Skip to main content
Glama

Server Details

Second opinion before an irreversible agent action; signed proofs, free verify, public ledger.

If you are the author of this connector, you can claim ownership by verifying the domain or GitHub account it belongs to. Claimed connector authors can inspect health checks, view analytics, and manage their listing.
Status
Healthy
Uptime
99.5% over 49 days
Last Tested
Transport
Streamable HTTP · MCP 2025-06-18
URL
Repository
babyblueviper1/invinoveritas
GitHub Stars
6
Server Listing
invinoveritas

TDQS

A4.1/5.0

Scored across 8 tools

Disambiguation4/5

Tools mostly target clearly distinct operations: audit, review, validate, witness, verify, ledger read/write, and conformance certification. Slight overlap exists where conformance_certify and ledger_submit both publish to the ledger, and review/validate both produce verdicts, but their descriptions clearly delimit the object and scope.

Naming Consistency3/5

All names use snake_case consistently, but the verb/noun ordering is mixed: verb-first (audit_agent_readiness, verify_proof), noun-first (ledger, ledger_submit, conformance_certify), and bare verbs (review, validate, witness). This is readable but lacks a predictable pattern.

Tool Count5/5

Eight tools sit comfortably in the effective range and each addresses a distinct verification, ledger, or audit capability. There is no obvious redundancy or bloat.

Completeness4/5

The surface covers core workflows: auditing, reviewing, validating, witnessing, signing, verifying proofs, and reading/writing the ledger. Minor gaps remain, such as no direct read/query of the conformance registry beyond certification and no proof search by artifact or issuer beyond event_id lookup.

Available Tools

8 tools
audit_agent_readinessA
Read-only
Inspect

Audits a public agent or API URL for verifiability: discovery files (llms.txt, MCP card, robots, sitemap), handshake endpoints, and whether presented signed proofs validate. Returns a 0-100 score, a grade, ranked fixes, and a signed proof of the audit. Every result re-derives from a public fetch. Docs: https://api.babyblueviper.com/docs

ParametersJSON Schema
NameRequiredDescriptionDefault
urlYesThe agent endpoint/site URL to audit (public http(s) only)

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark this as read-only and non-destructive. The description adds meaningful behavioral context beyond that: it returns a score, grade, ranked fixes, and a signed proof, and it emphasizes that every result re-derives from a fresh public fetch, which affects how an agent should interpret the output.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and front-loaded with the core verb and resource. Each sentence adds value: scope, checked items, return values, verification guarantee, and a docs link. There is no fluff or repetition of the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter, read-only audit tool with no output schema, the description is complete. It explains what will happen, what the result looks like, and the guarantee that results are reproducible from public fetches. No critical missing context is apparent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is only one parameter, url, and its schema description already specifies that it must be a public HTTP(S) agent endpoint/site URL. The tool description does not add new parameter-level information, but with 100% schema description coverage, this is an acceptable baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the tool's action: auditing a public agent or API URL for verifiability. It enumerates specific checked artifacts (llms.txt, MCP card, robots, sitemap, handshake endpoints, signed proofs) and the concrete output (score, grade, ranked fixes, signed proof), which distinguishes it from generic siblings like validate or verify_proof.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description makes the intended context clear: public agent/API URLs only, with all results derived from public fetches. It does not explicitly compare against sibling tools or state when not to use it, but the public-only constraint and audit-specific focus provide sufficient guidance for most cases.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

conformance_certifyA
Idempotent
Inspect

Publishes a verifier's current conformance grade from the public registry (conformance.json) as a permanent, signed ledger entry, labeled 'certified as of this measurement'. It records the registry's existing measurement and cannot change it. Only works for a verifier currently listed as certified. Docs: https://api.babyblueviper.com/conformance

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesThe verifier's exact name as listed on GET /conformance.json (must currently show certified:true).
noteNoOptional short context for the ledger entry.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations, the description discloses that the entry is permanent and signed, that the tool cannot change the registry measurement, and that it only works for currently certified verifiers. This adds meaningful behavioral context beyond the readOnlyHint, idempotentHint, and destructiveHint annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences with no filler. It front-loads the core action, then adds the key limitations and a documentation link. Every sentence contributes useful information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the purpose, the permanent signed nature, the inability to change the measurement, and the certified-only precondition. A small gap is that it does not describe the return value or explicitly contrast with ledger_submit, but the documentation link and annotations fill most remaining context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the schema already documents both parameters, including the exact-name requirement and the certified:true precondition. The description reinforces this by mentioning the registry and certification status, but it does not add substantial parameter-level meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb ('Publishes') and resource ('verifier's current conformance grade from the public registry') and clearly distinguishes this from other ledger operations by stating it cannot change the existing measurement. It also adds the certified-only precondition, making the tool's scope unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly states when the tool applies: only for a verifier currently listed as certified, and it records the registry's existing measurement rather than creating or altering it. It does not explicitly name an alternative such as ledger_submit for new ledger entries, but the constraints are clear enough for an agent to select this tool appropriately.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ledgerA
Read-onlyIdempotent
Inspect

Reads invinoveritas's public track record of signed verdicts, including ones that turned out wrong. Each entry is a signed Nostr event whose id and signature can be recomputed against invinoveritas's published key; entries are append-only and Bitcoin-timestamped, so they can't be edited after the fact. No arguments returns the index; pass entry to read one. Free, no sign-in. Docs: https://api.babyblueviper.com/ledger

ParametersJSON Schema
NameRequiredDescriptionDefault
entryNoOptional entry number (e.g. '1'); omit for the full index.

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint and idempotentHint annotations, the description reveals that entries are signed Nostr events whose integrity can be recomputed, and that they are append-only and Bitcoin-timestamped, implying immutability. It also states the access model, free and no sign-in, which is useful for an agent deciding whether to call. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four sentences, each earning its place: purpose, integrity model, usage, and access/documentation. The most decision-relevant information is front-loaded in the first sentence, and the docs link is a compact pointer rather than bloat.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-optional-parameter read tool with annotations already covering safety and idempotence, the description covers purpose, data model, behavior, access, and documentation. The only omission is a concrete description of the response shape for the index or an entry, but that is partially mitigated by the explicit usage instructions and docs link.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already fully documents the optional entry parameter with an example and the omit-for-index behavior, so the baseline is 3. The description restates this behavior rather than adding new parameter-level semantics. No additional syntax or format details are introduced.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb and resource: 'Reads invinoveritas's public track record of signed verdicts,' which immediately sets it apart from write/verify siblings like ledger_submit and verify_proof. The addition of 'including ones that turned out wrong' narrows the scope and reinforces that this is an audit/read tool. Clear and unambiguous purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides concrete invocation context: no arguments yields the index, passing entry reads a specific record, and access is free with no sign-in. It does not explicitly name alternatives or state when-not-to-use, but the read-only framing makes the appropriate use clear for an agent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ledger_submitAInspect

Publishes one of your own signed review proofs (from review with sign=true) as a public entry on the invinoveritas ledger. Publication is immediate and permanent: the entry is broadcast to Nostr relays and Bitcoin-timestamped. Only genuine invinoveritas-signed proofs are accepted. Docs: https://api.babyblueviper.com/ledger

ParametersJSON Schema
NameRequiredDescriptionDefault
noteNoOptional short context: what this verdict was for, why it's worth featuring.
eventYesThe signed Nostr event from a prior /review(sign=true) call — the exact proof.event object that response returned.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds meaningful behavioral disclosure beyond the annotations: publication is 'immediate and permanent', broadcast to Nostr relays, Bitcoin-timestamped, and restricted to 'genuine invinoveritas-signed proofs'. With readOnlyHint=false, idempotentHint=false, and destructiveHint=false already provided, this description usefully explains the irreversible, external side-effects of the operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: the core action appears in the first sentence, followed by critical permanence constraints and acceptance criteria. Every sentence carries information relevant to calling the tool correctly, and the docs URL is a lightweight addition rather than noise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no output schema, the description covers the important context: source input (signed review proof), destination (ledger/Nostr), permanence, and validity requirements. It does not describe the exact return shape or failure modes, but the docs link and clear input constraints make this adequate for safe invocation of an irreversible publish action.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents both parameters well, including that event must be the exact proof.event object from a prior /review(sign=true) call. The description reinforces this by saying the input must be one of the user's own signed proofs, but it does not add substantial new meaning for either parameter beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb and resource ('Publishes... on the invinoveritas ledger') and scopes the input precisely to 'one of your own signed review proofs (from review with sign=true)'. This clearly distinguishes it from siblings like ledger, review, and verify_proof by specifying exactly which prior output it consumes and what permanent public action it performs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description establishes the correct triggering context: it should be used after a review call with sign=true, and only on the exact proof.event returned there. It does not explicitly name alternatives or exclusions (e.g., 'use ledger to read entries'), but the conditional source is clear enough for most agents to avoid misuse.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

reviewA
Read-only
Inspect

Independent verdict on a proposed action before it is taken: a code diff, shell command, deployment plan, configuration change, another agent's output, or a proposed transaction. Returns approve / approve_with_concerns / reject with a confidence score, issues ranked by severity, suggested fixes and alternatives. With sign=true the verdict is returned as a signed proof that anyone can check later with verify_proof. The verdict is a reasoned second opinion, not a guarantee of outcome. Docs: https://api.babyblueviper.com/docs

ParametersJSON Schema
NameRequiredDescriptionDefault
signNoReturn the verdict as a portable signed proof (binds verdict, artifact hash and invinoveritas's public key, plus a content-addressed decision_ref). Anyone can check it later with verify_proof.
contextNoWhat you are trying to accomplish, why now, success criteria
artifactYesThe artifact to review: unified diff / patch, shell command, plan, config, analysis, agent output, or raw text
concernsNoSpecific things to check (e.g. 'production safety', 'edge cases in trading logic', 'regulatory risk')
artifact_typeNoType of artifact. 'code_diff' or 'patch' triggers deep code review. 'plan' for architecture/strategy. 'trade' triggers the capital-scale-aware risk-manager review of a proposed entry/exit. 'onchain_action' triggers the on-chain risk review of a proposed transfer/swap/approval/contract call (e.g. a Base MCP action) BEFORE you sign it — catches scam/honeypot tokens, unlimited-allowance drainers, address poisoning, slippage/MEV. 'sanctions_screening' for a compliance/AML result BEFORE acting on it — checks a categorical verdict (e.g. CLEAN) carries its own scope, not an unscoped claim. Tailors focus and suggestions. IMPORTANT for trade/onchain_action/sanctions_screening: a REJECT can happen purely from low confidence on an action you can't undo, even if content-wise the review leaned approve — see the response's reversibility_gate field. When present, epistemic_basis tells you WHY it's a reject: 'evidence_against' means a deterministic engine found a real positive finding (a known-bad address, an on-chain/sanctions hit); 'insufficient_evidence' means no finding either way, just confidence below the reversibility floor — different situations, do not treat them identically if your own logic branches on the reason.general
verdict_relayNoOptional (verdict-relay/v2): also return a BIP-340 signature an ERC-8414 InvinoveritasVerdictAuthoritySigned contract verifies on-chain (garyyang-finchip/task-token-standard#2). {chain_id, authority, task_contract, token_id, submission_id, task_version, result_hash, task_document}. Requires sign=true. result_hash must be sha256 of the exact artifact; task_document is the plaintext task document (sha256 = the kernel's tdHash) and is put into the review context. approved/decision_ref come from our own verdict (approve->true, reject->false; concerns/defer unsigned). Checked before any charge. Result field verdict_relay.
action_bindingNoOptional: the exact real-world action this verdict authorizes — tool identity, materialized (not templated) arguments, and the id of the agent that will execute it, e.g. {'tool': 'place_order', 'agent_id': 'your-stable-agent-id', 'args': {...}}. v14+: `tool` and `args` are bound as SEPARATE preimage fields (action_binding_tool_hash = sha256(tool), action_binding_args_hash = sha256(RFC-8785-JCS(args))) so a verifier can assert 'same tool, different arguments' as a checkable statement; `agent_id` is bound as a plain string (action_binding_agent_id, not hashed). All bound DIRECTLY into decision_ref — so the verdict commits to the exact action, not just the free-text `artifact` argument or the verdict conclusion. Recomputing decision_ref without byte-identical tool/args/agent_id values produces a different hash: an approval cannot be replayed against a different tool, different materialized arguments, or a different agent. Every sub-key is optional. Max ~8KB JSON-encoded. NOT independently verified by us — we hash exactly what you send. HONEST LIMIT: nothing stops a caller from submitting an under-specified action_binding (e.g. tool+side but not size) and getting an approval reusable across the omitted dimension — that's about who controls what goes into the fingerprint, not how it's hashed.
related_claimsNoOptional (policy v20): a structured claim about related_proof_event -- a non-empty subset of {artifact_hash, verdict, verified_at, policy_version, decision_ref}. Compared by exact equality against the referenced proof (which we re-verify); the claims hash, comparison version and result (matched|mismatched|missing_proof|unverifiable_proof; not_supplied if omitted) are bound into decision_ref. Faithful restatement only: not relevance, authorization or truth.
disclosed_summaryNoOnly used when confidentiality_tier='partial_disclosure'. A real, human-readable description of the reviewed artifact/decision you're choosing to make public — bound raw into decision_ref. Ignored for other tier values.
external_evidenceNoOptional (v17, 2026-09-10): third-party evidence this judgment relied on — e.g. a tool-reliability registry's own historical PASS/FAIL record, worked out live with arian-gogani/nobulex-registry#1. Array of {'source': str, 'record': str (the issuer's OWN exact saved bytes, verbatim — never re-parsed/re-emitted as JSON on our side), 'record_sha256': str (issuer-computed, not independently verified by us), 'evidence_type': str, 'observed_at': ISO 8601, 'validity_until': ISO 8601 | null}. All entries hashed together (RFC-8785-JCS) into external_evidence_hash, bound into decision_ref — so 'this exact evidence was what the verdict considered' is checkable, not just claimed in reasoning text. Does NOT authenticate the issuer, verify record_sha256, or establish freshness — that's the caller's own responsibility before relying on the cited evidence.
intended_audienceNoOptional: declare who/what this verdict is intended for (your own DID, endpoint URL, or gateway identifier). Bound into decision_ref so it can't be silently stripped or altered once issued. NOT independently verified — a reader compares this against their own identity and treats a mismatch as a signal the proof may be presented outside its intended context, a real context-binding replay-protection gap that earlier policy versions had no way to represent at all.
intended_verifierNoOptional: a CAIP-10 string naming the specific on-chain verifier/gate this verdict is meant to be checked against, e.g. 'eip155:8453:0x8004A169FB4a3325136EB29fA0ceB6D2e539a432'. Bound into decision_ref (itself inside the schnorr-signed content) so it achieves real crypto-level domain separation — the raw signed bytes otherwise bind only to our pubkey + content, nothing to a specific chain/contract, so a proof is technically replayable against any gate willing to accept it. NOT independently verified — a gate compares this against its own chain_id/address.
severity_thresholdNoMinimum severity to reportall
related_proof_eventNoOptional: if the artifact being reviewed IS another party's already-signed verdict proof (a verdict-of-verdict re-review), pass that proof's full signed event ({id, pubkey, created_at, kind, tags, content, sig}). We independently re-verify it ourselves before its source_class can affect this call's own — capped, never upgraded (an independent_mediator call reviewing an agent_reported inner verdict stays agent_reported). Fails closed to agent_reported if the inner event doesn't verify, regardless of your own registry status. One hop only. HONEST SCOPE: we verify the cited event's own authenticity, not that it's actually the thing your artifact claims to be re-reviewing.
request_capture_refNoOptional: a requester-controlled commitment (a hash/id you generated and can independently prove existed at request-time) that this artifact was submitted for review — the captured-admission-v0 review profile (trustless-ai/recompute-kit). Echoed back verbatim in the response's admission_receipt. NOT independently verified by us; closes the /ledger raw-tape-vs-published gap only for requesters who opt in.
confidentiality_tierNoWhich privacy/evidentiary tradeoff this verdict should use, only meaningful with sign=true. 'hash_only' (default): the proof carries only artifact_hash, raw content never disclosed — strongest privacy, weakest standalone evidentiary value (a third party can't confirm what the hash corresponds to without your later cooperation). 'partial_disclosure': pass disclosed_summary, bound raw into decision_ref, so a third party gets real checkable context without full exposure. 'full_disclosure': records intent to publish this verdict to the public /ledger (full_disclosure_requested=true in the proof) — strongest evidentiary tier, but actual publication is still a separate curated step on our side, not yet fully self-serve.hash_only
mediator_attestationNoOptional (v22): your mediator proves control of its own key. {key_url (https, mediator's own domain), public_key_ed25519_b64, requested_at (unix s, +-600 s), nonce (8-128 ASCII), signature_ed25519_b64} -- Ed25519 over the RFC 8785 JCS bytes of {schema:'invinoveritas.mediator_request.v1', artifact_hash (sha256 hex of the exact artifact), artifact_type, requested_at, nonce}; key_url must list the key. Requires sign=true; checked before any charge; bound into the proof as mediator_attestation_hash. Establishes key control at issue time, NOT independence.

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare the safe-read profile (readOnlyHint=true, destructiveHint=false). The description adds substantial context beyond that: the verdict vocabulary (approve/approve_with_concerns/reject) with confidence score and severity-ranked issues, the meaning of sign=true and the signed-proof guarantee, the reversibility_gate / epistemic_basis response semantics, and the explicit caveat that the verdict is a reasoned second opinion, not a guarantee.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the core purpose in the first clause, then layers return shape, signing behavior, and caveats. Every sentence contributes (return contract, proof linkage, disclaimers). Slightly dense but appropriate for a tool with this much behavioral surface.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 17-parameter tool with nested objects and no output schema, the description supplies the missing response vocabulary (approve/reject/confidence/severity/fixes) and the sign→verify_proof relationship, plus honest limits. It gives an agent enough to call it and interpret the result correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema carries the per-parameter burden (baseline 3). The description modestly adds value by tying sign=true to verify_proof and illustrating usage. Since structured fields already document all 17 params thoroughly, the description does not need to compensate further, and it introduces no conflicting semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Independent verdict on a proposed action before it is taken') and enumerates exactly what can be reviewed — diff, shell command, deployment plan, config change, agent output, transaction. This clearly distinguishes it from siblings like verify_proof (used after the fact) and ledger/witness.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear timing context ('before it is taken') and routes to the alternative for the after-the-fact case ('check later with verify_proof'). It also encodes per-artifact_type usage conditions (e.g. onchain_action 'BEFORE you sign it'). No explicit when-not-to-use exclusions, but the routing guidance is strong.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

validateA
Read-only
Inspect

Statistical reality-check of a backtest from its realized returns (or trade rows), not the strategy itself. Returns likely_real / borderline / overfit_or_noise using the Deflated Sharpe Ratio (adjusted for the number of variants tried), a sign-flip permutation test, and out-of-sample decay across purged folds. Inputs are not retained beyond a redacted audit hash. Docs: https://api.babyblueviper.com/docs

ParametersJSON Schema
NameRequiredDescriptionDefault
tradesNoAlternative to 'returns': rows with a return field (ret/pnl/net_bps) and optional 'coin'/'ts'/'entry'/'exit' fields.
k_foldsNo
n_permsNo
returnsNoPer-trade (or per-period) realized returns.
agent_idNoOptional caller agent ID
n_trialsNoHow many strategy variants/params you tried before selecting this one. Be honest — more trials = bigger Deflated-Sharpe haircut.
trial_sharpesNoOptional: Sharpes of all variants tried → exact DSR variance.
periods_per_yearNoOptional, for annualized-Sharpe display only.

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark the tool as read-only and non-destructive; the description adds meaningful behavioral context by detailing the statistical methods (Deflated Sharpe Ratio, permutation test, purged-fold decay) and stating that inputs are not retained beyond a redacted audit hash. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: purpose first, then method, then data-retention behavior, then docs link. Every sentence contributes information without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex statistical tool with no output schema, the description explains the main return classification and the methodology, and the schema covers parameter details. It could be more explicit about the full response shape, but an agent has enough to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 75% schema coverage, the schema covers most parameters, and the description adds semantic context for several: 'realized returns (or trade rows)' clarifies returns/trades, 'number of variants tried' explains n_trials, and 'purged folds' and 'sign-flip permutation test' give meaning to k_folds and n_perms.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific purpose: statistically reality-checking a backtest from realized returns or trade rows, and it names the output categories (likely_real / borderline / overfit_or_noise). It does not explicitly distinguish this from sibling tools like review or verify_proof, though 'not the strategy itself' narrows the scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context for when to use the tool: when you have realized returns or trade rows from a backtest and want an overfitting reality-check. It includes an exclusion ('not the strategy itself') but does not name alternative tools or provide explicit when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

verify_proofA
Read-onlyIdempotent
Inspect

Checks a signed invinoveritas proof without trusting whoever handed it over: recomputes the event id, checks the Schnorr signature, and confirms the signing key is invinoveritas's published key. Optionally pass expect_artifact_hash (sha256 of the content you received) to confirm the proof covers that exact content. Accepts the full event, or an event_id to look up. Returns {valid, checks, proof_payload}. Free, no sign-in. Docs: https://api.babyblueviper.com/verify

ParametersJSON Schema
NameRequiredDescriptionDefault
eventNoThe signed proof event {id,pubkey,created_at,kind,tags,content,sig} the counterparty handed you (from a /prove or /review sign=true response).
event_idNoAlternatively, the Nostr event id alone (from a /review sign=true, /prove, or /witness proof) — fetches the durably-stored full event, independent of relay retention, and verifies it.
proof_idNoAlternatively, a stored attestation proof_id to fetch + verify.
verifier_signatureNoOptional (added 2026-08-16) — an EIP-191 personal_sign signature over 'invinoveritas-verify-proof:<event_id>', signed by the key controlling the address in expect_intended_verifier (eip155 CAIP-10 namespace only). Cryptographically PROVES presenter identity rather than just asserting it — sets checks.intended_verifier_authenticated.
expect_artifact_hashNoOptional sha256 hex of the output you received — asserts the proof is ABOUT that exact artifact.
expect_intended_verifierNoOptional (added 2026-08-16) — asserts the proof's declared intended_verifier matches you, the consumption-identity check alongside expect_artifact_hash's content-identity check. A match confirms the issuer's declared intent, not that delivery was actually restricted to you.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish read-only, idempotent, and non-destructive behavior, so the description only needs to add context beyond that. It adds useful behavioral detail: verification is done without trusting the presenter, the tool fetches durably-stored events when given an id, and it is free with no sign-in. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact yet information-dense, starting with the core verification behavior, then optional parameters, accepted inputs, return shape, and access requirements. Every sentence earns its place and the docs link is a useful fallback without padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only verification tool with a rich input schema, the description covers the purpose, inputs, return shape, and cost. It does not detail the structure of the checks field or error behavior, but the return shape {valid, checks, proof_payload} plus the docs link provides adequate grounding without an output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all six parameters thoroughly. The description adds a small amount of semantic context by explaining that expect_artifact_hash confirms the proof covers the received content and by summarizing the two main input modes, but it does not significantly go beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource — 'Checks a signed invinoveritas proof' — and then enumerates the exact verification steps: recomputing the event id, checking the Schnorr signature, and confirming the signing key. This clearly distinguishes verify_proof from siblings like witness or validate by describing what makes this tool unique.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides clear input alternatives ('Accepts the full event, or an event_id to look up') and explains when to use the optional expect_artifact_hash parameter to confirm content coverage. It does not explicitly name sibling tools or state when not to use it, but the usage context is strongly implied by the precise verification description.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

witnessAInspect

Timestamps and signs a third party's exact claim, unmodified and unjudged: 'we received this text, attributed to source X, at time T', not 'we agree with it'. The source is recorded as self-declared. The resulting proof checks with verify_proof. Docs: https://api.babyblueviper.com/docs

ParametersJSON Schema
NameRequiredDescriptionDefault
bodyYesThe exact claim to anchor, byte-for-byte (max 16000 chars)
sourceYesWho this claim is attributed to (self-declared, NOT verified by us)

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only provide negative hints (not read-only, not idempotent, not destructive). The description adds key behavioral details: the tool creates a signed timestamp, leaves the claim unmodified and unjudged, and records the source as self-declared. It stops short of specifying persistence or rate limits, but covers the core behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded, using a concrete example to explain the non-judgment nuance. Every sentence serves a purpose – core action, source caveat, verification route, and docs link – with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter tool with no output schema, the description covers the purpose, input semantics, and how to verify the result. It does not describe the proof's return format or mention authentication/rate limits, but those are not essential for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Both parameters already have detailed schema descriptions (byte-for-byte, max 16000 chars; self-declared, not verified). The tool description reinforces these points but adds little new parameter-level meaning, so it does not elevate the baseline 3 for high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action – timestamps and signs a third party's exact claim – and clarifies it does not express agreement. It also names verify_proof as the mechanism to check the resulting proof, distinguishing it from sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The tool description implies its use case: witnessing a third-party claim without endorsing it, and points to verify_proof for subsequent verification. However, it does not explicitly contrast with alternatives like ledger_submit or enumerate when not to use the tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 1 tool update
    • Changedreview1 field changed
      • addedInput schema / properties / verdict_relay
        Added value: +{
        +  "description": "Optional (verdict-relay/v2): also return a BIP-340 signature an ERC-8414 InvinoveritasVerdictAuthoritySigned contract verifies on-chain (garyyang-finchip/task-token-standard#2). {chain_id, authority, task_contract, token_id, submission_id, task_version, result_hash, task_document}. Requires sign=true. result_hash must be sha256 of the exact artifact; task_document is the plaintext task document (sha256 = the kernel's tdHash) and is put into the review context. approved/decision_ref come from our own verdict (approve->true, reject->false; concerns/defer unsigned). Checked before any charge. Result field verdict_relay.",
        +  "type": "object"
        +}
  2. 24 tool updates
    • Removedagent_economy_brief
    • Removedbrowse
    • Removeddecision
    • Removedexecute
    • Removedfeedback_list
    • Removedfeedback_submit
    • Removedfeedback_vote
    • Removedmarketplace_buy
    • Removedmarkets_act
    • Removedmemory_delete
    • Removedmemory_get
    • Removedmemory_list
    • Removedmemory_search
    • Removedmemory_store
    • Removedmessage_post
    • Removedprove
    • Removedreason
    • Removedresidence_me
    • Changedreview2 fields changed
      • changedInput schema / examples
        Previous value: -[
        -  {
        -    "artifact": "systemctl restart my-trading-bot.service && curl -X POST https://api.exchange.com/v3/order -d '{\"side\":\"buy\",\"qty\":100000}'",
        -    "artifact_type": "shell_command",
        -    "concerns": "Is the order-of-operations safe? What can go wrong between restart and the order?",
        -    "context": "About to deploy a tuned config and immediately open a 100k-sat position on the exchange",
        -    "severity_threshold": "high"
        -  }
        -]New value: +[
        +  {
        +    "artifact": "rm -rf ./build && git push --force origin main",
        +    "artifact_type": "shell_command",
        +    "context": "About to force-push a rebuilt main branch that other people pull from.",
        +    "sign": true
        +  }
        +]
      • changedInput schema / properties / sign / description
        Previous value: -"Return a PORTABLE SIGNED proof of this verdict (binds verdict + artifact hash + our pubkey), including a content-addressed decision_ref = sha256(JCS({artifact_hash, artifact_type, policy_version, verdict, source_class})). Attach it to your output so a downstream agent can confirm via verify_proof — WITHOUT trusting you or us — that invinoveritas issued this verdict for this exact artifact. The agent-to-agent trust handshake. For artifact_type=trade|onchain_action|sanctions_screening, the proof also carries source_class ('agent_reported' today — no mediation-point integration exists yet) and, when applicable, a vantage_limitation field disclosing that the verdict is occurrence evidence, not an absence/completeness claim — check it before treating an irreversible-class verdict as sufficient on its own. The proof also carries an opaque engine_generation counter (informational, not bound into decision_ref) — compare it across two proofs to detect a backend/judgment-engine change between calls without us disclosing which model we run."New value: +"Return the verdict as a portable signed proof (binds verdict, artifact hash and invinoveritas's public key, plus a content-addressed decision_ref). Anyone can check it later with verify_proof."
    • Removedseller_intel
    • Removedsignals
    • Removedworkspace_delete
    • Removedworkspace_list
    • Removedworkspace_status
  3. 1 tool update
    • Changedreview1 field changed
      • removedInput schema / properties / include_trading_state
        Removed value: -{
        -  "default": false,
        -  "description": "Sentinel mode: inject live Sovereign Earner state (equity, regime, open position, PnL) for trading-related reviews. Highly recommended for any trading or risk decision.",
        -  "type": "boolean"
        -}
  4. 1 tool update
    • Changedreview1 field changed
      • addedInput schema / properties / mediator_attestation
        Added value: +{
        +  "description": "Optional (v22): your mediator proves control of its own key. {key_url (https, mediator's own domain), public_key_ed25519_b64, requested_at (unix s, +-600 s), nonce (8-128 ASCII), signature_ed25519_b64} -- Ed25519 over the RFC 8785 JCS bytes of {schema:'invinoveritas.mediator_request.v1', artifact_hash (sha256 hex of the exact artifact), artifact_type, requested_at, nonce}; key_url must list the key. Requires sign=true; checked before any charge; bound into the proof as mediator_attestation_hash. Establishes key control at issue time, NOT independence.",
        +  "type": "object"
        +}
  5. 1 tool update
    • Changedreview1 field changed
      • addedInput schema / properties / related_claims
        Added value: +{
        +  "description": "Optional (policy v20): a structured claim about related_proof_event -- a non-empty subset of {artifact_hash, verdict, verified_at, policy_version, decision_ref}. Compared by exact equality against the referenced proof (which we re-verify); the claims hash, comparison version and result (matched|mismatched|missing_proof|unverifiable_proof; not_supplied if omitted) are bound into decision_ref. Faithful restatement only: not relevance, authorization or truth.",
        +  "type": "object"
        +}
  6. 1 tool update
    • Changedreview1 field changed
      • addedInput schema / properties / external_evidence
        Added value: +{
        +  "description": "Optional (v17, 2026-09-10): third-party evidence this judgment relied on — e.g. a tool-reliability registry's own historical PASS/FAIL record, worked out live with arian-gogani/nobulex-registry#1. Array of {'source': str, 'record': str (the issuer's OWN exact saved bytes, verbatim — never re-parsed/re-emitted as JSON on our side), 'record_sha256': str (issuer-computed, not independently verified by us), 'evidence_type': str, 'observed_at': ISO 8601, 'validity_until': ISO 8601 | null}. All entries hashed together (RFC-8785-JCS) into external_evidence_hash, bound into decision_ref — so 'this exact evidence was what the verdict considered' is checkable, not just claimed in reasoning text. Does NOT authenticate the issuer, verify record_sha256, or establish freshness — that's the caller's own responsibility before relying on the cited evidence.",
        +  "type": "array"
        +}
  7. 2 tool updates
    • Removedbounty_get
    • Removedbounty_submit
  8. 1 tool update
    • Changedreview1 field changed
      • changedInput schema / properties / artifact_type / description
        Previous value: -"Type of artifact. 'code_diff' or 'patch' triggers deep code review. 'plan' for architecture/strategy. 'trade' triggers the capital-scale-aware risk-manager review of a proposed entry/exit. 'onchain_action' triggers the on-chain risk review of a proposed transfer/swap/approval/contract call (e.g. a Base MCP action) BEFORE you sign it — catches scam/honeypot tokens, unlimited-allowance drainers, address poisoning, slippage/MEV. 'sanctions_screening' for a compliance/AML result BEFORE acting on it — checks a categorical verdict (e.g. CLEAN) carries its own scope, not an unscoped claim. Tailors focus and suggestions. IMPORTANT for trade/onchain_action/sanctions_screening: a REJECT can happen purely from low confidence on an action you can't undo, even if content-wise the review leaned approve — see the response's reversibility_gate field."New value: +"Type of artifact. 'code_diff' or 'patch' triggers deep code review. 'plan' for architecture/strategy. 'trade' triggers the capital-scale-aware risk-manager review of a proposed entry/exit. 'onchain_action' triggers the on-chain risk review of a proposed transfer/swap/approval/contract call (e.g. a Base MCP action) BEFORE you sign it — catches scam/honeypot tokens, unlimited-allowance drainers, address poisoning, slippage/MEV. 'sanctions_screening' for a compliance/AML result BEFORE acting on it — checks a categorical verdict (e.g. CLEAN) carries its own scope, not an unscoped claim. Tailors focus and suggestions. IMPORTANT for trade/onchain_action/sanctions_screening: a REJECT can happen purely from low confidence on an action you can't undo, even if content-wise the review leaned approve — see the response's reversibility_gate field. When present, epistemic_basis tells you WHY it's a reject: 'evidence_against' means a deterministic engine found a real positive finding (a known-bad address, an on-chain/sanctions hit); 'insufficient_evidence' means no finding either way, just confidence below the reversibility floor — different situations, do not treat them identically if your own logic branches on the reason."
  9. 1 tool update
    • Changedreview1 field changed
      • addedInput schema / properties / action_binding
        Added value: +{
        +  "description": "Optional: the exact real-world action this verdict authorizes — tool identity, materialized (not templated) arguments, and the id of the agent that will execute it, e.g. {'tool': 'place_order', 'agent_id': 'your-stable-agent-id', 'args': {...}}. v14+: `tool` and `args` are bound as SEPARATE preimage fields (action_binding_tool_hash = sha256(tool), action_binding_args_hash = sha256(RFC-8785-JCS(args))) so a verifier can assert 'same tool, different arguments' as a checkable statement; `agent_id` is bound as a plain string (action_binding_agent_id, not hashed). All bound DIRECTLY into decision_ref — so the verdict commits to the exact action, not just the free-text `artifact` argument or the verdict conclusion. Recomputing decision_ref without byte-identical tool/args/agent_id values produces a different hash: an approval cannot be replayed against a different tool, different materialized arguments, or a different agent. Every sub-key is optional. Max ~8KB JSON-encoded. NOT independently verified by us — we hash exactly what you send. HONEST LIMIT: nothing stops a caller from submitting an under-specified action_binding (e.g. tool+side but not size) and getting an approval reusable across the omitted dimension — that's about who controls what goes into the fingerprint, not how it's hashed.",
        +  "type": "object"
        +}
  10. 1 tool update
    • Addedvalidate
  11. 1 tool update
    • Changedverify_proof2 fields changed
      • addedInput schema / properties / expect_intended_verifier
        Added value: +{
        +  "description": "Optional (added 2026-08-16) — asserts the proof's declared intended_verifier matches you, the consumption-identity check alongside expect_artifact_hash's content-identity check. A match confirms the issuer's declared intent, not that delivery was actually restricted to you.",
        +  "type": "string"
        +}
      • addedInput schema / properties / verifier_signature
        Added value: +{
        +  "description": "Optional (added 2026-08-16) — an EIP-191 personal_sign signature over 'invinoveritas-verify-proof:<event_id>', signed by the key controlling the address in expect_intended_verifier (eip155 CAIP-10 namespace only). Cryptographically PROVES presenter identity rather than just asserting it — sets checks.intended_verifier_authenticated.",
        +  "type": "string"
        +}
  12. 1 tool update
    • Changedreview1 field changed
      • addedInput schema / properties / request_capture_ref
        Added value: +{
        +  "description": "Optional: a requester-controlled commitment (a hash/id you generated and can independently prove existed at request-time) that this artifact was submitted for review — the captured-admission-v0 review profile (trustless-ai/recompute-kit). Echoed back verbatim in the response's admission_receipt. NOT independently verified by us; closes the /ledger raw-tape-vs-published gap only for requesters who opt in.",
        +  "type": "string"
        +}
  13. 1 tool update
    • Changedreview1 field changed
      • addedInput schema / properties / intended_verifier
        Added value: +{
        +  "description": "Optional: a CAIP-10 string naming the specific on-chain verifier/gate this verdict is meant to be checked against, e.g. 'eip155:8453:0x8004A169FB4a3325136EB29fA0ceB6D2e539a432'. Bound into decision_ref (itself inside the schnorr-signed content) so it achieves real crypto-level domain separation — the raw signed bytes otherwise bind only to our pubkey + content, nothing to a specific chain/contract, so a proof is technically replayable against any gate willing to accept it. NOT independently verified — a gate compares this against its own chain_id/address.",
        +  "type": "string"
        +}
  14. 1 tool update
    • Changedreview2 fields changed
      • addedInput schema / properties / confidentiality_tier
        Added value: +{
        +  "default": "hash_only",
        +  "description": "Which privacy/evidentiary tradeoff this verdict should use, only meaningful with sign=true. 'hash_only' (default): the proof carries only artifact_hash, raw content never disclosed — strongest privacy, weakest standalone evidentiary value (a third party can't confirm what the hash corresponds to without your later cooperation). 'partial_disclosure': pass disclosed_summary, bound raw into decision_ref, so a third party gets real checkable context without full exposure. 'full_disclosure': records intent to publish this verdict to the public /ledger (full_disclosure_requested=true in the proof) — strongest evidentiary tier, but actual publication is still a separate curated step on our side, not yet fully self-serve.",
        +  "enum": [
        +    "hash_only",
        +    "partial_disclosure",
        +    "full_disclosure"
        +  ],
        +  "type": "string"
        +}
      • addedInput schema / properties / disclosed_summary
        Added value: +{
        +  "description": "Only used when confidentiality_tier='partial_disclosure'. A real, human-readable description of the reviewed artifact/decision you're choosing to make public — bound raw into decision_ref. Ignored for other tier values.",
        +  "type": "string"
        +}
  15. 1 tool update
    • Changedreview1 field changed
      • addedInput schema / properties / intended_audience
        Added value: +{
        +  "description": "Optional: declare who/what this verdict is intended for (your own DID, endpoint URL, or gateway identifier). Bound into decision_ref so it can't be silently stripped or altered once issued. NOT independently verified — a reader compares this against their own identity and treats a mismatch as a signal the proof may be presented outside its intended context, a real context-binding replay-protection gap that earlier policy versions had no way to represent at all.",
        +  "type": "string"
        +}
  16. 1 tool update
    • Changedreview1 field changed
      • addedInput schema / properties / related_proof_event
        Added value: +{
        +  "description": "Optional: if the artifact being reviewed IS another party's already-signed verdict proof (a verdict-of-verdict re-review), pass that proof's full signed event ({id, pubkey, created_at, kind, tags, content, sig}). We independently re-verify it ourselves before its source_class can affect this call's own — capped, never upgraded (an independent_mediator call reviewing an agent_reported inner verdict stays agent_reported). Fails closed to agent_reported if the inner event doesn't verify, regardless of your own registry status. One hop only. HONEST SCOPE: we verify the cited event's own authenticity, not that it's actually the thing your artifact claims to be re-reviewing.",
        +  "type": "object"
        +}
  17. 1 tool update
    • Changedreview1 field changed
      • changedInput schema / properties / sign / description
        Previous value: -"Return a PORTABLE SIGNED proof of this verdict (binds verdict + artifact hash + our pubkey), including a content-addressed decision_ref = sha256(JCS({artifact_hash, artifact_type, policy_version, verdict, source_class})). Attach it to your output so a downstream agent can confirm via verify_proof — WITHOUT trusting you or us — that invinoveritas issued this verdict for this exact artifact. The agent-to-agent trust handshake. For artifact_type=trade|onchain_action|sanctions_screening, the proof also carries source_class ('agent_reported' today — no mediation-point integration exists yet) and, when applicable, a vantage_limitation field disclosing that the verdict is occurrence evidence, not an absence/completeness claim — check it before treating an irreversible-class verdict as sufficient on its own."New value: +"Return a PORTABLE SIGNED proof of this verdict (binds verdict + artifact hash + our pubkey), including a content-addressed decision_ref = sha256(JCS({artifact_hash, artifact_type, policy_version, verdict, source_class})). Attach it to your output so a downstream agent can confirm via verify_proof — WITHOUT trusting you or us — that invinoveritas issued this verdict for this exact artifact. The agent-to-agent trust handshake. For artifact_type=trade|onchain_action|sanctions_screening, the proof also carries source_class ('agent_reported' today — no mediation-point integration exists yet) and, when applicable, a vantage_limitation field disclosing that the verdict is occurrence evidence, not an absence/completeness claim — check it before treating an irreversible-class verdict as sufficient on its own. The proof also carries an opaque engine_generation counter (informational, not bound into decision_ref) — compare it across two proofs to detect a backend/judgment-engine change between calls without us disclosing which model we run."

Related MCP Connectors

Related MCP Servers

  • F
    license
    Not graded
    quality
    C
    maintenance
    Provides AI agents with independent, advisory reviews before irreversible actions, returning recomputable, Bitcoin-anchored signed proofs that anyone can verify for free via a public verdict ledger.
    -
  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables deterministic verification of AI agent decisions and actions, providing PASS/FAIL/ABSTAIN verdicts with replayable proofs and an optional signed receipt ledger.
    33 npm
    Apache 2.0
  • A
    license
    Not graded
    quality
    D
    maintenance
    Provides cryptographic governance receipts for AI agents, enabling pre-execution evaluation and signed verdicts (EXECUTE/BLOCK/REVIEW/SHADOW) with offline-verifiable audit trails.
    MIT
Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.