invinoveritas
Server Details
Second opinion before an irreversible agent action; signed proofs, free verify, public ledger.
- Status
- Healthy
- Uptime
- 99.5% over 49 days
- Last Tested
- Transport
- Streamable HTTP · MCP 2025-06-18
- URL
- Repository
- babyblueviper1/invinoveritas
- GitHub Stars
- 6
- Server Listing
- invinoveritas
TDQS
Scored across 8 tools
Tools mostly target clearly distinct operations: audit, review, validate, witness, verify, ledger read/write, and conformance certification. Slight overlap exists where conformance_certify and ledger_submit both publish to the ledger, and review/validate both produce verdicts, but their descriptions clearly delimit the object and scope.
All names use snake_case consistently, but the verb/noun ordering is mixed: verb-first (audit_agent_readiness, verify_proof), noun-first (ledger, ledger_submit, conformance_certify), and bare verbs (review, validate, witness). This is readable but lacks a predictable pattern.
Eight tools sit comfortably in the effective range and each addresses a distinct verification, ledger, or audit capability. There is no obvious redundancy or bloat.
The surface covers core workflows: auditing, reviewing, validating, witnessing, signing, verifying proofs, and reading/writing the ledger. Minor gaps remain, such as no direct read/query of the conformance registry beyond certification and no proof search by artifact or issuer beyond event_id lookup.
Available Tools
8 toolsaudit_agent_readinessARead-onlyInspect
Audits a public agent or API URL for verifiability: discovery files (llms.txt, MCP card, robots, sitemap), handshake endpoints, and whether presented signed proofs validate. Returns a 0-100 score, a grade, ranked fixes, and a signed proof of the audit. Every result re-derives from a public fetch. Docs: https://api.babyblueviper.com/docs
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | The agent endpoint/site URL to audit (public http(s) only) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark this as read-only and non-destructive. The description adds meaningful behavioral context beyond that: it returns a score, grade, ranked fixes, and a signed proof, and it emphasizes that every result re-derives from a fresh public fetch, which affects how an agent should interpret the output.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and front-loaded with the core verb and resource. Each sentence adds value: scope, checked items, return values, verification guarantee, and a docs link. There is no fluff or repetition of the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter, read-only audit tool with no output schema, the description is complete. It explains what will happen, what the result looks like, and the guarantee that results are reproducible from public fetches. No critical missing context is apparent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is only one parameter, url, and its schema description already specifies that it must be a public HTTP(S) agent endpoint/site URL. The tool description does not add new parameter-level information, but with 100% schema description coverage, this is an acceptable baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool's action: auditing a public agent or API URL for verifiability. It enumerates specific checked artifacts (llms.txt, MCP card, robots, sitemap, handshake endpoints, signed proofs) and the concrete output (score, grade, ranked fixes, signed proof), which distinguishes it from generic siblings like validate or verify_proof.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description makes the intended context clear: public agent/API URLs only, with all results derived from public fetches. It does not explicitly compare against sibling tools or state when not to use it, but the public-only constraint and audit-specific focus provide sufficient guidance for most cases.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
conformance_certifyAIdempotentInspect
Publishes a verifier's current conformance grade from the public registry (conformance.json) as a permanent, signed ledger entry, labeled 'certified as of this measurement'. It records the registry's existing measurement and cannot change it. Only works for a verifier currently listed as certified. Docs: https://api.babyblueviper.com/conformance
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | The verifier's exact name as listed on GET /conformance.json (must currently show certified:true). | |
| note | No | Optional short context for the ledger entry. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations, the description discloses that the entry is permanent and signed, that the tool cannot change the registry measurement, and that it only works for currently certified verifiers. This adds meaningful behavioral context beyond the readOnlyHint, idempotentHint, and destructiveHint annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences with no filler. It front-loads the core action, then adds the key limitations and a documentation link. Every sentence contributes useful information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the purpose, the permanent signed nature, the inability to change the measurement, and the certified-only precondition. A small gap is that it does not describe the return value or explicitly contrast with ledger_submit, but the documentation link and annotations fill most remaining context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the schema already documents both parameters, including the exact-name requirement and the certified:true precondition. The description reinforces this by mentioning the registry and certification status, but it does not add substantial parameter-level meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb ('Publishes') and resource ('verifier's current conformance grade from the public registry') and clearly distinguishes this from other ledger operations by stating it cannot change the existing measurement. It also adds the certified-only precondition, making the tool's scope unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly states when the tool applies: only for a verifier currently listed as certified, and it records the registry's existing measurement rather than creating or altering it. It does not explicitly name an alternative such as ledger_submit for new ledger entries, but the constraints are clear enough for an agent to select this tool appropriately.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ledgerARead-onlyIdempotentInspect
Reads invinoveritas's public track record of signed verdicts, including ones that turned out wrong. Each entry is a signed Nostr event whose id and signature can be recomputed against invinoveritas's published key; entries are append-only and Bitcoin-timestamped, so they can't be edited after the fact. No arguments returns the index; pass entry to read one. Free, no sign-in. Docs: https://api.babyblueviper.com/ledger
| Name | Required | Description | Default |
|---|---|---|---|
| entry | No | Optional entry number (e.g. '1'); omit for the full index. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnlyHint and idempotentHint annotations, the description reveals that entries are signed Nostr events whose integrity can be recomputed, and that they are append-only and Bitcoin-timestamped, implying immutability. It also states the access model, free and no sign-in, which is useful for an agent deciding whether to call. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four sentences, each earning its place: purpose, integrity model, usage, and access/documentation. The most decision-relevant information is front-loaded in the first sentence, and the docs link is a compact pointer rather than bloat.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-optional-parameter read tool with annotations already covering safety and idempotence, the description covers purpose, data model, behavior, access, and documentation. The only omission is a concrete description of the response shape for the index or an entry, but that is partially mitigated by the explicit usage instructions and docs link.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already fully documents the optional entry parameter with an example and the omit-for-index behavior, so the baseline is 3. The description restates this behavior rather than adding new parameter-level semantics. No additional syntax or format details are introduced.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a specific verb and resource: 'Reads invinoveritas's public track record of signed verdicts,' which immediately sets it apart from write/verify siblings like ledger_submit and verify_proof. The addition of 'including ones that turned out wrong' narrows the scope and reinforces that this is an audit/read tool. Clear and unambiguous purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides concrete invocation context: no arguments yields the index, passing entry reads a specific record, and access is free with no sign-in. It does not explicitly name alternatives or state when-not-to-use, but the read-only framing makes the appropriate use clear for an agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ledger_submitAInspect
Publishes one of your own signed review proofs (from review with sign=true) as a public entry on the invinoveritas ledger. Publication is immediate and permanent: the entry is broadcast to Nostr relays and Bitcoin-timestamped. Only genuine invinoveritas-signed proofs are accepted. Docs: https://api.babyblueviper.com/ledger
| Name | Required | Description | Default |
|---|---|---|---|
| note | No | Optional short context: what this verdict was for, why it's worth featuring. | |
| event | Yes | The signed Nostr event from a prior /review(sign=true) call — the exact proof.event object that response returned. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds meaningful behavioral disclosure beyond the annotations: publication is 'immediate and permanent', broadcast to Nostr relays, Bitcoin-timestamped, and restricted to 'genuine invinoveritas-signed proofs'. With readOnlyHint=false, idempotentHint=false, and destructiveHint=false already provided, this description usefully explains the irreversible, external side-effects of the operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded: the core action appears in the first sentence, followed by critical permanence constraints and acceptance criteria. Every sentence carries information relevant to calling the tool correctly, and the docs URL is a lightweight addition rather than noise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no output schema, the description covers the important context: source input (signed review proof), destination (ledger/Nostr), permanence, and validity requirements. It does not describe the exact return shape or failure modes, but the docs link and clear input constraints make this adequate for safe invocation of an irreversible publish action.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents both parameters well, including that event must be the exact proof.event object from a prior /review(sign=true) call. The description reinforces this by saying the input must be one of the user's own signed proofs, but it does not add substantial new meaning for either parameter beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb and resource ('Publishes... on the invinoveritas ledger') and scopes the input precisely to 'one of your own signed review proofs (from review with sign=true)'. This clearly distinguishes it from siblings like ledger, review, and verify_proof by specifying exactly which prior output it consumes and what permanent public action it performs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description establishes the correct triggering context: it should be used after a review call with sign=true, and only on the exact proof.event returned there. It does not explicitly name alternatives or exclusions (e.g., 'use ledger to read entries'), but the conditional source is clear enough for most agents to avoid misuse.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
reviewARead-onlyInspect
Independent verdict on a proposed action before it is taken: a code diff, shell command, deployment plan, configuration change, another agent's output, or a proposed transaction. Returns approve / approve_with_concerns / reject with a confidence score, issues ranked by severity, suggested fixes and alternatives. With sign=true the verdict is returned as a signed proof that anyone can check later with verify_proof. The verdict is a reasoned second opinion, not a guarantee of outcome. Docs: https://api.babyblueviper.com/docs
| Name | Required | Description | Default |
|---|---|---|---|
| sign | No | Return the verdict as a portable signed proof (binds verdict, artifact hash and invinoveritas's public key, plus a content-addressed decision_ref). Anyone can check it later with verify_proof. | |
| context | No | What you are trying to accomplish, why now, success criteria | |
| artifact | Yes | The artifact to review: unified diff / patch, shell command, plan, config, analysis, agent output, or raw text | |
| concerns | No | Specific things to check (e.g. 'production safety', 'edge cases in trading logic', 'regulatory risk') | |
| artifact_type | No | Type of artifact. 'code_diff' or 'patch' triggers deep code review. 'plan' for architecture/strategy. 'trade' triggers the capital-scale-aware risk-manager review of a proposed entry/exit. 'onchain_action' triggers the on-chain risk review of a proposed transfer/swap/approval/contract call (e.g. a Base MCP action) BEFORE you sign it — catches scam/honeypot tokens, unlimited-allowance drainers, address poisoning, slippage/MEV. 'sanctions_screening' for a compliance/AML result BEFORE acting on it — checks a categorical verdict (e.g. CLEAN) carries its own scope, not an unscoped claim. Tailors focus and suggestions. IMPORTANT for trade/onchain_action/sanctions_screening: a REJECT can happen purely from low confidence on an action you can't undo, even if content-wise the review leaned approve — see the response's reversibility_gate field. When present, epistemic_basis tells you WHY it's a reject: 'evidence_against' means a deterministic engine found a real positive finding (a known-bad address, an on-chain/sanctions hit); 'insufficient_evidence' means no finding either way, just confidence below the reversibility floor — different situations, do not treat them identically if your own logic branches on the reason. | general |
| verdict_relay | No | Optional (verdict-relay/v2): also return a BIP-340 signature an ERC-8414 InvinoveritasVerdictAuthoritySigned contract verifies on-chain (garyyang-finchip/task-token-standard#2). {chain_id, authority, task_contract, token_id, submission_id, task_version, result_hash, task_document}. Requires sign=true. result_hash must be sha256 of the exact artifact; task_document is the plaintext task document (sha256 = the kernel's tdHash) and is put into the review context. approved/decision_ref come from our own verdict (approve->true, reject->false; concerns/defer unsigned). Checked before any charge. Result field verdict_relay. | |
| action_binding | No | Optional: the exact real-world action this verdict authorizes — tool identity, materialized (not templated) arguments, and the id of the agent that will execute it, e.g. {'tool': 'place_order', 'agent_id': 'your-stable-agent-id', 'args': {...}}. v14+: `tool` and `args` are bound as SEPARATE preimage fields (action_binding_tool_hash = sha256(tool), action_binding_args_hash = sha256(RFC-8785-JCS(args))) so a verifier can assert 'same tool, different arguments' as a checkable statement; `agent_id` is bound as a plain string (action_binding_agent_id, not hashed). All bound DIRECTLY into decision_ref — so the verdict commits to the exact action, not just the free-text `artifact` argument or the verdict conclusion. Recomputing decision_ref without byte-identical tool/args/agent_id values produces a different hash: an approval cannot be replayed against a different tool, different materialized arguments, or a different agent. Every sub-key is optional. Max ~8KB JSON-encoded. NOT independently verified by us — we hash exactly what you send. HONEST LIMIT: nothing stops a caller from submitting an under-specified action_binding (e.g. tool+side but not size) and getting an approval reusable across the omitted dimension — that's about who controls what goes into the fingerprint, not how it's hashed. | |
| related_claims | No | Optional (policy v20): a structured claim about related_proof_event -- a non-empty subset of {artifact_hash, verdict, verified_at, policy_version, decision_ref}. Compared by exact equality against the referenced proof (which we re-verify); the claims hash, comparison version and result (matched|mismatched|missing_proof|unverifiable_proof; not_supplied if omitted) are bound into decision_ref. Faithful restatement only: not relevance, authorization or truth. | |
| disclosed_summary | No | Only used when confidentiality_tier='partial_disclosure'. A real, human-readable description of the reviewed artifact/decision you're choosing to make public — bound raw into decision_ref. Ignored for other tier values. | |
| external_evidence | No | Optional (v17, 2026-09-10): third-party evidence this judgment relied on — e.g. a tool-reliability registry's own historical PASS/FAIL record, worked out live with arian-gogani/nobulex-registry#1. Array of {'source': str, 'record': str (the issuer's OWN exact saved bytes, verbatim — never re-parsed/re-emitted as JSON on our side), 'record_sha256': str (issuer-computed, not independently verified by us), 'evidence_type': str, 'observed_at': ISO 8601, 'validity_until': ISO 8601 | null}. All entries hashed together (RFC-8785-JCS) into external_evidence_hash, bound into decision_ref — so 'this exact evidence was what the verdict considered' is checkable, not just claimed in reasoning text. Does NOT authenticate the issuer, verify record_sha256, or establish freshness — that's the caller's own responsibility before relying on the cited evidence. | |
| intended_audience | No | Optional: declare who/what this verdict is intended for (your own DID, endpoint URL, or gateway identifier). Bound into decision_ref so it can't be silently stripped or altered once issued. NOT independently verified — a reader compares this against their own identity and treats a mismatch as a signal the proof may be presented outside its intended context, a real context-binding replay-protection gap that earlier policy versions had no way to represent at all. | |
| intended_verifier | No | Optional: a CAIP-10 string naming the specific on-chain verifier/gate this verdict is meant to be checked against, e.g. 'eip155:8453:0x8004A169FB4a3325136EB29fA0ceB6D2e539a432'. Bound into decision_ref (itself inside the schnorr-signed content) so it achieves real crypto-level domain separation — the raw signed bytes otherwise bind only to our pubkey + content, nothing to a specific chain/contract, so a proof is technically replayable against any gate willing to accept it. NOT independently verified — a gate compares this against its own chain_id/address. | |
| severity_threshold | No | Minimum severity to report | all |
| related_proof_event | No | Optional: if the artifact being reviewed IS another party's already-signed verdict proof (a verdict-of-verdict re-review), pass that proof's full signed event ({id, pubkey, created_at, kind, tags, content, sig}). We independently re-verify it ourselves before its source_class can affect this call's own — capped, never upgraded (an independent_mediator call reviewing an agent_reported inner verdict stays agent_reported). Fails closed to agent_reported if the inner event doesn't verify, regardless of your own registry status. One hop only. HONEST SCOPE: we verify the cited event's own authenticity, not that it's actually the thing your artifact claims to be re-reviewing. | |
| request_capture_ref | No | Optional: a requester-controlled commitment (a hash/id you generated and can independently prove existed at request-time) that this artifact was submitted for review — the captured-admission-v0 review profile (trustless-ai/recompute-kit). Echoed back verbatim in the response's admission_receipt. NOT independently verified by us; closes the /ledger raw-tape-vs-published gap only for requesters who opt in. | |
| confidentiality_tier | No | Which privacy/evidentiary tradeoff this verdict should use, only meaningful with sign=true. 'hash_only' (default): the proof carries only artifact_hash, raw content never disclosed — strongest privacy, weakest standalone evidentiary value (a third party can't confirm what the hash corresponds to without your later cooperation). 'partial_disclosure': pass disclosed_summary, bound raw into decision_ref, so a third party gets real checkable context without full exposure. 'full_disclosure': records intent to publish this verdict to the public /ledger (full_disclosure_requested=true in the proof) — strongest evidentiary tier, but actual publication is still a separate curated step on our side, not yet fully self-serve. | hash_only |
| mediator_attestation | No | Optional (v22): your mediator proves control of its own key. {key_url (https, mediator's own domain), public_key_ed25519_b64, requested_at (unix s, +-600 s), nonce (8-128 ASCII), signature_ed25519_b64} -- Ed25519 over the RFC 8785 JCS bytes of {schema:'invinoveritas.mediator_request.v1', artifact_hash (sha256 hex of the exact artifact), artifact_type, requested_at, nonce}; key_url must list the key. Requires sign=true; checked before any charge; bound into the proof as mediator_attestation_hash. Establishes key control at issue time, NOT independence. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare the safe-read profile (readOnlyHint=true, destructiveHint=false). The description adds substantial context beyond that: the verdict vocabulary (approve/approve_with_concerns/reject) with confidence score and severity-ranked issues, the meaning of sign=true and the signed-proof guarantee, the reversibility_gate / epistemic_basis response semantics, and the explicit caveat that the verdict is a reasoned second opinion, not a guarantee.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the core purpose in the first clause, then layers return shape, signing behavior, and caveats. Every sentence contributes (return contract, proof linkage, disclaimers). Slightly dense but appropriate for a tool with this much behavioral surface.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 17-parameter tool with nested objects and no output schema, the description supplies the missing response vocabulary (approve/reject/confidence/severity/fixes) and the sign→verify_proof relationship, plus honest limits. It gives an agent enough to call it and interpret the result correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema carries the per-parameter burden (baseline 3). The description modestly adds value by tying sign=true to verify_proof and illustrating usage. Since structured fields already document all 17 params thoroughly, the description does not need to compensate further, and it introduces no conflicting semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Independent verdict on a proposed action before it is taken') and enumerates exactly what can be reviewed — diff, shell command, deployment plan, config change, agent output, transaction. This clearly distinguishes it from siblings like verify_proof (used after the fact) and ledger/witness.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear timing context ('before it is taken') and routes to the alternative for the after-the-fact case ('check later with verify_proof'). It also encodes per-artifact_type usage conditions (e.g. onchain_action 'BEFORE you sign it'). No explicit when-not-to-use exclusions, but the routing guidance is strong.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
validateARead-onlyInspect
Statistical reality-check of a backtest from its realized returns (or trade rows), not the strategy itself. Returns likely_real / borderline / overfit_or_noise using the Deflated Sharpe Ratio (adjusted for the number of variants tried), a sign-flip permutation test, and out-of-sample decay across purged folds. Inputs are not retained beyond a redacted audit hash. Docs: https://api.babyblueviper.com/docs
| Name | Required | Description | Default |
|---|---|---|---|
| trades | No | Alternative to 'returns': rows with a return field (ret/pnl/net_bps) and optional 'coin'/'ts'/'entry'/'exit' fields. | |
| k_folds | No | ||
| n_perms | No | ||
| returns | No | Per-trade (or per-period) realized returns. | |
| agent_id | No | Optional caller agent ID | |
| n_trials | No | How many strategy variants/params you tried before selecting this one. Be honest — more trials = bigger Deflated-Sharpe haircut. | |
| trial_sharpes | No | Optional: Sharpes of all variants tried → exact DSR variance. | |
| periods_per_year | No | Optional, for annualized-Sharpe display only. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark the tool as read-only and non-destructive; the description adds meaningful behavioral context by detailing the statistical methods (Deflated Sharpe Ratio, permutation test, purged-fold decay) and stating that inputs are not retained beyond a redacted audit hash. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded: purpose first, then method, then data-retention behavior, then docs link. Every sentence contributes information without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex statistical tool with no output schema, the description explains the main return classification and the methodology, and the schema covers parameter details. It could be more explicit about the full response shape, but an agent has enough to select and invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 75% schema coverage, the schema covers most parameters, and the description adds semantic context for several: 'realized returns (or trade rows)' clarifies returns/trades, 'number of variants tried' explains n_trials, and 'purged folds' and 'sign-flip permutation test' give meaning to k_folds and n_perms.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific purpose: statistically reality-checking a backtest from realized returns or trade rows, and it names the output categories (likely_real / borderline / overfit_or_noise). It does not explicitly distinguish this from sibling tools like review or verify_proof, though 'not the strategy itself' narrows the scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when to use the tool: when you have realized returns or trade rows from a backtest and want an overfitting reality-check. It includes an exclusion ('not the strategy itself') but does not name alternative tools or provide explicit when-not-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verify_proofARead-onlyIdempotentInspect
Checks a signed invinoveritas proof without trusting whoever handed it over: recomputes the event id, checks the Schnorr signature, and confirms the signing key is invinoveritas's published key. Optionally pass expect_artifact_hash (sha256 of the content you received) to confirm the proof covers that exact content. Accepts the full event, or an event_id to look up. Returns {valid, checks, proof_payload}. Free, no sign-in. Docs: https://api.babyblueviper.com/verify
| Name | Required | Description | Default |
|---|---|---|---|
| event | No | The signed proof event {id,pubkey,created_at,kind,tags,content,sig} the counterparty handed you (from a /prove or /review sign=true response). | |
| event_id | No | Alternatively, the Nostr event id alone (from a /review sign=true, /prove, or /witness proof) — fetches the durably-stored full event, independent of relay retention, and verifies it. | |
| proof_id | No | Alternatively, a stored attestation proof_id to fetch + verify. | |
| verifier_signature | No | Optional (added 2026-08-16) — an EIP-191 personal_sign signature over 'invinoveritas-verify-proof:<event_id>', signed by the key controlling the address in expect_intended_verifier (eip155 CAIP-10 namespace only). Cryptographically PROVES presenter identity rather than just asserting it — sets checks.intended_verifier_authenticated. | |
| expect_artifact_hash | No | Optional sha256 hex of the output you received — asserts the proof is ABOUT that exact artifact. | |
| expect_intended_verifier | No | Optional (added 2026-08-16) — asserts the proof's declared intended_verifier matches you, the consumption-identity check alongside expect_artifact_hash's content-identity check. A match confirms the issuer's declared intent, not that delivery was actually restricted to you. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish read-only, idempotent, and non-destructive behavior, so the description only needs to add context beyond that. It adds useful behavioral detail: verification is done without trusting the presenter, the tool fetches durably-stored events when given an id, and it is free with no sign-in. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact yet information-dense, starting with the core verification behavior, then optional parameters, accepted inputs, return shape, and access requirements. Every sentence earns its place and the docs link is a useful fallback without padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only verification tool with a rich input schema, the description covers the purpose, inputs, return shape, and cost. It does not detail the structure of the checks field or error behavior, but the return shape {valid, checks, proof_payload} plus the docs link provides adequate grounding without an output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all six parameters thoroughly. The description adds a small amount of semantic context by explaining that expect_artifact_hash confirms the proof covers the received content and by summarizing the two main input modes, but it does not significantly go beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource — 'Checks a signed invinoveritas proof' — and then enumerates the exact verification steps: recomputing the event id, checking the Schnorr signature, and confirming the signing key. This clearly distinguishes verify_proof from siblings like witness or validate by describing what makes this tool unique.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides clear input alternatives ('Accepts the full event, or an event_id to look up') and explains when to use the optional expect_artifact_hash parameter to confirm content coverage. It does not explicitly name sibling tools or state when not to use it, but the usage context is strongly implied by the precise verification description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
witnessAInspect
Timestamps and signs a third party's exact claim, unmodified and unjudged: 'we received this text, attributed to source X, at time T', not 'we agree with it'. The source is recorded as self-declared. The resulting proof checks with verify_proof. Docs: https://api.babyblueviper.com/docs
| Name | Required | Description | Default |
|---|---|---|---|
| body | Yes | The exact claim to anchor, byte-for-byte (max 16000 chars) | |
| source | Yes | Who this claim is attributed to (self-declared, NOT verified by us) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only provide negative hints (not read-only, not idempotent, not destructive). The description adds key behavioral details: the tool creates a signed timestamp, leaves the claim unmodified and unjudged, and records the source as self-declared. It stops short of specifying persistence or rate limits, but covers the core behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded, using a concrete example to explain the non-judgment nuance. Every sentence serves a purpose – core action, source caveat, verification route, and docs link – with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter tool with no output schema, the description covers the purpose, input semantics, and how to verify the result. It does not describe the proof's return format or mention authentication/rate limits, but those are not essential for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Both parameters already have detailed schema descriptions (byte-for-byte, max 16000 chars; self-declared, not verified). The tool description reinforces these points but adds little new parameter-level meaning, so it does not elevate the baseline 3 for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action – timestamps and signs a third party's exact claim – and clarifies it does not express agreement. It also names verify_proof as the mechanism to check the resulting proof, distinguishing it from sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The tool description implies its use case: witnessing a third-party claim without endorsing it, and points to verify_proof for subsequent verification. However, it does not explicitly contrast with alternatives like ledger_submit or enumerate when not to use the tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
1 tool update
- Changed
review1 field changed- added
Input schema / properties / verdict_relayAdded value: +{ + "description": "Optional (verdict-relay/v2): also return a BIP-340 signature an ERC-8414 InvinoveritasVerdictAuthoritySigned contract verifies on-chain (garyyang-finchip/task-token-standard#2). {chain_id, authority, task_contract, token_id, submission_id, task_version, result_hash, task_document}. Requires sign=true. result_hash must be sha256 of the exact artifact; task_document is the plaintext task document (sha256 = the kernel's tdHash) and is put into the review context. approved/decision_ref come from our own verdict (approve->true, reject->false; concerns/defer unsigned). Checked before any charge. Result field verdict_relay.", + "type": "object" +}
24 tool updates
- Removed
agent_economy_brief - Removed
browse - Removed
decision - Removed
execute - Removed
feedback_list - Removed
feedback_submit - Removed
feedback_vote - Removed
marketplace_buy - Removed
markets_act - Removed
memory_delete - Removed
memory_get - Removed
memory_list - Removed
memory_search - Removed
memory_store - Removed
message_post - Removed
prove - Removed
reason - Removed
residence_me - Changed
review2 fields changed- changed
Input schema / examplesPrevious value: -[ - { - "artifact": "systemctl restart my-trading-bot.service && curl -X POST https://api.exchange.com/v3/order -d '{\"side\":\"buy\",\"qty\":100000}'", - "artifact_type": "shell_command", - "concerns": "Is the order-of-operations safe? What can go wrong between restart and the order?", - "context": "About to deploy a tuned config and immediately open a 100k-sat position on the exchange", - "severity_threshold": "high" - } -]New value: +[ + { + "artifact": "rm -rf ./build && git push --force origin main", + "artifact_type": "shell_command", + "context": "About to force-push a rebuilt main branch that other people pull from.", + "sign": true + } +] - changed
Input schema / properties / sign / descriptionPrevious value: -"Return a PORTABLE SIGNED proof of this verdict (binds verdict + artifact hash + our pubkey), including a content-addressed decision_ref = sha256(JCS({artifact_hash, artifact_type, policy_version, verdict, source_class})). Attach it to your output so a downstream agent can confirm via verify_proof — WITHOUT trusting you or us — that invinoveritas issued this verdict for this exact artifact. The agent-to-agent trust handshake. For artifact_type=trade|onchain_action|sanctions_screening, the proof also carries source_class ('agent_reported' today — no mediation-point integration exists yet) and, when applicable, a vantage_limitation field disclosing that the verdict is occurrence evidence, not an absence/completeness claim — check it before treating an irreversible-class verdict as sufficient on its own. The proof also carries an opaque engine_generation counter (informational, not bound into decision_ref) — compare it across two proofs to detect a backend/judgment-engine change between calls without us disclosing which model we run."New value: +"Return the verdict as a portable signed proof (binds verdict, artifact hash and invinoveritas's public key, plus a content-addressed decision_ref). Anyone can check it later with verify_proof."
- Removed
seller_intel - Removed
signals - Removed
workspace_delete - Removed
workspace_list - Removed
workspace_status
1 tool update
- Changed
review1 field changed- removed
Input schema / properties / include_trading_stateRemoved value: -{ - "default": false, - "description": "Sentinel mode: inject live Sovereign Earner state (equity, regime, open position, PnL) for trading-related reviews. Highly recommended for any trading or risk decision.", - "type": "boolean" -}
1 tool update
- Changed
review1 field changed- added
Input schema / properties / mediator_attestationAdded value: +{ + "description": "Optional (v22): your mediator proves control of its own key. {key_url (https, mediator's own domain), public_key_ed25519_b64, requested_at (unix s, +-600 s), nonce (8-128 ASCII), signature_ed25519_b64} -- Ed25519 over the RFC 8785 JCS bytes of {schema:'invinoveritas.mediator_request.v1', artifact_hash (sha256 hex of the exact artifact), artifact_type, requested_at, nonce}; key_url must list the key. Requires sign=true; checked before any charge; bound into the proof as mediator_attestation_hash. Establishes key control at issue time, NOT independence.", + "type": "object" +}
1 tool update
- Changed
review1 field changed- added
Input schema / properties / related_claimsAdded value: +{ + "description": "Optional (policy v20): a structured claim about related_proof_event -- a non-empty subset of {artifact_hash, verdict, verified_at, policy_version, decision_ref}. Compared by exact equality against the referenced proof (which we re-verify); the claims hash, comparison version and result (matched|mismatched|missing_proof|unverifiable_proof; not_supplied if omitted) are bound into decision_ref. Faithful restatement only: not relevance, authorization or truth.", + "type": "object" +}
1 tool update
- Changed
review1 field changed- added
Input schema / properties / external_evidenceAdded value: +{ + "description": "Optional (v17, 2026-09-10): third-party evidence this judgment relied on — e.g. a tool-reliability registry's own historical PASS/FAIL record, worked out live with arian-gogani/nobulex-registry#1. Array of {'source': str, 'record': str (the issuer's OWN exact saved bytes, verbatim — never re-parsed/re-emitted as JSON on our side), 'record_sha256': str (issuer-computed, not independently verified by us), 'evidence_type': str, 'observed_at': ISO 8601, 'validity_until': ISO 8601 | null}. All entries hashed together (RFC-8785-JCS) into external_evidence_hash, bound into decision_ref — so 'this exact evidence was what the verdict considered' is checkable, not just claimed in reasoning text. Does NOT authenticate the issuer, verify record_sha256, or establish freshness — that's the caller's own responsibility before relying on the cited evidence.", + "type": "array" +}
2 tool updates
- Removed
bounty_get - Removed
bounty_submit
1 tool update
- Changed
review1 field changed- changed
Input schema / properties / artifact_type / descriptionPrevious value: -"Type of artifact. 'code_diff' or 'patch' triggers deep code review. 'plan' for architecture/strategy. 'trade' triggers the capital-scale-aware risk-manager review of a proposed entry/exit. 'onchain_action' triggers the on-chain risk review of a proposed transfer/swap/approval/contract call (e.g. a Base MCP action) BEFORE you sign it — catches scam/honeypot tokens, unlimited-allowance drainers, address poisoning, slippage/MEV. 'sanctions_screening' for a compliance/AML result BEFORE acting on it — checks a categorical verdict (e.g. CLEAN) carries its own scope, not an unscoped claim. Tailors focus and suggestions. IMPORTANT for trade/onchain_action/sanctions_screening: a REJECT can happen purely from low confidence on an action you can't undo, even if content-wise the review leaned approve — see the response's reversibility_gate field."New value: +"Type of artifact. 'code_diff' or 'patch' triggers deep code review. 'plan' for architecture/strategy. 'trade' triggers the capital-scale-aware risk-manager review of a proposed entry/exit. 'onchain_action' triggers the on-chain risk review of a proposed transfer/swap/approval/contract call (e.g. a Base MCP action) BEFORE you sign it — catches scam/honeypot tokens, unlimited-allowance drainers, address poisoning, slippage/MEV. 'sanctions_screening' for a compliance/AML result BEFORE acting on it — checks a categorical verdict (e.g. CLEAN) carries its own scope, not an unscoped claim. Tailors focus and suggestions. IMPORTANT for trade/onchain_action/sanctions_screening: a REJECT can happen purely from low confidence on an action you can't undo, even if content-wise the review leaned approve — see the response's reversibility_gate field. When present, epistemic_basis tells you WHY it's a reject: 'evidence_against' means a deterministic engine found a real positive finding (a known-bad address, an on-chain/sanctions hit); 'insufficient_evidence' means no finding either way, just confidence below the reversibility floor — different situations, do not treat them identically if your own logic branches on the reason."
1 tool update
- Changed
review1 field changed- added
Input schema / properties / action_bindingAdded value: +{ + "description": "Optional: the exact real-world action this verdict authorizes — tool identity, materialized (not templated) arguments, and the id of the agent that will execute it, e.g. {'tool': 'place_order', 'agent_id': 'your-stable-agent-id', 'args': {...}}. v14+: `tool` and `args` are bound as SEPARATE preimage fields (action_binding_tool_hash = sha256(tool), action_binding_args_hash = sha256(RFC-8785-JCS(args))) so a verifier can assert 'same tool, different arguments' as a checkable statement; `agent_id` is bound as a plain string (action_binding_agent_id, not hashed). All bound DIRECTLY into decision_ref — so the verdict commits to the exact action, not just the free-text `artifact` argument or the verdict conclusion. Recomputing decision_ref without byte-identical tool/args/agent_id values produces a different hash: an approval cannot be replayed against a different tool, different materialized arguments, or a different agent. Every sub-key is optional. Max ~8KB JSON-encoded. NOT independently verified by us — we hash exactly what you send. HONEST LIMIT: nothing stops a caller from submitting an under-specified action_binding (e.g. tool+side but not size) and getting an approval reusable across the omitted dimension — that's about who controls what goes into the fingerprint, not how it's hashed.", + "type": "object" +}
1 tool update
- Added
validate
1 tool update
- Changed
verify_proof2 fields changed- added
Input schema / properties / expect_intended_verifierAdded value: +{ + "description": "Optional (added 2026-08-16) — asserts the proof's declared intended_verifier matches you, the consumption-identity check alongside expect_artifact_hash's content-identity check. A match confirms the issuer's declared intent, not that delivery was actually restricted to you.", + "type": "string" +} - added
Input schema / properties / verifier_signatureAdded value: +{ + "description": "Optional (added 2026-08-16) — an EIP-191 personal_sign signature over 'invinoveritas-verify-proof:<event_id>', signed by the key controlling the address in expect_intended_verifier (eip155 CAIP-10 namespace only). Cryptographically PROVES presenter identity rather than just asserting it — sets checks.intended_verifier_authenticated.", + "type": "string" +}
1 tool update
- Changed
review1 field changed- added
Input schema / properties / request_capture_refAdded value: +{ + "description": "Optional: a requester-controlled commitment (a hash/id you generated and can independently prove existed at request-time) that this artifact was submitted for review — the captured-admission-v0 review profile (trustless-ai/recompute-kit). Echoed back verbatim in the response's admission_receipt. NOT independently verified by us; closes the /ledger raw-tape-vs-published gap only for requesters who opt in.", + "type": "string" +}
1 tool update
- Changed
review1 field changed- added
Input schema / properties / intended_verifierAdded value: +{ + "description": "Optional: a CAIP-10 string naming the specific on-chain verifier/gate this verdict is meant to be checked against, e.g. 'eip155:8453:0x8004A169FB4a3325136EB29fA0ceB6D2e539a432'. Bound into decision_ref (itself inside the schnorr-signed content) so it achieves real crypto-level domain separation — the raw signed bytes otherwise bind only to our pubkey + content, nothing to a specific chain/contract, so a proof is technically replayable against any gate willing to accept it. NOT independently verified — a gate compares this against its own chain_id/address.", + "type": "string" +}
1 tool update
- Changed
review2 fields changed- added
Input schema / properties / confidentiality_tierAdded value: +{ + "default": "hash_only", + "description": "Which privacy/evidentiary tradeoff this verdict should use, only meaningful with sign=true. 'hash_only' (default): the proof carries only artifact_hash, raw content never disclosed — strongest privacy, weakest standalone evidentiary value (a third party can't confirm what the hash corresponds to without your later cooperation). 'partial_disclosure': pass disclosed_summary, bound raw into decision_ref, so a third party gets real checkable context without full exposure. 'full_disclosure': records intent to publish this verdict to the public /ledger (full_disclosure_requested=true in the proof) — strongest evidentiary tier, but actual publication is still a separate curated step on our side, not yet fully self-serve.", + "enum": [ + "hash_only", + "partial_disclosure", + "full_disclosure" + ], + "type": "string" +} - added
Input schema / properties / disclosed_summaryAdded value: +{ + "description": "Only used when confidentiality_tier='partial_disclosure'. A real, human-readable description of the reviewed artifact/decision you're choosing to make public — bound raw into decision_ref. Ignored for other tier values.", + "type": "string" +}
1 tool update
- Changed
review1 field changed- added
Input schema / properties / intended_audienceAdded value: +{ + "description": "Optional: declare who/what this verdict is intended for (your own DID, endpoint URL, or gateway identifier). Bound into decision_ref so it can't be silently stripped or altered once issued. NOT independently verified — a reader compares this against their own identity and treats a mismatch as a signal the proof may be presented outside its intended context, a real context-binding replay-protection gap that earlier policy versions had no way to represent at all.", + "type": "string" +}
1 tool update
- Changed
review1 field changed- added
Input schema / properties / related_proof_eventAdded value: +{ + "description": "Optional: if the artifact being reviewed IS another party's already-signed verdict proof (a verdict-of-verdict re-review), pass that proof's full signed event ({id, pubkey, created_at, kind, tags, content, sig}). We independently re-verify it ourselves before its source_class can affect this call's own — capped, never upgraded (an independent_mediator call reviewing an agent_reported inner verdict stays agent_reported). Fails closed to agent_reported if the inner event doesn't verify, regardless of your own registry status. One hop only. HONEST SCOPE: we verify the cited event's own authenticity, not that it's actually the thing your artifact claims to be re-reviewing.", + "type": "object" +}
1 tool update
- Changed
review1 field changed- changed
Input schema / properties / sign / descriptionPrevious value: -"Return a PORTABLE SIGNED proof of this verdict (binds verdict + artifact hash + our pubkey), including a content-addressed decision_ref = sha256(JCS({artifact_hash, artifact_type, policy_version, verdict, source_class})). Attach it to your output so a downstream agent can confirm via verify_proof — WITHOUT trusting you or us — that invinoveritas issued this verdict for this exact artifact. The agent-to-agent trust handshake. For artifact_type=trade|onchain_action|sanctions_screening, the proof also carries source_class ('agent_reported' today — no mediation-point integration exists yet) and, when applicable, a vantage_limitation field disclosing that the verdict is occurrence evidence, not an absence/completeness claim — check it before treating an irreversible-class verdict as sufficient on its own."New value: +"Return a PORTABLE SIGNED proof of this verdict (binds verdict + artifact hash + our pubkey), including a content-addressed decision_ref = sha256(JCS({artifact_hash, artifact_type, policy_version, verdict, source_class})). Attach it to your output so a downstream agent can confirm via verify_proof — WITHOUT trusting you or us — that invinoveritas issued this verdict for this exact artifact. The agent-to-agent trust handshake. For artifact_type=trade|onchain_action|sanctions_screening, the proof also carries source_class ('agent_reported' today — no mediation-point integration exists yet) and, when applicable, a vantage_limitation field disclosing that the verdict is occurrence evidence, not an absence/completeness claim — check it before treating an irreversible-class verdict as sufficient on its own. The proof also carries an opaque engine_generation counter (informational, not bound into decision_ref) — compare it across two proofs to detect a backend/judgment-engine change between calls without us disclosing which model we run."
Related MCP Connectors
Independent effect verification and signed receipts for consequential AI agent actions.
Human-in-the-loop approval for agent actions, with verifiable action-bound receipts.
Signed agent execution declarations. Free verification; issuance 0.002 USDC via x402 on Base.
Expert review for AI agents. On-chain proof of human review.
Related MCP Servers
- FlicenseNot gradedqualityCmaintenanceProvides AI agents with independent, advisory reviews before irreversible actions, returning recomputable, Bitcoin-anchored signed proofs that anyone can verify for free via a public verdict ledger.-
- AlicenseNot gradedqualityBmaintenanceEnables deterministic verification of AI agent decisions and actions, providing PASS/FAIL/ABSTAIN verdicts with replayable proofs and an optional signed receipt ledger.33 npmApache 2.0
- AlicenseNot gradedqualityDmaintenanceProvides cryptographic governance receipts for AI agents, enabling pre-execution evaluation and signed verdicts (EXECUTE/BLOCK/REVIEW/SHADOW) with offline-verifiable audit trails.MIT

evermint-mcpofficial
AlicenseNot gradedqualityDmaintenanceTamper-evident receipts for AI agent actions. The notary layer for agent-to-agent transactions.35 npm1MIT
Glama MCP Gateway
Add one secure layer between your agents and this server.