Skip to main content
Glama

carrierscore

by io.carrierscore

Verify Archived Evidence Report Hash

verify_evidence
Read-onlyIdempotent

Verify an archived Montgomery evidence report by its audit entry id: CarrierScore re-reads the immutable stored copy, recomputes its SHA-256 and reports whether it matches the hash recorded at generation time (and, optionally, a hash the caller supplies — e.g. the sha256 printed on a broker's filed copy). Requires the same paid API key that generated the report.

Use it when a broker or auditor needs to prove that a filed evidence report is exactly what CarrierScore produced on the stated date. match=true means the archived report is byte-identical to what was served; match_supplied compares against the caller's own hash. Follow up with the audit_entries list to find ids, or with montgomery_file to generate a fresh report.

Args:

  • entry_id: the audit_entry_id returned by montgomery_file (also listed by audit_entries)

  • sha256 (optional): a 64-hex SHA-256 to compare against the archived report (text or canonical json)

Returns JSON: { entry_id, dot_number, generated_at, scored_as_of, score_version, format_requested, sha256_stored, sha256_computed, match, sha256_json_stored, sha256_json_computed, match_json, sha256_supplied?, match_supplied? }.

Errors: 403 without a paid key, or (Monitor tier) if the entry is older than the 90-day retrieval window; 404 if the entry id is unknown for this key.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
sha256NoOptional SHA-256 to compare against the archived report
entry_idYesAudit entry id from montgomery_file / audit_entries

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
matchYestrue = the archived report is byte-identical to what was served
entry_idYes
dot_numberNo
match_jsonNo
generated_atNo
scored_as_ofNo
score_versionNo
sha256_storedNoHash recorded when the report was archived
match_suppliedNoWhether the supplied hash matches the archived report
sha256_computedYesHash recomputed now from the stored report text
sha256_suppliedNoEcho of the hash the caller supplied, if any
format_requestedNo
sha256_json_storedNo
sha256_json_computedNo

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false, so the safety profile is clear. The description adds value by explaining the verification process (re-reads stored copy, recomputes SHA-256, compares hashes). It also discloses authentication requirement ('Requires the same paid API key') and error conditions (403, 404, Monitor tier 90-day limit), which go beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a clear first sentence (verb+resource), usage section, parameter explanations, and return value summary. At about 120 words, it is efficient but could be slightly more terse in the return value explanation since an output schema exists. Still, every major sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity (2 params, output schema present, descriptive annotations), the description is complete: it explains purpose, usage context, parameters, return fields, error cases, and authentication. The presence of output schema reduces the burden for return values, and the description focuses on what the schema and annotations don't cover.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description adds meaning by explaining the source of entry_id ('from montgomery_file / audit_entries') and the optional sha256 parameter's purpose ('caller supplies — e.g. the sha256 printed on a broker's filed copy'). It also clarifies the patterns but schema already has regex. The description earns extra for explaining how parameters relate to the verification logic.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'verify' and the specific resource 'Archived Montgomery evidence report hash'. It distinguishes the tool from siblings like 'montgomery_file' (generates fresh reports) and 'audit_entries' (lists ids) by explaining that this tool checks integrity of stored reports.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says 'Use it when a broker or auditor needs to prove that a filed evidence report is exactly what CarrierScore produced on the stated date.' It also provides context on when not to use it implicitly (e.g., to generate a fresh report use montgomery_file) and gives follow-up actions (audit_entries list, montgomery_file).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All carrierscore toolsInspect
Try in Browser
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.5/5.0
Disambiguation5/5

Each tool targets a distinct function: identity lookup, detailed risk scoring, batch monitoring, alert history, report generation, and list management. There is no meaningful overlap between them; even carrier_score and montgomery_file differ in that one returns raw indices and the other produces a documented artifact.

Naming Consistency4/5

All names use snake_case and are readable, but there is a slight mix of verb-first (list_alerts, monitor_carriers, save_carrier_list) and noun-first (carrier_lookup, carrier_score, montgomery_file) patterns. This is a minor deviation; the names are still clear and predictable.

Tool Count5/5

Six tools is well-scoped for a domain-specific risk-assessment API. Each tool serves a clear purpose in the workflow, covering identity verification, scoring, batch checks, monitoring, alerting, and report generation without bloat.

Completeness4/5

The core lifecycle is covered: lookup, score, monitor, alert, report. However, there is no tool to update or delete a saved carrier list, nor a way to list the current contents of a list. These are minor gaps that can be worked around by creating new lists or relying on alert data.

Resources