changedInput schema / description
Previous value: -"Provide an authentic parent macaroon, an array of restrictions, and optional TTL; child caveats intersect with inherited constraints and no payment invoice is issued."New value: +"Provide an authentic parent macaroon and at least one restriction: expiresAt or ttlSeconds, exact tools, or caveats. New caveats intersect with inherited constraints and no payment invoice is issued."
changedInput schema / examples
Previous value: -[
- {
- "caveats": [
- "allowed_tools = stratigraphy.get,stratigraphy.get_digest",
- "max_target = 870000"
- ],
- "macaroon": "base64url-parent-macaroon",
- "ttlSeconds": 3600
- }
-]New value: +[
+ {
+ "caveats": [
+ "max_target = 870000"
+ ],
+ "expiresAt": "2026-12-31T23:59:59Z",
+ "macaroon": "base64url-parent-macaroon",
+ "tools": [
+ "stratigraphy.get_diff"
+ ]
+ }
+]
addedInput schema / properties / caveats / default
Added value: +[]
changedInput schema / properties / caveats / description
Previous value: -"List of restriction caveats to append (e.g. ['time_before = 2026-12-31', 'max_target = 870000', 'allowed_tools = stratigraphy.get,stratigraphy.get_digest']). Existing allowed_path and max_requests restrictions are also supported. Constraints: maxItems: 16. Example: [\"time_before = 2026-12-31\",\"max_target = 870000\",\"allowed_tools = stratigraphy.get,stratigraphy.get_digest\"]."New value: +"Optional restriction caveats to append, normalized to canonical form: 'time < 2026-12-31T23:59:59Z', 'rpc = stratigraphy.get_diff', 'max_target = 870000', 'max_requests = 1', 'allowed_path = /mcp/tools/stratigraphy.get_diff', and legacy 'time_before = 2026-12-31' or 'allowed_tools = stratigraphy.get,stratigraphy.get_digest'. Constraints: maxItems: 16. Example: [\"max_target = 870000\"]."
changedInput schema / properties / caveats / example
Previous value: -[
- "time_before = 2026-12-31",
- "max_target = 870000",
- "allowed_tools = stratigraphy.get,stratigraphy.get_digest"
-]New value: +[
+ "max_target = 870000"
+]
changedInput schema / properties / caveats / examples
Previous value: -[
- [
- "time_before = 2026-12-31",
- "max_target = 870000",
- "allowed_tools = stratigraphy.get,stratigraphy.get_digest"
- ]
-]New value: +[
+ [
+ "max_target = 870000"
+ ]
+]
changedInput schema / properties / caveats / items / description
Previous value: -"One supported restriction caveat. Constraints: minLength: 1; maxLength: 256. Example: \"max_target = 870000\"."New value: +"One supported restriction caveat. Constraints: minLength: 1; maxLength: 256. Example: \"time < 2026-12-31T23:59:59Z\"."
changedInput schema / properties / caveats / items / example
Previous value: -"max_target = 870000"New value: +"time < 2026-12-31T23:59:59Z"
changedInput schema / properties / caveats / items / examples
Previous value: -[
- "max_target = 870000"
-]New value: +[
+ "time < 2026-12-31T23:59:59Z"
+]
addedInput schema / properties / expiresAt
Added value: +{
+ "description": "Optional absolute expiration boundary as a future UTC instant (YYYY-MM-DDTHH:MM:SSZ, optionally with .sss milliseconds). Appends `time < YYYY-MM-DDTHH:MM:SS.sssZ`; it cannot extend the parent's expiry. Mutually exclusive with ttlSeconds. Constraints: format: date-time; pattern: ^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d{3})?Z$. Example: \"2026-12-31T23:59:59Z\".",
+ "example": "2026-12-31T23:59:59Z",
+ "examples": [
+ "2026-12-31T23:59:59Z"
+ ],
+ "format": "date-time",
+ "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d{3})?Z$",
+ "type": "string"
+}
changedInput schema / properties / macaroon / description
Previous value: -"Required authentic, unexpired parent L402 macaroon (1-8192 characters); caveats and ttlSeconds can only narrow its scope. Constraints: minLength: 1; maxLength: 8192. Example: \"base64url-parent-macaroon\"."New value: +"Required authentic, unexpired parent L402 macaroon (1-8192 characters); added restrictions can only narrow its scope. Constraints: minLength: 1; maxLength: 8192. Example: \"base64url-parent-macaroon\"."
addedInput schema / properties / tools
Added value: +{
+ "description": "Optional exact MCP tool targets (1-16 unique names). Appends one `rpc = tool[,tool...]` caveat; the child is refused for every other tool. Matching is exact, so a legacy alias is a different name. Each tool must already be authorized by the parent: an MCP L402 credential authorizes the single tool named in its allowed_path. Constraints: minItems: 1; maxItems: 16. Example: [\"stratigraphy.get_diff\"].",
+ "example": [
+ "stratigraphy.get_diff"
+ ],
+ "examples": [
+ [
+ "stratigraphy.get_diff"
+ ]
+ ],
+ "items": {
+ "description": "Registered MCP tool name or supported legacy alias. Constraints: pattern: ^[a-z][a-z0-9]*\\.[a-z][a-z0-9_]*$. Example: \"stratigraphy.get_diff\".",
+ "example": "stratigraphy.get_diff",
+ "examples": [
+ "stratigraphy.get_diff"
+ ],
+ "pattern": "^[a-z][a-z0-9]*\\.[a-z][a-z0-9_]*$",
+ "type": "string"
+ },
+ "maxItems": 16,
+ "minItems": 1,
+ "type": "array",
+ "uniqueItems": true
+}
changedInput schema / properties / ttlSeconds / description
Previous value: -"Optional positive integer TTL of 1-2592000 seconds (e.g. 3600); appends an expiration caveat without extending the parent's expiry. Constraints: minimum: 1; maximum: 2592000. Example: 3600."New value: +"Optional positive integer TTL of 1-2592000 seconds (e.g. 3600). Appends `time <` at the current time plus ttlSeconds; it cannot extend the parent's expiry. Mutually exclusive with expiresAt. Constraints: minimum: 1; maximum: 2592000. Example: 3600."
changedInput schema / required
Previous value: -[
- "macaroon",
- "caveats"
-]New value: +[
+ "macaroon"
+]
changedOutput schema / examples
Previous value: -[
- {
- "appliedCaveats": [
- "max_target=870000"
- ],
- "attenuatedMacaroon": "base64url-child-macaroon",
- "issuedAt": "2026-09-27T21:00:00.000Z",
- "status": "attenuated"
- }
-]New value: +[
+ {
+ "appliedCaveats": [
+ "max_target=870000",
+ "time < 2026-12-31T23:59:59.000Z",
+ "rpc = stratigraphy.get_diff"
+ ],
+ "attenuatedMacaroon": "base64url-child-macaroon",
+ "issuedAt": "2026-09-27T21:00:00.000Z",
+ "status": "attenuated"
+ }
+]
changedOutput schema / properties / appliedCaveats / description
Previous value: -"New canonical caveats appended to the parent; inherited caveats are preserved inside the token. Example: [\"max_target=870000\"]."New value: +"New canonical caveats appended to the parent; inherited caveats are preserved inside the token. Example: [\"max_target=870000\",\"time < 2026-12-31T23:59:59.000Z\",\"rpc = stratigraphy.get_diff\"]."
changedOutput schema / properties / appliedCaveats / example
Previous value: -[
- "max_target=870000"
-]New value: +[
+ "max_target=870000",
+ "time < 2026-12-31T23:59:59.000Z",
+ "rpc = stratigraphy.get_diff"
+]
changedOutput schema / properties / appliedCaveats / examples
Previous value: -[
- [
- "max_target=870000"
- ]
-]New value: +[
+ [
+ "max_target=870000",
+ "time < 2026-12-31T23:59:59.000Z",
+ "rpc = stratigraphy.get_diff"
+ ]
+]
changedOutput schema / properties / appliedCaveats / items / description
Previous value: -"One appended canonical caveat. Example: \"max_target=870000\"."New value: +"One appended canonical caveat. Example: \"rpc = stratigraphy.get_diff\"."
changedOutput schema / properties / appliedCaveats / items / example
Previous value: -"max_target=870000"New value: +"rpc = stratigraphy.get_diff"
changedOutput schema / properties / appliedCaveats / items / examples
Previous value: -[
- "max_target=870000"
-]New value: +[
+ "rpc = stratigraphy.get_diff"
+]
