Skip to main content
Glama
Sign In

Spurvik EU AI Act

by com.spurvik
OverviewDiscussionsAdmin

spurvik_explain_receipt

Read-onlyIdempotent

Explain the fields of an HMAC provenance receipt JSON. If signingSecret is passed, or SPURVIK_SIGNING_SECRET is set, check the HMAC locally with verifyProvenanceSignature, which checks that the record's signed fields still match the HMAC-SHA-256 signature. It does not show that a notice was shown, that output is marked, or that your system meets the Act. The signing secret is not logged. Omit the secret to explain the fields without checking.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "receipt": "<receipt>"
    },
    "name": "spurvik_explain_receipt"
  }
}

Input Schema

NameRequiredDescriptionDefault
receiptYes
signingSecretNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the read-only and idempotent annotations, it discloses that verification happens locally via verifyProvenanceSignature, checks signed fields against an HMAC-SHA-256 signature, does not prove notice display or compliance, and does not log the secret. These are meaningful behavioral and security details that an agent would not get from the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the tool's purpose, then covers optional HMAC verification, limitations, secret handling, and omission behavior. Every sentence adds useful context, with no redundant or filler wording.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a low-complexity tool with two parameters and no output schema, the description covers purpose, optional verification behavior, limitations, and secret handling. It gives enough context to invoke the tool correctly without needing additional structured documentation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry parameter meaning. It fully explains signingSecret: optional, can come from SPURVIK_SIGNING_SECRET, is not logged, and changes behavior when omitted. It describes receipt only as an HMAC provenance receipt JSON, which is useful but does not fully specify the expected receipt shape.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: explaining the fields of an HMAC provenance receipt JSON. It is clear enough to separate from the sibling tools, but it does not explicitly distinguish itself from them or name when to choose this versus an alternative.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives clear conditional usage for the optional signingSecret: if provided or if SPURVIK_SIGNING_SECRET is set, HMAC verification is performed; omitting the secret explains fields without checking. It also states what the verification does not prove. It lacks explicit when-to-use guidance relative to sibling tools, so it is strong but not complete.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Spurvik EU AI Act toolsInspect
Try in Browser
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources