Knox Anchor

anchor_mcp_tool_call

Convenience anchor for the AAM Model Context Protocol theater. Records an agent_mcp_tool_call event with structured tool-call metadata (server URL, tool name, argument digest, asserted agent identity, response digest). The record is sealed with a commitment to the authenticated principal that made the assertion, so a reader can tell WHO claimed it. Knox does not authenticate the named agent: this makes an assertion about an agent's actions independently checkable, not the agent itself independently identified.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "server_url": "<server_url>",
      "tool_name": "<tool_name>",
      "arguments_digest": "<arguments_digest>",
      "agent_identity": "<agent_identity>",
      "outcome": "<outcome>"
    },
    "name": "anchor_mcp_tool_call"
  }
}

Input Schema

Name	Required	Description
`outcome`	Yes	Outcome of the tool call.
`tool_name`	Yes	Name of the tool invoked.
`server_url`	Yes	MCP server endpoint the agent invoked.
`agent_identity`	Yes	Stable identifier the CALLER asserts for the agent (e.g., agent ID, principal, did:knox:agent-X). Recorded as an assertion attributed to your API key, never as an authenticated subject; the anchored payload carries agentIdentityVerified:false and a commitment to the asserting principal.
`response_digest`	No	Caller-computed SHA-256 of the JSON-stringified response (64 hex chars).
`arguments_digest`	Yes	Caller-computed SHA-256 of the JSON-stringified arguments (64 hex chars).

Schema Changelog

Changes observed during successful MCP inspections.

Changed2 schema fields changedSep 20, 2026

changedInput schema / properties / agent_identity / description

Previous value: -"Stable identifier for the calling agent (e.g., agent ID, principal, did:knox:agent-X)."New value: +"Stable identifier the CALLER asserts for the agent (e.g., agent ID, principal, did:knox:agent-X). Recorded as an assertion attributed to your API key, never as an authenticated subject; the anchored payload carries agentIdentityVerified:false and a commitment to the asserting principal."

addedInput schema / properties / agent_identity / maxLength
```
Added value: +256
```

First observedAug 7, 2026

TDQS

A4/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full behavioral burden and does so thoroughly. It discloses that the record is sealed with a commitment to the authenticated principal, that Knox does not authenticate the named agent, that the event carries `agentIdentityVerified:false`, and that the record makes an independently checkable assertion. This is rich, transparent behavioral context that goes far beyond a simple action statement.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two long sentences, but every clause adds substantive value—purpose, event type, metadata fields, and the critical trust model. It is dense but not wasteful; the front-loaded purpose is immediately clear. It could be slightly tightened, but for the conceptual complexity it is well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the absence of annotations and output schema, the description is remarkably complete. It covers the event's content, the trust boundaries, the principals involved, and the verifiable nature of the record. Combined with fully described schema parameters, an agent has everything needed to use the tool appropriately.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage, so the baseline is 3. The description does not add per-parameter meaning beyond what the schema already provides; it gives high-level context about digests and agent identity, but the schema descriptions already explain the assertion semantics and formats. The description neither compensates for gaps nor loses credit.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool records an `agent_mcp_tool_call` event with structured metadata, naming the specific event type and its purpose as a 'convenience anchor' for AAM MCP. It distinguishes itself from generic anchoring by focusing on tool-call auditing, but it does not explicitly contrast with the sibling `anchor_event` tool, so it falls short of full differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use the tool—when you need to anchor an MCP tool call and record its metadata—but it does not explicitly state when not to use it or how it compares to alternatives like `anchor_event` or `anchor_file_hash`. The usage context is clear enough to infer, but there is no explicit routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Knox Anchor tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?