schema
NameRequiredDescriptionDefault
buyerNoOptional. When present and the verdict is not `fail`, Sigil opportunistically records a `buys_through` edge linking the buyer entity to the resolved DSP. Side-effect persistence only — never affects the verdict or response shape, silent on every failure path. Requires `entity_slug` plus one of `dsp_domain` / `dsp_id`.
receiptNoWhen true, attach a signed Receipt v1.0 committed to the transparency log. Additive — the response shape is otherwise unchanged, and a signing failure never costs you the verdict (ADR-014).
weightsNoPer-check weight overrides
thresholdsNo{ pass, fail } verdict cutoffs
supply_pathYes
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden and does exceptionally well. It discloses privacy behavior (ip_address never logged/stored/token), the fact that geo is unused, check evaluation semantics (pass/warn/fail, weighted mean, verdict cutoffs), the reserved checks, and the 5-minute token lifetime. This goes far beyond the tool name and schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a summary, check list, scoring explanation, privacy note, and returns. It is a bit long but every section earns its place by providing differentiators and critical behavioral details. Minor redundancy exists (e.g., pass/warn/fail mentioned multiple times), but overall it is efficient and front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (nested object parameters, no output schema, no annotations), the description is remarkably complete. It lists all return fields (trust_score, verdict, checks, recommendations, sigil_token), explains the checks, overrides, and privacy, and gives the token lifetime. It covers the essential context an agent needs to invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description enriches schema parameters by explaining that `weights` overrides the weighted mean calculation and `thresholds` overrides verdict cutoffs. It also clarifies `ip_address` usage privacy and the fact that `geo` is unused (though geo is not in the schema, the intent is clear). Schema coverage is 80%, and the description adds meaning beyond the generic schema descriptions for weights/thresholds.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific verb+resource: 'core Sigil pre-bid call' that submits a supply path and composes checks into a trust verdict with a signed token. It explicitly lists the checks composed (ads_txt, datacenter_ip, fraud_signals, bundle_verified, etc.), distinguishing it from granular siblings like sigil_verify_ads_txt or sigil_verify_ip_type.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context: it positions the tool as the core pre-bid call and explains that it aggregates individual checks, implying use when a combined trust verdict is needed. However, it does not explicitly name alternatives or state when not to use this tool (e.g., when only a single check is needed), so it lacks explicit exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sigil_verify_tokenAInspect

Verifies the authenticity and expiry of a sigil_token returned by sigil_verify_supply_path. Anyone can call this — no key needed; Sigil verifies the Ed25519 signature server-side. Tokens live 5 minutes.

Returns valid (boolean), reason (when invalid: malformed / expired / bad_signature / unsigned), and the decoded payload.

ParametersJSON Schema
NameRequiredDescriptionDefault
tokenYes
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It discloses server-side Ed25519 verification, no-auth requirement, token expiry, and explicit return fields (valid, reason with enum values, payload). This is rich behavioral detail beyond schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three concise sentences, front-loaded purpose, followed by access/expiry context and return format. No wasted words or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one param, no output schema), description fully covers purpose, input semantics, return values, and operational constraints (auth, expiry). It is complete and self-contained.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single 'token' parameter has zero schema description coverage. Description explains it is the token from sigil_verify_supply_path and that tokens live 5 minutes, adding important meaning to the otherwise bare parameter definition.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description states it 'verifies the authenticity and expiry of a sigil_token' and specifies the token source (sigil_verify_supply_path), distinguishing it from sibling verification tools. This is a specific verb+resource+scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Implied usage is clear: use after obtaining a token from sigil_verify_supply_path. States anyone can call and no key needed, plus 5-minute lifetime. Lacks explicit 'do not use when' or named alternatives, but gives sufficient contextual guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

signal_dark_pool_riskAInspect

Reconciles every sell path a publisher declares (sells_through) against each SSP's own sellers.json (exchange_seat) and keeps three classes strictly separate: corroborated (seat present), contradicted (SSP crawled but seller_id absent — real risk), and unchecked (SSP not yet crawled — excluded from risk, lowers confidence). Combined with publisher-side ads.txt opacity. Two-sided corroboration is the cross-lens moat — it catches unauthorized resale a one-sided ads.txt read cannot.

ParametersJSON Schema
NameRequiredDescriptionDefault
domainYesPublisher hostname.
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the transparency burden. It discloses meaningful behavioral detail: how the three classes are derived, that 'unchecked' items are excluded from risk and lower confidence, and that this is a cross-lens verification. It does not mention auth/rate limits or output format, but the core analytical behavior is transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three dense sentences effectively front-load the main action and key distinctions. The only minor waste is the 'moat' metaphor; otherwise, every sentence earns its place. Could be slightly tighter or use structured lists, but it is well-organized.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool's complex risk classification logic is well explained, including the role of each class and confidence impact. However, with no output schema, the description does not explicitly state the response shape/fields, though the semantics are clear enough for an agent to anticipate a structured risk assessment.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter `domain` is already fully described in the schema as 'Publisher hostname', and schema coverage is 100%. The description adds no additional parameter-level detail (e.g., format or examples), so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('reconciles') and clearly identifies the resource (publisher's `sells_through` declarations against SSP `sellers.json`). It is unambiguous about what the tool does and the three output classes, which distinguishes it from sibling signal/risk tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description strongly implies the tool is for detecting unauthorized resale via two-sided corroboration and explicitly contrasts this with 'one-sided ads.txt read'. It does not name a specific sibling alternative, but provides enough context to know when this tool is appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

signal_halo_scoreAInspect

Scores an entity by the trust character of its neighbours — the SSPs its publishers sell through and the DSPs it buys through. Reports neighbour counts, mean/min neighbour trust, and how many neighbours are adversary-classified (P46). derived.halo_score (0–100, or null when no neighbour has a computed trust) is mean neighbour trust dragged down by adversary-neighbour share. Evidence about an entity's company, not a persisted verdict — no profile poisoning.

ParametersJSON Schema
NameRequiredDescriptionDefault
entity_slugYesStable kebab-case entity identifier.
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Since there are no annotations, the description carries the transparency burden. It discloses that the tool produces evidence, not a persisted verdict, and explicitly states 'no profile poisoning.' It also exposes the output semantics (range 0–100, null condition) and how the score is computed, which is strong value beyond the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is efficient and front-loaded with the core purpose, then details outputs and side-effect behavior. It is slightly longer than minimal but every sentence provides meaningful context; no filler or redundancy is present beyond minor overlap between the second and third sentences.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that there is no output schema, the description effectively explains the return values: neighbour counts, mean/min trust, adversary count, and derived.halo_score formula with null behavior. It also clears side-effect ambiguity. It lacks error-case or prerequisite details, but for a single-parameter scoring tool this is reasonably complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter entity_slug is well-documented in the schema ('Stable kebab-case entity identifier'), giving 100% schema coverage. The description adds little beyond referring to 'an entity's company,' but the schema is sufficient, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Scores an entity by the trust character of its neighbours' and specifies the scope (SSPs publishers sell through, DSPs it buys through). It also differentiates from generic scoring tools by defining the halo_score concept and its outputs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given on when to use this tool versus alternatives such as sigil_score_entity or signal_dark_pool_risk. The usage context is only implied by the unique halo-score concept, but no explicit when/when-not or alternative references are provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

signal_team_signalAInspect

Surfaces other entities that operate as a coordinated team with this one: they share a NARROWLY-held direct seller account (2–8 entities — network house accounts shared by hundreds are separated into house_accounts_excluded, not counted) or co-own an exchange seat. derived.team_signal (0–100) is a coordination magnitude over teammate count, shared-account breadth, and co-owned seats.

ParametersJSON Schema
NameRequiredDescriptionDefault
entity_slugYesStable kebab-case entity identifier.
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description takes on the full burden of behavioral disclosure. It goes beyond a simple summary by explaining the meaning of derived.team_signal (0–100), mentioning the house_accounts_excluded field, and clarifying counting rules (e.g., 2–8 entities, shared house accounts excluded). While it doesn't explicitly state read-only or auth requirements, the 'Surfaces' wording implies a read operation and the calculation details offer meaningful transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences and uses backticks for code references, making it visually clear. Every sentence contributes value: the first defines the tool's core purpose, and the second explains the signal's composition. It is concise, though slightly dense in technical detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that the tool has a single parameter and no output schema, the description does a solid job of conveying what the response will contain: likely a list of entities plus derived.team_signal and house_accounts_excluded. It explains the key fields and data boundaries. It doesn't specify pagination, but for a signal lookup tool this is acceptable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already provides a description for entity_slug ('Stable kebab-case entity identifier.'), giving 100% schema coverage. The tool description does not add additional parameter-specific guidance or constraints, so it meets the baseline but doesn't exceed it.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Surfaces') and identifies a clear resource: other entities coordinated with the given one. It provides precise criteria (shared narrow seller account or co-owned exchange seat), which distinguishes it from the other signal_* tools that focus on different risk or score aspects.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied rather than explicit. The description explains what the tool does and the scope of its calculation, but it does not state when to use this tool over sibling signal tools or provide explicit alternatives. There is no 'when to use' guidance, only the natural inference from the purpose.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

signal_tracker_densityBInspect

Observed component counts first, a labelled derived roll-up second. The components — data_categories, supply-surface counts (ssp + publisher + dsp + owns_seat + buys_through), and corroborating sources — are facts. derived.tracker_density (0–100) is a weighted blend of those counts, not a measurement; data_cost_usd is deliberately excluded (non-zero only for a curated seed, so weighting by it would fabricate precision). Anchors the surveillance_bigtech adversary class for the cross-lens classifier.

ParametersJSON Schema
NameRequiredDescriptionDefault
entity_slugYesStable kebab-case entity identifier ([a-z0-9-], 1–255 chars).
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It clearly discloses that derived.tracker_density is a weighted blend, not a measurement, and explains why data_cost_usd is excluded. This adds meaningful behavioral context beyond the raw schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a dense technical paragraph, but each sentence adds distinct value: output structure, component facts, derived score semantics, and use case. It could be more front-loaded, but it is not bloated.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with a single parameter and no output schema, the description covers the return value meaning (facts and derived score) and the purpose (anchoring an adversary class). It falls short of providing the exact output structure but is sufficiently informative.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already fully documents entity_slug with format details, and the description adds no parameter-specific information. Baseline of 3 is appropriate given high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explains the output structure (component counts and derived.tracker_density) but lacks an explicit verb or action, so an agent can infer it returns density data for an entity but not precisely what operation it performs. It differentiates the tool's unique derived score concept but not the primary purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool vs alternative signal tools (e.g., signal_halo_score, signal_dark_pool_risk). The mention of anchoring the cross-lens classifier is a downstream use case, not an agent-facing usage guideline.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

snapshot_dataCInspect

The exact bytes the manifest's sha256 commits to. Content-Type application/x-ndjson; rows ordered by domain. Verify: sha256(body) == manifest.sha256.

ParametersJSON Schema
NameRequiredDescriptionDefault
dateYes
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses output format (application/x-ndjson), row ordering by domain, and a verification step. However, without annotations, it does not state whether the tool is read-only, what happens with invalid dates, or rate limits. The description partially fulfills the burden.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is brief with two sentences and a verification line. No redundancy, but the first sentence is somewhat cryptic. Information is front-loaded but could be rephrased for clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Missing key context: the relationship to 'snapshot_manifest' and 'snapshot_diff', what a manifest is, and how to obtain the sha256. The date parameter is unexplained, and no return type is specified (despite no output schema needed). Incomplete for a tool with one parameter.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description does not explain the required 'date' parameter at all. Schema coverage is 0%, and the description provides no semantics (e.g., format, range, or purpose of date). This is a critical gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description indicates the tool returns bytes matching a manifest's sha256, specifying content type and ordering. However, it lacks an explicit action verb like 'retrieve' or 'get', and the purpose is not contrasted with sibling tools like 'snapshot_manifest'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives such as 'snapshot_manifest' or 'snapshot_diff'. The description does not mention prerequisites or typical workflow context, leaving the agent without decision criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

snapshot_diffCInspect

JSONL diff vs the previous snapshot — apply +/~/- lines instead of re-pulling the corpus.

ParametersJSON Schema
NameRequiredDescriptionDefault
dateYes
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Lacking annotations, the description does not explain side effects, idempotency, or how 'previous snapshot' is determined, leaving behavioral traits unclear.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence, but its brevity sacrifices clarity on important details like input format and output usage.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With low parameter coverage and no output schema, the description fails to explain input format, output structure, or how to apply the diff, leaving it incomplete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter 'date' has no schema description or explanation in the text; its role (e.g., snapshot date to diff against) is ambiguous.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it produces a JSONL diff against a previous snapshot with +/~/- lines, distinguishing it from full-data tools like snapshot_data.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies incremental updates but provides no explicit guidance on when to use this tool vs alternatives like snapshot_data or snapshot_manifest.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

snapshot_manifestBInspect

P4 corpus replication, the OPA "push data into the PDP" pattern. A daily snapshot of the domain corpus (domain, score, category, fingerprinting, entity) is published as deterministic JSONL with a manifest carrying row_count, sha256 over the exact bytes, a diff summary vs the previous day, and an Ed25519-signed Receipt v1.0 committed to the transparency log — a PDP that replicates the data can verify offline that it loaded exactly what was published.

date is YYYY-MM-DD or latest. Retention: 14 days. Fetch the rows from data_url, apply increments from diff_url ({"op":"+"|"~"|"-"} per line), re-pull the full file when the manifest marks the diff truncated.

ParametersJSON Schema
NameRequiredDescriptionDefault
dateYes
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Despite no annotations, the description discloses several behavioral traits: manifest contains row_count, sha256, diff summary, and a signed receipt; date supports 'YYYY-MM-DD' or 'latest'; retention is 14 days; diff format is specified; and it notes to re-pull when truncated. This is substantial behavioral context, though the exact return format (JSON object?) is implied but not explicit.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single dense paragraph mixing background, usage, and technical details. It could be split into clearer sections (purpose, usage, details) but is not overly long. Every sentence has information, but the structure reduces readability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the manifest content, date argument, retention, and diff handling. However, it does not specify the exact JSON structure of the manifest or mention any error cases. Without output schema, more detail on the return value would improve completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema only has 'date' with no description. The description adds meaning by specifying the format ('YYYY-MM-DD' or 'latest') and implying it selects the snapshot day. This compensates well for the 0% schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states that the tool provides a manifest for a daily snapshot of a domain corpus, but it is buried in jargon about replication patterns. The verb is not explicitly stated (e.g., 'fetch manifest'), and it does not clearly distinguish from sibling tools like snapshot_data or snapshot_diff. The purpose is inferable but not immediately clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool versus alternatives. It describes how to use the manifest (fetch rows, apply diffs), but does not say when to choose snapshot_manifest over other snapshot-related tools. Siblings are not mentioned or differentiated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

status_historyAInspect

One sample per 20-minute monitor sweep. uptime_pct is the share of sweeps in which every fail point was green (the strictest read); per_monitor lists only monitors that failed at least once in the window. History begins at feature deploy and is never extrapolated backwards — an empty window returns uptime_pct: null, not 100.

ParametersJSON Schema
NameRequiredDescriptionDefault
daysNo
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description fully discloses key behavioral traits: 20-minute sweep sampling, metric definitions, that history starts at feature deploy, no backward extrapolation, and null handling for empty windows. This exceeds expectations for a simple status tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences long, each packed with essential information. It front-loads the sampling rate and clearly explains metrics and edge cases. No redundant text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no output schema and one parameter, the description covers output semantics and edge cases well. However, it omits explanation of the 'days' parameter, which is needed for full completeness. Despite this, the core behavior is well described.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has one parameter (days) with 0% coverage in the description. The description does not mention this parameter at all, leaving its purpose (likely the history window length) unexplained. This is a significant gap given low schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly defines the tool's purpose: it provides historical status data with specific metrics (uptime_pct and per_monitor) sampled every 20 minutes. The resource (status history) and the action (retrieval) are well implied, and the tool is distinct from siblings like lookup or compliance tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance is given on when to use this tool versus alternatives, nor are there any exclusions or prerequisites. The context of siblings includes many unrelated tools, but the description fails to clarify the use case or suggest when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

stream_taskAInspect

Opens a persistent SSE connection that emits events as the task progresses. The stream closes automatically when the task reaches a terminal state or after ~90 seconds (timeout). Heartbeat comments are sent every ~15 seconds to keep the connection alive through proxies.

Event types:

  • status — emitted when status changes (pending → running → complete/failed)

  • result — emitted on complete with the full result payload

  • error — emitted on failed, cancelled, or expired with error info

  • SSE comment (: heartbeat) — keepalive, no data

Use this tool when:

  • You want real-time progress without polling.

  • You are in an environment that supports SSE (EventSource API).

Do NOT use this tool when:

  • You want a simple one-shot status check — use get_task instead.

  • Your HTTP client doesn't support streaming responses.

Inputs:

  • task_id (path, required): 26-char ULID.

Returns:

  • SSE stream (text/event-stream). Each event is event: <type>\\ndata: <json>\\n\\n.

Cost:

  • Free. Counts as one request against rate limits when the stream opens.

Latency:

  • First event: <200ms. Stream duration: up to 90s.

ParametersJSON Schema
NameRequiredDescriptionDefault
task_idYes
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description fully discloses the connection lifecycle (persistent SSE, auto-close on terminal state or ~90s timeout), keepalive heartbeats every ~15s, event types, cost (free but counts against rate limits), and latency. It also explains the SSE event format. This goes well beyond minimal disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections (overview, event types, usage guidance, inputs, returns, cost, latency). Every sentence provides useful information without fluff. It is front-loaded with the primary purpose and organized for easy scanning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description fully explains the return value (SSE stream format, event types, data structure) and also covers timeout, heartbeat, cost, and latency. It addresses terminal states and error conditions, making it complete for an agent to invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema coverage is 0% (no property descriptions), so the description must compensate. It does add value by clarifying `task_id` as a path parameter and restating the 26-char ULID requirement, which is helpful context beyond the raw schema. However, it does not offer examples or further semantics, but for a single simple parameter this is adequate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Opens a persistent SSE connection that emits events as the task progresses,' which clearly states the tool's purpose with a specific verb and resource. It also distinguishes itself from siblings by explicitly naming `get_task` as the alternative for one-shot status checks.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes dedicated 'Use this tool when' and 'Do NOT use this tool when' sections, providing explicit guidance on when to stream events versus when to poll with `get_task`, and cautions against use when SSE streaming is unsupported. This is exemplary alternative-selection guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

submit_feedbackAInspect

Close the loop: after you acted on a TunnelMind verdict, tell us how it went. Reports aggregate per node into an advisory second opinion that any caller can read back via GET /v1/feedback/{node}.

Advisory only. In v0 a negative aggregate does NOT silently lower the fused trust score — it's a human-weighable signal beside the verdict, not an automatic reweight.

Use this tool when:

  • You acted on a verdict and want to record the real-world outcome (honored, defrauded, no issue) to help future callers.

Inputs:

  • node (body, required): the subject — ip, domain, asn, or entity slug.

  • outcome (body, required): one of positive, negative, neutral.

  • receipt_id (body, optional): the verdict receipt this outcome refers to.

  • note (body, optional): free-text context, max 500 chars.

Returns the updated advisory aggregate { node, counts, total, score, signal }.

Cost:

  • Free. Requires an API key (authenticated callers only).

ParametersJSON Schema
NameRequiredDescriptionDefault
nodeYes
noteNo
outcomeYes
receipt_idNo
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fully discloses behavior: aggregates per node, returns a read-back endpoint, is advisory only, is free, and requires an API key. It explicitly states what the tool does NOT do (silently lower the fused trust score), which is valuable and not contradicted by any structured data.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-organized with clear sections for usage, inputs, return value, and cost. Every sentence provides necessary information without fluff. The description is front-loaded with the core purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the lack of annotations and output schema, the description is exceptionally complete. It covers purpose, usage, inputs, return shape, cost, and authentication, leaving no significant gaps for an agent to infer.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Despite 0% schema description coverage, the description meaningfully explains each parameter: node is the subject, outcome is an enum, receipt_id is an optional verdict reference, and note is free-text with a max length. This adds semantics beyond the raw schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: recording real-world outcomes after acting on a TunnelMind verdict. It uses a specific verb ('Close the loop', 'tell us how it went') and distinguishes itself from the read-only sibling get_feedback by explaining it aggregates feedback into an advisory opinion.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides an explicit 'Use this tool when' section with a concrete scenario. It also clarifies a key non-use condition: the feedback is advisory only and does not automatically reweight the fused trust score, preventing misuse.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

tracker_verifyAInspect

The Tracker lens-owned verify surface: a per-node verdict over the normalized DDG Tracker Radar / IAB TCF / Disconnect.me corpus, with an optional signed TunnelMind Receipt v1.0. This is the single-lens ground truth the fused POST /v1/verify cites for its tracker block.

Use this tool when:

  • You need to know whether a domain is tracking/surveillance infrastructure and which entity operates it, without the full cross-lens fusion.

  • You want a signed, offline-verifiable receipt for that single-lens answer.

Inputs:

  • node (path, required): a domain (e.g. doubleclick.net) or an entity slug (e.g. google). IPs and ASNs are not indexable by this lens.

  • receipt (query, optional): true attaches a Receipt v1.0 envelope.

Returns:

  • tracking: true (in the tracker corpus), false (queried, absent), or null (not answerable — ip/asn node or backend unavailable; see reason).

  • tracker: the lens record — domain {category, prevalence, score 0-100} plus operating entity {slug, name, parent_company, industry, sources}, or entity + top_domains when queried by slug.

  • checked_at: ISO 8601 timestamp of the corpus read.

  • receipt: TunnelMind Receipt v1.0 (Ed25519, JCS) when requested.

Cost:

  • Counts as one request against the daily rate limit.

Latency:

  • Typical: <100ms (one or two D1 reads at the edge).

ParametersJSON Schema
NameRequiredDescriptionDefault
nodeYes
receiptNo
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full responsibility for behavioral disclosure. It covers rate-limit cost, latency, null/not-answerable behavior with reason, the optional receipt envelope, and the fact that it reads from the corpus. This goes well beyond the minimal read-only expectation and adds valuable operational context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is longer than average but is well-structured with clear sections (Use this tool when, Inputs, Returns, Cost, Latency) and front-loads the core purpose. Every section adds information; no genuine fluff exists, though some sections could be tightened for extreme conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the lack of an output schema and annotations, the description is unusually complete. It explains purpose, usage, inputs, return fields (tracking, tracker, checked_at, receipt), edge cases (null with reason, slug vs domain), cost, latency, and the single-lens relationship to fused verify. This is sufficient for an agent to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has no descriptions (0% coverage), so the description must compensate. It thoroughly explains 'node' (path, required, domain or entity slug, not IP/ASN) and 'receipt' (query, optional, boolean that attaches a Receipt v1.0 envelope), including defaults and effects. This fully resolves parameter meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies a specific verb+resource: it is the tracker-lens verify surface producing a per-node verdict over named corpora (DDG Tracker Radar, IAB TCF, Disconnect.me). It also distinguishes itself from the fused 'POST /v1/verify' and cross-lens tools, making its unique role explicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description has a dedicated 'Use this tool when' section with two concrete use cases, and explicitly contrasts with 'full cross-lens fusion'. It also states what is not indexable (IPs/ASNs), providing clear guidance on when this tool should be selected over alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

tractionAInspect

Live traction numbers computed from sources the Worker owns: the hash-chained D1 audit log (7-day call volume, distinct identified callers, top operations), the stored-receipt table, and Stripe (succeeded charges → paying customers, gross USD). Ed25519-signed with the same attestation envelope as /v1/status so the numbers can be replayed to an auditor.

Use this tool when:

  • You are evaluating whether anyone actually uses and pays for this API.

  • You need a signed, re-checkable statement of usage rather than a claim.

Returns:

  • traction.usage: calls_7d, identified_callers_7d, anonymous_calls_7d, top_operations_7d — or available:false with a reason.

  • traction.receipts: stored receipt counts (total / 7d).

  • traction.revenue: paying_customers, succeeded_charges, gross_usd, truncated flag when the Stripe page is partial.

  • attestation: Ed25519 signature over the canonicalized traction block.

Cost:

  • Counts as one request against the daily rate limit. Cached 1h.

Latency:

  • Typical: <100ms cached; up to ~2s on a cache miss (one Stripe read).

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full weight and does so thoroughly. It discloses the computation sources, Ed25519 signing, rate-limit cost, 1-hour caching, latency behavior, and edge cases like 'available:false' and a 'truncated' flag. This is far beyond a minimal disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections: overview, use cases, return values, cost, and latency. It is front-loaded with the core purpose and then provides detailed but relevant specifics. Every sentence contributes useful operational or semantic context, and the formatting aids readability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is complex, has no output schema, and no annotations, yet the description fully covers what the tool returns, how the numbers are sourced and signed, what edge cases to expect, cost implications, and latency. An agent has enough context to select and invoke this tool correctly and interpret its results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and an empty schema description, so there are no parameter semantics to explain. Per the rubric, a zero-parameter tool gets a baseline of 4; the description instead focuses on output fields and operational behavior, which is appropriate and valuable.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: it returns live traction numbers (usage, receipts, revenue, attestation) computed from specific owned sources. It includes concrete data fields and is easily distinguishable from sibling tools, which focus on registries, compliance, receipts, or signals rather than aggregate usage/payment metrics.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says when to use the tool ('when you are evaluating whether anyone actually uses and pays for this API' and 'when you need a signed, re-checkable statement'). It does not explicitly describe when not to use it or name alternative tools, so it narrowly misses a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

verdict_lookupAInspect

The reconciliation layer in one call. Where cross_lens_verify answers "what is this network destination," verdict_lookup answers a different, sharper question about a key-addressed ACTOR: does what this key claims about itself match what the network has seen it do?

It fuses two sides:

  • claim — what the key can prove about itself: its attestation_tier across roots of trust (bare Ed25519 self-attestation → a RATS/EAT hardware/platform attestation). TunnelMind owns no silicon and reads every root; the tier is always measured/anchored, never self-asserted (a token claiming a higher tier than its trust anchor is trusted to assert is capped down).

  • conduct — what the graph has seen the key's subject do (Scry × Sigil × GhostRoute), supplied via the optional subject parameter.

The response carries reconciliation.contradictions (e.g. a key that attests silicon-root but behaves as a low-trust node → claim_exceeds_conduct; a presented claim that fails to verify → unverified_claim; claims presented with no proof of key control → key_control_unproven), a claim_vs_conduct_delta, and a verdict {tier, reputation, flags, confidence}.

Keys are linked to an identity ONLY when the actor cryptographically proves control — never inferred from behavioral correlation. An EAT that attests a different subject key is rejected, not silently merged.

The verdict is published as a self-verifying receipt: given the receipt bytes + the witness public keys carried inline, anyone re-derives the verdict and checks log inclusion OFFLINE with scripts/verify-verdict.mjs — no call back to TunnelMind. A bare, unattested key still gets a verdict (at self-asserted tier); attestation is never required to participate.

ParametersJSON Schema
NameRequiredDescriptionDefault
eatNoA RATS/EAT compact JWS (EdDSA) attesting this key, signed by a trusted anchor.
keyYesThe actor's Ed25519 public key, as hex (64 chars, optional 0x), base64url (43 chars, unpadded), or did:key (did:key:z6Mk…).
sigNoBase64 Ed25519 signature over `nonce`, proving control of the key.
nonceNoBinding nonce for a bare-Ed25519 self-attestation (paired with `sig`).
claimsNoURL-encoded JSON array of raw claim objects, e.g. `[{"type":"ed25519-self","signature":"…","nonce":"…"},{"type":"eat","token":"…"}]`. Overrides the `nonce`/`sig`/`eat` convenience params when present.
subjectNoAn ip / domain / ASN / entity_slug the key claims to act as. Drives the conduct (graph behavior) side of the reconciliation. Omit for a claim-only verdict.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does so thoroughly. It discloses the capping-down of self-asserted tiers, rejection of EATs for different subject keys, the requirement of cryptographic proof for identity linking, and the offline-verifiable receipt mechanism.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but well-structured with bold labels and clear sections; every sentence serves to explain the tool's behavior, inputs, or outputs. It could be tightened, but the density is justified for the complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has no annotations and no output schema, yet the description explains the response shape (contradictions, delta, verdict), edge cases (unattested keys, rejected EATs), and even the offline verification script. This is a comprehensive picture for a complex tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already provides 100% coverage with detailed per-parameter descriptions, so the baseline is 3. The narrative adds conceptual context about claim vs conduct but doesn't introduce syntax or constraints beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly defines the tool as a reconciliation layer that answers whether a key's claims match its observed network conduct, and explicitly contrasts it with `cross_lens_verify`. It names the specific resource (key-addressed ACTOR) and the action (fusing claim and conduct into a verdict), distinguishing it from siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly positions the tool against `cross_lens_verify` ('Where `cross_lens_verify` answers... `verdict_lookup` answers a different...'), providing a clear alternative. It also gives usage guidance on the optional `subject` parameter and notes that attestation is never required, so agents know when a bare key can still be processed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

verify_agentAInspect

Reconciles a claimed bot User-Agent against the operator's OWN published IP-range feed (Googlebot, GPTBot, OAI-SearchBot, ChatGPT-User, PerplexityBot, Perplexity-User, Bingbot). A User-Agent is trivial to forge; membership in the operator's published CIDR ranges is not. This exposes the common attack: a scraper sending User-Agent: Googlebot from an IP in none of Google's ranges.

Use this tool when:

  • A request claims to be a search/AI crawler and you must decide whether to trust that claim before serving, allowing, or logging it.

  • You are separating genuine declared agents from impersonators.

Inputs:

  • ip (path, required): the IPv4 or IPv6 address to check.

  • ua (query, optional): the claimed User-Agent string. Omit to ask only "is this IP a known published bot range?".

Returns:

  • verdict: one of

    • verified — the IP is inside the agent's published range (UA, if given, agrees). It genuinely is that bot.

    • spoofed — the UA claims a verifiable bot but the IP is in none of its published ranges. Impersonation.

    • mismatch — the IP is a real bot's range, but the UA names a different bot.

    • unverifiable — the UA names a real agent whose operator publishes no authoritative IP feed (e.g. Anthropic's ClaudeBot). Neither confirmed nor denied — never reported as spoofed.

    • unknown — no recognized bot UA and the IP is in no known range.

  • is_verified_agent, is_spoofed: booleans for the two actionable cases.

  • agent, agent_label, matched_agent, claimed_agent: the resolved identities.

  • reason: one-line explanation of the verdict.

  • feeds_as_of_ms: when the published ranges were last refreshed.

Cost:

  • Counts as one request against the daily rate limit.

Latency:

  • Typical: <50ms (one KV read + CIDR match). First call after a deploy may take ~1s if it has to warm the range cache.

ParametersJSON Schema
NameRequiredDescriptionDefault
ipYes
uaNo
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full responsibility for behavioral disclosure. It explains the fundamental security rationale (UA forgery vs. IP range membership), details all verdict outcomes including edge cases (e.g., 'unverifiable' never reported as spoofed), and discloses operational behaviors such as rate-limit counting and cache-warming latency. This is exceptionally transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but well-structured with clear sections: purpose, use cases, inputs, returns, cost, and latency. The first sentence immediately delivers the core function. Every section provides necessary operational detail without fluff. The structure makes the length appropriate for the tool's complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given there is no output schema, the description thoroughly explains all possible return fields and verdict values. It also covers cost and latency, which are essential for an agent deciding whether to invoke the tool. The information is complete enough for an agent to fully understand the tool's behavior and results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although the input schema has 0% description coverage (only type and required flags), the description compensates fully by explaining each parameter's purpose, location (path/query), requiredness, and optional behavior. For `ua`, it even describes what happens when omitted. This adds substantial meaning beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource: 'Reconciles a claimed bot User-Agent against the operator's OWN published IP-range feed.' It clearly identifies the tool's function of verifying bot claims against IP ranges and lists the exact bots covered. This distinguishes it from sibling tools like verify_agent_signature (which likely verifies signatures, not IP ranges).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides an explicit 'Use this tool when' section with two concrete scenarios: deciding whether to trust a bot claim before serving/allowing/logging, and separating genuine agents from impersonators. This is clear usage context, but it does not mention alternative tools or explicitly state when not to use it, so it falls just short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

verify_agent_signatureAInspect

Neutral third-party Web Bot Auth verification. An origin — or the PDP deciding for it — received a request from a claimed agent carrying the Web Bot Auth headers (Signature, Signature-Input, Signature-Agent). Relay those headers here, plus the authority the request was addressed to, and TunnelMind verifies the Ed25519 signature against the agent's own published key directory (https:///.well-known/http-message-signatures-directory).

Facts, not a verdict: state: verified means "this signature cryptographically verifies against that directory" — whether to trust the agent behind it is your policy engine's call.

Use this tool when:

  • A request claims a cryptographic agent identity (Signature-Agent header present) and you must check the claim before serving it.

  • You want signature verification independent of your CDN — or you are not behind a CDN that implements Web Bot Auth at all.

Inputs (JSON body):

  • signature (required): the received Signature header value.

  • signature_input (required): the received Signature-Input header value.

  • signature_agent (required): the received Signature-Agent header value (quoted https origin).

  • authority (required): the host the request was addressed to.

  • method, path, scheme (optional): only needed if the signature's covered components include them.

Returns:

  • state: one of

    • verified — Ed25519 signature verifies against a key in the agent's published directory.

    • invalid_signature — key found, signature does not verify (tampered or forged).

    • unknown_key — directory reachable but contains no key with the claimed thumbprint.

    • directory_unreachable — the claimed key directory did not answer; an honest degraded state, not evidence of forgery.

    • expired — the signature's expires timestamp has passed.

    • malformed — headers do not parse as a Web Bot Auth signature.

  • key_id: the claimed RFC 7638 JWK thumbprint.

  • directory_url: the resolved well-known directory URL.

  • params: created/expires/alg/tag as sent.

  • checks[]: per-check {name, pass, detail} facts a PDP can gate on.

Cost:

  • Counts as one request against the daily rate limit.

Latency:

  • Typical: <100ms when the agent's directory is KV-cached (1h TTL); up to ~5s on first sight of a new directory.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathNo
methodNo
schemeNo
authorityYes
signatureYes
signature_agentYes
signature_inputYes
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fully discloses cost (counts as one request against rate limit), latency (cached <100ms, up to ~5s on first sight), and behavior (verification states, directory resolution, checks array). No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-structured with headings and bullet points, but slightly verbose. Every sentence adds value, but could be tightened around return values. Front-loaded purpose and usage effectively.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 7 params, no output schema, and no annotations, the description covers inputs, outputs, states, cost, latency, and behavioral nuances. Completely sufficient for an agent to select and invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Despite 0% schema description coverage, the description explains each parameter in detail: required headers (signature, signature_input, signature_agent, authority) and optional ones (method, path, scheme) with context on when needed. Compensates fully for missing schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it is for 'neutral third-party Web Bot Auth verification'. It specifies the verb 'verify' and the resource 'agent signature' with cryptographic detail. Distinguishes from sibling 'verify_agent' by focusing on Web Bot Auth headers and signature verification against a key directory.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly provides use cases: when a request claims cryptographic identity and must check the claim, or when signature verification is needed independent of CDN. Also clarifies what the tool does not do ('Facts, not a verdict'), guiding the agent on when to use versus its own policy enforcement.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

verify_receiptAInspect

Tamper-detection verification for TunnelMind surveillance receipts. Submit the receipt ID, the SHA-256 content hash, and the Ed25519 signature from the receipt document. The registry compares these against what was recorded at issuance time. Returns VALID if both match exactly, INVALID with a specific mismatch reason otherwise.

Use this tool when:

  • You received a surveillance receipt document and want to verify it hasn't been altered.

  • You are programmatically checking receipt authenticity in an agent workflow.

  • You want to prove to a third party that a receipt is genuine.

Do NOT use this tool when:

  • You only want to check existence — use get_receipt instead (no body required).

Inputs:

  • receipt_id (body, required): The receipt's ID field from the document.

  • content_hash (body, required): SHA-256 hex hash of the receipt JSON. Max 256 chars.

  • signature (body, required): Ed25519 signature from the receipt document. Max 512 chars.

Returns:

  • valid: boolean. True only if both hash and signature match exactly.

  • status: VALID or INVALID.

  • message: human-readable explanation. On INVALID, specifies whether the hash mismatched, the signature mismatched, or both.

Cost:

  • Free. No API key required.

Latency:

  • Typical: <100ms, p99: <300ms.

ParametersJSON Schema
NameRequiredDescriptionDefault
signatureYesEd25519 signature from the receipt document
receipt_idYes
content_hashYesSHA-256 hex hash of the receipt JSON content
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses the verification mechanism (compares against issuance record), the output semantics (VALID/INVALID with specific mismatch reason), and additional operational details (free, no API key, latency). This is a complete and transparent behavioral disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections (overview, when-to-use, when-not-to-use, inputs, returns, cost, latency). Every sentence provides necessary information; there is no fluff or redundancy. The front-loaded purpose sentence allows quick comprehension.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (3 required params, no output schema, no annotations), the description covers all necessary contexts: input semantics, output format, mismatch behavior, cost, latency, and alternatives. It is fully self-sufficient for an agent to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds meaning beyond the schema by explaining each parameter's source ('from the receipt document'), specifying 'body' placement, reiterating requiredness, and providing max lengths. It compensates for the 33% of schema parameters lacking descriptions, especially `receipt_id`, which only has an example in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a clear verb and object: 'Tamper-detection verification for TunnelMind surveillance receipts.' It specifies exactly what the tool does (verify authenticity against issuance record) and distinguishes it from the sibling `get_receipt` (existence check without body). This makes it unambiguous and sibling-differentiated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit 'Use this tool when' and 'Do NOT use this tool when' sections provide clear guidance, including a specific alternative (`get_receipt`). This satisfies the highest bar for usage guidance with both positive and negative cases.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

x402_echoAInspect

Validates an agent's x402 v1 client implementation against a TunnelMind surface end-to-end. Two operating modes:

  • mode: "demo" — HMAC over a nonce against a publicly-published secret. Does not move USDC. Smoke proves the WIRE works, not money movement.

  • mode: "x402" — real Coinbase facilitator dispatch (gated on operator wallet provisioning; currently returns "facilitator not configured").

Without an X-PAYMENT header, the endpoint returns HTTP 402 with a standards- compliant accepts[] array (USDC on Base, $0.001).

With a valid X-PAYMENT header (base64-encoded payment payload), echoes the request body and returns an X-PAYMENT-RESPONSE settlement header.

Use this tool when:

  • You are validating your agent's x402 v1 client implementation against a real public endpoint.

  • You want to demonstrate the full 402 → retry → settle wire end-to-end.

Do NOT use this tool when:

  • You need a real paid operation — no TunnelMind production endpoint is gated behind x402 yet.

Inputs:

  • X-PAYMENT (header, optional): base64(JSON) per the x402 v1 spec. Without it, a 402 challenge is returned.

  • Request body (optional): any JSON object to be echoed back on successful payment.

Returns:

  • On no header: HTTP 402 + { x402Version, accepts: [...] }.

  • On valid payment: HTTP 200 + { ok: true, data: { echoed, paid_micro_usdc, x402 } } and an X-PAYMENT-RESPONSE header carrying the settlement record.

  • On invalid payment: HTTP 402 + { error: "invalid payment", reason }.

Discovery:

  • https://tunnelmind.ai/.well-known/x402.json carries the public demo secret and the HMAC construction recipe.

Cost:

  • Free in demo mode (no USDC moved). $0.001 USDC in real-mode (when activated).

Latency:

  • Typical <100ms (demo mode); real mode is bounded by facilitator latency.

ParametersJSON Schema
NameRequiredDescriptionDefault
X-PAYMENTNobase64(JSON) payment payload per the x402 v1 spec. Absent → 402 challenge.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden and exceeds it. It details two operating modes (demo vs. x402), exact HTTP responses for missing/valid/invalid X-PAYMENT headers, the 'accepts[]' array, cost implications, and latency expectations. This is a model of behavioral disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but well-structured with clear section headers, bullet points, and code-like syntax for returns. Every section (Inputs, Returns, Discovery, Cost, Latency) earns its place by providing non-redundant, actionable information. It's front-loaded with the most critical purpose statement.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (modes, payment protocol, headers) and the absence of an output schema, the description is remarkably complete. It covers inputs, all output cases, error handling, cost, latency, and discovery of the demo secret—everything an agent needs to invoke and interpret the result correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already describes X-PAYMENT with 100% coverage, so baseline is 3. The description adds value by specifying that X-PAYMENT is a 'header', its base64(JSON) format, and explicitly tying it to the 402→retry→settle flow. It doesn't go into deep syntax but the additional header context justifies a 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource statement: 'Validates an agent's x402 v1 client implementation against a TunnelMind surface end-to-end.' It clearly distinguishes itself from sibling verification tools by focusing on x402 client validation against a public endpoint, not generic agent verification.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit guidance is provided with dedicated 'Use this tool when' and 'Do NOT use this tool when' sections, including concrete scenarios like 'validating your agent's x402 v1 client implementation' and an exclusion for 'a real paid operation'. This leaves no ambiguity about appropriate vs. inappropriate usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Discussions

No comments yet. Be the first to start the discussion!

Related MCP Servers

  • F
    license
    A
    quality
    B
    maintenance
    Local-first MCP tools for AI-assisted work receipts, workspace maps, routing ledgers, measured verdicts, and shared state verification across the five Project Telos flagships.
    23
    2
  • A
    license
    -
    quality
    C
    maintenance
    MCP server for the HiveMorph polymorphic agent runtime, exposing audit log, identity index, supermodel directory, brood carousel, and approval queue with x402 micropayments.
    MIT

View all MCP Servers

Try in Browser

Your Connectors

Sign in to create a connector for this server.

Resources