NOMOS
Server Details
Ask a sealed authority whether an action may proceed. Answers are deterministic and citable.
- Status
- Healthy
- Last Tested
- Transport
- Streamable HTTP · MCP 2025-11-25
- URL
- ChatGPT
- –
- Claude
- –
TDQS
Scored across 4 tools
Two pairs overlap in purpose: ask_authority and verify_decision both evaluate inputs against sealed rules and return a verdict, and the line is further blurred because verify_decision also accepts keyless public pub_ artifacts, which is close to what ask_authority does for public authorities. Likewise generate_governance already performs contradiction detection that detect_contradictions exposes as a standalone tool. The descriptions do a lot of work to separate them, but an agent must read carefully to avoid misselection.
All four names follow a clean verb_noun pattern (ask_authority, detect_contradictions, generate_governance, verify_decision) in consistent snake_case. The verbs are semantically meaningful and predictable, so the naming alone communicates each tool's action.
Four tools is a lean but reasonable surface for a governance/verification service, and each covers a distinct stage (author, analyze, verify, consult). It feels slightly thin for a platform that also hosts a marketplace and a Studio, but nothing is redundant.
The core lifecycle of create -> analyze -> verify -> consult is covered, but there is no way to list or retrieve previously generated artifacts, re-seal/update an artifact after a policy change, or fetch a stored transcript by query_id. These gaps will force agents to work around missing operations rather than complete common workflows directly.
Available Tools
4 toolsask_authorityAInspect
Query a published authority on the NOMOS Exchange marketplace — a different system from verify_decision's own governance artifacts. Every public authority (e.g. eu-ai-act.nomos) is queryable with no key. Returns the authority's own verdict (AUTHORIZED/DENIED/ESCALATED), the exact rule and reason, and a permanent, cryptographically-bound transcript (query_id + url) — replayable evidence, not just a reply. Nothing is invented or paraphrased: the verdict is the authority's sealed rules evaluated against your inputs. The default response is a short, curated summary (verdict, matched rule, source citation when the artifact has one, transparency/completeness disclosures, transcript link) — not the full rule-by-rule evaluation trace. Set include_evaluation_trace: true to get that complete diagnostic record when you or the user actually need it.
| Name | Required | Description | Default |
|---|---|---|---|
| action | No | Optional label for what this query represents, for the caller's own transcript record (e.g. "pre-deployment check"). Purely descriptive — does not affect the verdict. | |
| inputs | Yes | Key/value facts to evaluate against the authority's rules (e.g. {"ai_categorises_biometric_data_for_sensitive_attributes": true}). Fields must match the authority's vocabulary — see the atlas endpoint or the artifact's catalog page. | |
| authority | Yes | The Exchange artifact's standard name — its short slug, optionally ".nomos"-suffixed (e.g. "eu-ai-act" or "eu-ai-act.nomos"), or its raw artifact ID. Browse the catalog at https://www.nomosprotocol.com/exchange. | |
| exchange_api_key | No | Exchange API key (nxk_...). Optional for free/public queries. Required only for metered access to licensed (paid) authorities beyond their free allotment. | |
| include_evaluation_trace | No | Set true to receive the full rule-by-rule evaluation trace (every rule checked, every missing field) instead of the default curated summary. Most callers never need this. |
Output Schema
| Name | Required | Description |
|---|---|---|
| url | No | Path to the permanent, shareable transcript for this query |
| verdict | No | The authority's own verdict |
| query_id | No | Permanent transcript ID — reopen any time at the returned url |
| expected_fields | No | Present only when ESCALATED for lack of data — the fields this authority still needs |
| matched_rule_id | No | ID of the rule that determined the verdict — null when AUTHORIZED with no matching rule |
| response_source | No | Provenance label — this is a sealed NOMOS verdict, not Claude's own reasoning. Preserve or restate this distinction when relaying the answer. |
| rules_evaluated | No | Only present when include_evaluation_trace was true |
| source_reference | No | Citation for the matched rule, when the source document's structure was captured at extraction time. Names where the rule TEXT was extracted from (e.g. "Article 5"), not a legal claim about what it covers. Null if unavailable. |
| matched_rule_name | No | Human-readable name/description of the matched rule — use this for display, not matched_rule_id |
| verdict_description | No | Human-readable reason — the exact rule and its consequence |
| rules_evaluated_count | No | Total rules checked during evaluation — the size of the full trace, whether or not it was returned |
| open_higher_priority_count | No | 0 means every relevant fact was known when this was sealed; >0 means facts were still missing above the matched rule |
| open_higher_priority_rules | No | The actual rules behind open_higher_priority_count (capped to 20) — use this to answer "which ones?" instead of guessing. Each has the rule name, what it would do if it matched, and exactly which input fields are missing. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations are sparse (readOnlyHint=false, openWorldHint=false, idempotentHint=false), and the description adds genuinely useful context the annotations cannot: no auth for public authorities, a permanent cryptographically-bound transcript (query_id + url) is produced, and the verdict comes from sealed rules rather than paraphrase. The non-read-only hint is consistent with the described permanent transcript write, so no contradiction. It does not discuss rate limits, latency, or error behavior for unknown authorities.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with purpose, then sibling differentiation, then response behavior — a sensible order with no wasted lead-in. Some phrasing is promotional rather than operative ('Nothing is invented or paraphrased', 'replayable evidence, not just a reply') and could be trimmed without losing decision-relevant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a nested-input, external-marketplace query tool with five parameters, the description covers auth tiers, what gets returned, and how to escalate detail. An output schema exists, so the description's return-value detail is a bonus rather than a requirement. Only error handling for malformed or unknown authority slugs is unaddressed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so every parameter is already documented, including the include_evaluation_trace default/trace tradeoff and the authority slug format. The description reinforces the default-vs-trace behavior but adds little syntax or format meaning beyond the schema. Baseline 3 applies when the schema carries the parameter burden.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Query a published authority on the NOMOS Exchange marketplace') and immediately scopes it against a named sibling ('a different system from verify_decision's own governance artifacts'). An agent can distinguish this from verify_decision, generate_governance, and detect_contradictions without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear routing context: this hits external published authorities, public ones need no key, licensed ones need an nxk_ key beyond a free allotment. It also tells the caller to omit include_evaluation_trace unless the diagnostic record is actually needed. It lacks an explicit 'use this when...' trigger phrase or stated exclusions for the other siblings, so it stops just short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
detect_contradictionsARead-onlyIdempotentInspect
Analyze policy documents (and optional behavioral decision logs) to detect contradictions, hidden rules, and gaps between declared policy and observed behavior. Stateless — no artifact is created and nothing is persisted. Returns contradiction types: threshold_conflicts (numeric rule overlaps), ghost_terms (undefined terms used in rules), role_conflicts (same action allowed by one role, denied by another), rule_collisions (direct logical conflicts), and layer_divergences (policy says X but behavioral data shows Y).
| Name | Required | Description | Default |
|---|---|---|---|
| api_key | No | NOMOS API key (nmk_live_...). | |
| documents | Yes | Policy documents to analyze for contradictions. | |
| behavioral_logs | No | Optional historical decision records. Enables layer_divergence detection — surfaces behavioral patterns that deviate from written policy. |
Output Schema
| Name | Required | Description |
|---|---|---|
| summary | No | Plain-language summary of findings |
| hidden_rules | No | Rules inferred from behavior not in written policy |
| contradictions | No | List of detected contradictions |
| total_contradictions | No | Total contradictions found |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/idempotent/closed-world, and the description adds genuinely new context: nothing is persisted and no artifact is created, which matters for a policy-analysis call. It stops short of mentioning API key requirements or input size limits, so it is strong but not complete.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the core action and followed by the stateless guarantee and the result taxonomy. The category list is dense but each entry conveys distinct output an agent needs for interpretation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present and full parameter coverage, the description covers purpose, statelessness, and result types adequately for a three-parameter analysis tool. It could note auth or document volume expectations, but nothing critical for correct invocation is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so both the document fields and behavioral_logs are already documented in the schema, including the layer_divergence note the description repeats. The description adds no format, sizing, or api_key nuance beyond structured data, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Analyze policy documents ... to detect contradictions') and enumerates the exact output categories (threshold_conflicts, ghost_terms, role_conflicts, rule_collisions, layer_divergences). The 'Stateless — no artifact is created' clause separates it from the artifact-producing siblings like generate_governance.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies usage through 'optional behavioral decision logs' enabling layer_divergence detection, which tells the agent when to supply extra input. However, it never states when to choose this over the adjacent siblings (verify_decision, ask_authority) or what preconditions the documents must meet.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
generate_governanceAInspect
Convert one or more policy documents into a sealed NOMOS governance artifact (.nomos). Extracts executable rules using Claude, detects contradictions between rules, computes an Autonomy Readiness Index (ARI) score (0–1), and cryptographically seals the result. Returns an artifact_id you can use with verify_decision immediately. Optionally accepts historical behavioral decision logs to add a behavioral evidence layer and reach CERTIFIED confidence tier.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Human-readable name for the governance artifact (e.g. "Loan Approval Policy v2", "HR Leave Rules"). | |
| domain | No | Industry or domain hint (e.g. "lending", "hr", "e-commerce", "healthcare", "insurance"). Improves extraction accuracy. | |
| api_key | No | NOMOS API key (nmk_live_...). | |
| documents | Yes | Policy documents to extract governance rules from. Each item must have filename and content (plain text). | |
| organization | Yes | Name of the organization this artifact governs (e.g. "Acme Bank", "HealthCorp"). | |
| behavioral_logs | No | Optional historical decision records (CSV rows as objects) for behavioral triangulation. Minimum 10 rows recommended. |
Output Schema
| Name | Required | Description |
|---|---|---|
| ari_score | No | Autonomy Readiness Index 0–1 (≥0.60 autonomous, ≥0.30 bounded, <0.30 human-governed) |
| seal_hash | No | SHA-256 cryptographic seal of the artifact |
| artifact_id | No | Unique ID for the sealed artifact — use this with verify_decision |
| autonomy_band | No | Recommended deployment mode |
| contradictions | No | Number of contradictions detected |
| confidence_tier | No | Artifact confidence tier |
| rules_extracted | No | Number of executable rules extracted |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare not read-only, not open-world, and not idempotent. The description adds meaningful behavior beyond them: LLM-based extraction, contradiction detection, ARI computation, cryptographic sealing, returned artifact_id, and the confidence-tier effect of behavioral logs. It does not cover cost, latency, or overwrite semantics, so it is not a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four front-loaded sentences with no filler: first states the transformation, then the processing steps, then the return value, then the optional input effect. Every sentence carries operational information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex mutation tool with an output schema and full parameter descriptions, the description covers the key workflow and output linkage. Minor omissions—such as cost, latency, or explicit overwrite/idempotency behavior—are not fatal because annotations and schema cover much of the contract.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already explains name, organization, documents, domain, api_key, and behavioral_logs. The description adds conceptual value for behavioral_logs (behavioral evidence layer / CERTIFIED tier) but little for the other parameters; baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Convert ... policy documents into a sealed NOMOS governance artifact') and enumerates the processing steps: rule extraction, contradiction detection, ARI scoring, and sealing. It also names the downstream sibling verify_decision, but does not explicitly differentiate itself from detect_contradictions despite the overlap.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides implied usage context—use it to produce an artifact_id for verify_decision, and optionally supply behavioral logs to reach CERTIFIED tier—but gives no explicit when-to-use versus detect_contradictions or ask_authority, nor when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verify_decisionARead-onlyIdempotentInspect
Check whether an AI decision is allowed, denied, or needs escalation according to a sealed NOMOS governance artifact. Always returns allowed (boolean) — that field is safe to read regardless of which artifact type answered. The rest of the shape genuinely differs by artifact type, because it proxies two different underlying endpoints: pub_ demo artifacts return a flat shape (outcome: auto_approved/auto_rejected/escalated, rule_applied, rule_reference, flat confidence and audit_hash); your own sealed artifacts from Studio return a nested shape (verdict: approved/rejected/escalated, a nested rule object, and nested confidence/audit/performance objects). See outputSchema for both exact shapes — do not assume one without checking which kind of artifact_id was passed. Use artifact IDs starting with pub_ for public demo artifacts that require no API key: pub_lending_v1 (loan approval), pub_refund_v1 (refund policy), pub_fraud_v1 (fraud detection), pub_hr_leave_v1 (HR leave approval), pub_kyc_v1 (KYC/identity).
| Name | Required | Description | Default |
|---|---|---|---|
| inputs | Yes | Key/value input fields for rule evaluation (e.g. {"amount": 5000, "credit_score": 720}). Fields must match the artifact's declared data contract. | |
| api_key | No | NOMOS API key (nmk_live_...). Not required for pub_ artifacts. | |
| decision | Yes | The action or decision being checked, as a verb phrase (e.g. "approve_loan", "process_refund", "approve_leave"). Should match an action defined in the artifact. | |
| domain_id | No | Your NOMOS domain ID. Required for custom artifacts created in Studio. Not needed for pub_ artifacts. | |
| artifact_id | Yes | Sealed artifact ID to evaluate against. Use pub_lending_v1, pub_refund_v1, pub_fraud_v1, pub_hr_leave_v1, or pub_kyc_v1 for public demos. Use your own artifact ID from Studio for custom governance. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and closed-world, so the safety profile is covered. The description adds genuine non-annotation context: the response shape is not uniform, `allowed` is the only field safe to read across both variants, and the two shapes correspond to two different backend endpoints. It stops short of stating failure modes (invalid artifact_id, contract mismatch on inputs) or rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The core guarantee ("Always returns `allowed`") is front-loaded and the shape divergence is explained before the artifact list. It is information-dense but the enumeration of pub_* IDs and their domains duplicates the schema's artifact_id description, which is the one removable block.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with a polymorphic response, nested objects, and mixed authentication requirements, the description covers auth (no key for pub_*), the polymorphic return contract, a cross-reference to outputSchema for exact shapes, and the available demo artifacts. An agent has everything needed to call it correctly without guessing the response shape.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so every parameter including the pub_* ID list and the api_key/domain_id split is already documented in structured data. The description largely restates the schema's artifact_id guidance rather than adding new meaning about how `decision` must match an artifact action or how `inputs` keys are validated. Baseline 3 applies when the schema carries the load.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
"Check whether an AI decision is allowed, denied, or needs escalation according to a sealed NOMOS governance artifact" names a specific verb (check/verify), a specific resource (a decision against a sealed artifact), and the three possible outcomes. It is clearly distinguishable from siblings generate_governance (producing artifacts) and detect_contradictions (auditing rules), and the mention of artifact types further narrows the scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives concrete routing guidance between artifact classes: use pub_* IDs for public demos with no API key, and your own Studio artifact IDs (plus domain_id) for custom governance. It does not explicitly state when to prefer this tool over ask_authority, so the sibling-level exclusion is missing, but the intra-tool selection guidance is strong.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
4 tool updates
- First observed
ask_authority - First observed
detect_contradictions - First observed
generate_governance - First observed
verify_decision
Related MCP Connectors
Pre-execution policy gate for consequential agent actions with durable trust receipts.
Second opinion before an irreversible agent action; signed proofs, free verify, public ledger.
Identity and authorization in one system: allow, deny, the reason, and a record.
Govern proposed Action Cards with Decision Receipts before developer-owned execution.
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceProvides agents with five read-only advisory tools for bounded semantic decisions, returning redacted receipts while leaving execution and authorization to the host.17,996 npmApache 2.0
- AlicenseNot gradedqualityAmaintenanceEnables any MCP client to route an agent's tool calls through Abhed's action gate, receiving allowed outputs, waiting for human approval on held actions, or errors naming the rule that blocked them. Every decision is recorded on a hash-chained, Ed25519-signed ledger.MIT
- AlicenseAqualityBmaintenanceEnables MCP-speaking agents to execute tool calls through an authorization gate, producing signed decision records and reconciled effect rows for accountability.6Apache 2.0
- AlicenseAqualityCmaintenanceEnables action-bound authorization and verifiable evidence contracts for MCP tool execution, offering deterministic action planning, policy decisions, and one-use capability tokens tied to exact action envelopes.31Apache 2.0
Glama MCP Gateway
Add one secure layer between your agents and this server.