Skip to main content
Glama

Attenuate a Macaroon

proof.attenuate
Read-onlyIdempotent

Attenuate an authentic, unexpired L402 parent macaroon by appending restrictive caveats and optionally ttlSeconds. At least one restriction is required. Requires its own L402 authorization; the parent's payment proof remains required for child redemption. Delegation cannot widen authority or reset an inherited quota. Live L402 Satoshi settlement: a configured NWC wallet issues the exact-priced Lightning invoice; paid execution requires confirmed incoming settlement and an invoice-bound payment proof. Handle HTTP 402, pay explicitly, then retry the identical request with Authorization: L402 :. Invoice creation alone is not payment; unavailable verification does not authorize execution.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
caveatsYesList of restriction caveats to append (e.g. ['time_before = 2026-12-31', 'max_target = 870000', 'allowed_tools = stratigraphy.get,stratigraphy.get_digest']). Existing allowed_path and max_requests restrictions are also supported. Constraints: maxItems: 16. Example: ["time_before = 2026-12-31","max_target = 870000","allowed_tools = stratigraphy.get,stratigraphy.get_digest"].
macaroonYesRequired authentic, unexpired parent L402 macaroon (1-8192 characters); caveats and ttlSeconds can only narrow its scope. Constraints: minLength: 1; maxLength: 8192. Example: "base64url-parent-macaroon".
ttlSecondsNoOptional positive integer TTL of 1-2592000 seconds (e.g. 3600); appends an expiration caveat without extending the parent's expiry. Constraints: minimum: 1; maximum: 2592000. Example: 3600.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
statusYesSuccessful attenuation status. Example: "attenuated".
issuedAtYesUTC issuance timestamp. Constraints: format: date-time. Example: "2026-09-27T21:00:00.000Z".
appliedCaveatsYesNew canonical caveats appended to the parent; inherited caveats are preserved inside the token. Example: ["max_target=870000"].
attenuatedMacaroonYesEncoded child subscription macaroon. Treat as a bearer credential. Example: "base64url-child-macaroon".

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed4 schema fields changed
    • changedInput schema / examples
      Previous value: -[
      -  {
      -    "caveats": [
      -      "allowed_tools = stratigraphy.get,stratigraphy.digest",
      -      "max_target = 870000"
      -    ],
      -    "macaroon": "base64url-parent-macaroon",
      -    "ttlSeconds": 3600
      -  }
      -]New value: +[
      +  {
      +    "caveats": [
      +      "allowed_tools = stratigraphy.get,stratigraphy.get_digest",
      +      "max_target = 870000"
      +    ],
      +    "macaroon": "base64url-parent-macaroon",
      +    "ttlSeconds": 3600
      +  }
      +]
    • changedInput schema / properties / caveats / description
      Previous value: -"List of restriction caveats to append (e.g. ['time_before = 2026-12-31', 'max_target = 870000', 'allowed_tools = stratigraphy.get,stratigraphy.digest']). Existing allowed_path and max_requests restrictions are also supported. Constraints: maxItems: 16. Example: [\"time_before = 2026-12-31\",\"max_target = 870000\",\"allowed_tools = stratigraphy.get,stratigraphy.digest\"]."New value: +"List of restriction caveats to append (e.g. ['time_before = 2026-12-31', 'max_target = 870000', 'allowed_tools = stratigraphy.get,stratigraphy.get_digest']). Existing allowed_path and max_requests restrictions are also supported. Constraints: maxItems: 16. Example: [\"time_before = 2026-12-31\",\"max_target = 870000\",\"allowed_tools = stratigraphy.get,stratigraphy.get_digest\"]."
    • changedInput schema / properties / caveats / example
      Previous value: -[
      -  "time_before = 2026-12-31",
      -  "max_target = 870000",
      -  "allowed_tools = stratigraphy.get,stratigraphy.digest"
      -]New value: +[
      +  "time_before = 2026-12-31",
      +  "max_target = 870000",
      +  "allowed_tools = stratigraphy.get,stratigraphy.get_digest"
      +]
    • changedInput schema / properties / caveats / examples
      Previous value: -[
      -  [
      -    "time_before = 2026-12-31",
      -    "max_target = 870000",
      -    "allowed_tools = stratigraphy.get,stratigraphy.digest"
      -  ]
      -]New value: +[
      +  [
      +    "time_before = 2026-12-31",
      +    "max_target = 870000",
      +    "allowed_tools = stratigraphy.get,stratigraphy.get_digest"
      +  ]
      +]
  2. Changed3 schema fields changed
    • changedInput schema / description
      Previous value: -"Derive a narrower child of an authentic, unexpired subscription macaroon; this delegation call does not issue a payment invoice."New value: +"Provide an authentic parent macaroon, an array of restrictions, and optional TTL; child caveats intersect with inherited constraints and no payment invoice is issued."
    • changedInput schema / properties / macaroon / description
      Previous value: -"Base L402 Macaroon string to attenuate. Constraints: minLength: 1; maxLength: 8192. Example: \"base64url-parent-macaroon\"."New value: +"Required authentic, unexpired parent L402 macaroon (1-8192 characters); caveats and ttlSeconds can only narrow its scope. Constraints: minLength: 1; maxLength: 8192. Example: \"base64url-parent-macaroon\"."
    • changedInput schema / properties / ttlSeconds / description
      Previous value: -"Optional time-to-live in seconds to automatically append an expiration caveat. Must be a positive integer of at most 30 days. Constraints: minimum: 1; maximum: 2592000. Example: 3600."New value: +"Optional positive integer TTL of 1-2592000 seconds (e.g. 3600); appends an expiration caveat without extending the parent's expiry. Constraints: minimum: 1; maximum: 2592000. Example: 3600."
  3. Added

TDQS

Score is being calculated.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources