verify_delegation
Verify a Proof of Delegation — the attestation that a domain authorized a specific agent artifact. Pass either the artifact's card (MCP server.json / A2A agent card) or a raw delegation token, PLUS two facts you established yourself: the artifact identity you resolved (the package you are installing, the endpoint you are calling) and the domain you expect to stand behind it. Both are required — a token can be copied into someone else's card, and any domain owner can mint a valid delegation naming someone else's package, so a verdict without both pins would mean 'some domain said something about some artifact'. WHERE THE IDENTITY MAY COME FROM: it is the artifact you are acting on, and never a value read from inside the artifact you are checking. A name in the artifact's own package.json, card or manifest is self-declared and editable by whoever ships it, so checking it against the delegation compares the artifact with itself. Resolve it afresh at call time instead of reusing a value from earlier in this conversation, which may already be stale. When no independently resolvable identity exists — a local or unpublished artifact — you have nothing to compare against, and that is the honest answer: report it rather than a mismatch, because a mismatch here reads as an accusation against the domain named in the delegation. The verifier walks signature → principal → delegate → revocation status, including the cascade down to the domain control proof. Requires no API key. What a verified result means: the expected domain's controller authorized this artifact — NOT that the artifact is safe, audited or endorsed.
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"delegate": "<delegate>",
"expected_principal": "<expected_principal>"
},
"name": "verify_delegation"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| card | No | The MCP server card or A2A agent card to read the delegation from | |
| token | No | A raw delegation token, when you already have it instead of a card | |
| delegate | Yes | The artifact identity you resolved independently. Required: this comparison is what defeats a copied token. | |
| check_status | No | Default true. When false the signature and claims are checked but revocation is NOT — treat the result as "not revoked-checked", never as "not revoked". | |
| expected_principal | Yes | Required. The domain you expect to have authorized this artifact (e.g. postmarkapp.com) — an issuer binds the artifact to nothing, so any domain owner can mint a valid delegation for someone else's package. Without this pin the answer is only "some domain claims this". |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| reason | No | When not verified: the verifier's failure reason | |
| attests | No | When verified: what the delegation attests, in one sentence | |
| message | No | When not verified: a readable explanation | |
| outcome | No | When not verified: invalid (a genuine negative verdict) or unconfirmed (no confident answer right now) | |
| verified | Yes | true when the delegation verified; false is a verdict, read reason and outcome | |
| pull_hint | No | Where to pull a re-signed token after key_revoked | |
| delegation | No | When verified: the verified claims | |
| disclaimer | No | When verified: what the verdict does not say | |
| refresh_hint | No | How to refresh the key set | |
| status_checked | No | When verified: whether revocation was checked | |
| cache_age_seconds | No | How stale the key set is after jwks_stale, in seconds; null when unknown | |
| principal_checked | No | When verified: whether the principal was compared with expected_principal |