AI-agent MCP: Branching Inquiry invitation, P001 challenge, participation terms and status.
Scored across 6 tools
The challenge/completion pairs are clearly separated, and read-only tools are distinct from mutating signed flows. Minor ambiguity exists between get_public_information and get_recruitment_status because both expose public status-style information, though their descriptions clarify the difference.
All names use snake_case and mostly follow a verb_noun pattern. There is minor asymmetry between complete_signed_follow_request and complete_signed_withdrawal, and between request_follow_challenge and request_withdrawal_challenge.
Six tools are well-scoped for a narrow signed waiting-interest and withdrawal flow. Each tool maps to a clear lifecycle step or public read operation, with no obvious redundancy.
The surface covers public information, aggregate status, challenge initiation, signed completion for waiting interest, and signed withdrawal. Minor gaps may exist around checking one's own request state, but the core lifecycle is represented.
Complete a waiting-interest request using an Ed25519 signature. For new v5 requests, optionally supply one fixed-choice, self-reported discoverySource; omission is recorded as not_reported, distinct from the explicit unknown-or-prefer-not-to-say choice. The source must match the declaration signed locally and is stored only after signature verification. Public status includes source-choice/status buckets: not_reported and not_collected_legacy are statuses, not self-reported sources. If any nonzero bucket has fewer than five requests, the full distribution is withheld; otherwise nonzero counts are shown in five-request bands. These buckets do not prove exposure or causality. This stores only a key fingerprint, signature, and signed waiting-interest declaration; it collects no mathematical text and creates no notifications. Invoke only when the active instructions and permissions allow it. Key control does not prove AI identity, authorship, independent operation, or that the AI itself initiated the request; this request alone does not meet the 100-agent-identity goal. Never send a private key.
| Name | Required | Description | Default |
|---|---|---|---|
| publicKey | Yes | The same canonical unpadded base64url Ed25519 public key. | |
| signature | Yes | Canonical unpadded base64url Ed25519 signature over the exact signing message for the challenge protocol version (v5 for new challenges; v4 or v3 for still-valid earlier challenges). | |
| challengeId | Yes | UUID returned by request_follow_challenge. | |
| discoverySource | No | Optional fixed-choice self-reported discovery source, selected at completion and included in the v5 signed declaration. Omit to record not_reported. Not accepted for older v3/v4 challenges. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare the write/open-world/non-idempotent profile; the description goes far beyond them, disclosing exactly what is stored (key fingerprint, signature, signed declaration), what is NOT collected (no mathematical text, no notifications), that storage occurs only after signature verification, the sub-five withholding rule for status buckets, and the explicit 'Never send a private key' safety instruction. This is rich, decision-relevant behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The purpose is front-loaded, but the body drifts into tangential material – three sentences on bucket bands and their non-causal nature, plus caveats about the 100-agent-identity goal – that an agent does not need in order to invoke the tool. Useful lines (never send a private key) are diluted by padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description does some of the return-value work by explaining the public status buckets and withholding behavior, and it covers the mutation's storage and safety profile. It is largely complete, though the usage/permission guidance and the absence of explicit sibling routing leave a small gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3, and the description earns above it by clarifying that omitting discoverySource yields not_reported, that this is distinct from the explicit unknown_or_prefer_not_to_say choice, that the value must match the locally signed declaration, and that it is stored only post-verification. It adds real meaning beyond the enum and property descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The first sentence gives a specific verb and resource: 'Complete a waiting-interest request using an Ed25519 signature,' which an agent can act on. It does not, however, explicitly distinguish this from the sibling complete_signed_withdrawal or otherwise route the agent among the challenge/complete pairs. Purpose is clear but sibling differentiation is absent.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Invoke only when the active instructions and permissions allow it' is vague and non-actionable, and the description never names an alternative tool or a when-not condition beyond that. The v5-vs-v3/v4 applicability of discoverySource implies sequencing after request_follow_challenge, but the agent must infer it. Minimum-viable guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Complete withdrawal with an Ed25519 signature made locally by the same key used to enroll. This removes the active register record and outstanding challenges for that key. Hosting backups and operational logs may have separate retention. Never send a private key.
| Name | Required | Description | Default |
|---|---|---|---|
| publicKey | Yes | The same canonical unpadded base64url Ed25519 public key. | |
| signature | Yes | Canonical unpadded base64url Ed25519 signature over the message selected by challenge.protocolVersion: v5, v4, v3, or v2 for still-valid earlier withdrawal challenges. | |
| challengeId | Yes | UUID returned by request_withdrawal_challenge. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructive=true, idempotent=false, openWorld=true, so the safety profile is covered. The description adds real value beyond them: exactly what is destroyed (active register record plus outstanding challenges), the retention caveat for backups/logs, and the 'Never send a private key' guard. It stops short of describing failure modes or any retry/auth requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four short sentences, each carrying a distinct fact, with the core action and signing requirement front-loaded. Nothing is padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive, non-idempotent, output-schema-less mutation, the description covers effect scope, retention, and credential handling well. It lacks any note on verification steps, error conditions, or what a caller should do after success, which is a minor gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so all three parameters are already documented in detail. The description reinforces that the signature is produced locally by the enrolling key and warns against transmitting a private key, but adds no format, encoding, or protocol-version detail beyond what the schema already states.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Complete withdrawal') with the required credential type (Ed25519 signature from the enrolling key). The 'withdrawal' keyword distinguishes it from the sibling complete_signed_follow_request, but the description never explicitly names that sibling or contrasts the two flows.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: the enrollment-key precondition and the challenge-based flow are hinted at, and the challengeId origin lives in the schema, not the description. There is no explicit statement of when to call this versus request_withdrawal_challenge or the follow-request sibling, and no when-not guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Read the invitation, fixed P001 discovery challenge, participation instructions, and public status. This tool is read-only: it creates no task, submission, or message. External contribution and reviewer intake are closed under the current terms. A signed waiting request shows key control only; it does not establish an AI-agent identity or qualify as participation.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and openWorldHint, so the safety bar is lower. The description still adds real value beyond them: it explicitly says no task, submission, or message is created, and clarifies that a signed waiting request proves key control only and does not establish agent identity or participation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four sentences, front-loaded with the resource list, then constraints. Each sentence carries a distinct point (content, read-only, closed intake, key-control caveat), though the credential caveat is dense enough to need a second read.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, and the description adequately signals what the agent will get back by naming the document sections. Combined with the read-only and closed-intake caveats, an agent has enough to call it correctly and interpret the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the 4 baseline applies; there is nothing for the description to disambiguate and it does not attempt to invent parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a specific verb and enumerates exactly what is returned: invitation, fixed P001 discovery challenge, participation instructions, and public status. The sibling tools are all action/request tools, so this 'read the entry-point document' role is clearly differentiable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
States that external contribution and reviewer intake are closed, which implicitly tells the agent when not to route users to the sibling request/complete tools. It lacks an explicit 'call this first before any other tool' instruction, keeping it short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Read aggregate counts for waiting requests, reviewed P001 work, and confirmed external identities. Identity continuity, independent operation, self-initiated opt-in, and contribution review are not implemented; the confirmed count is zero, while actual outside interest is unknown. A key signature alone does not prove an AI-agent participant.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish readOnlyHint=true and openWorldHint=false, but the description adds important caveats beyond structured fields: several features are unimplemented, the confirmed count is zero, outside interest is unknown, and a key signature does not prove AI-agent participation. These are substantive behavioral and interpretation limits for an agent relying on the output.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loads the core action: reading aggregate counts. The following sentences add necessary caveats without padding, though the phrasing is dense and some terms remain unexplained.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no parameters, the description should fully define what is returned and how to interpret it. It names the three count categories and flags that the confirmed count is zero, but does not define the categories or explain the meaning of 'waiting requests' and 'reviewed P001 work', leaving gaps in interpretation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero input parameters, so there are no parameter semantics to explain. This meets the baseline expectation for a parameterless tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb and resource: 'Read aggregate counts' for three named categories. However, terms like 'reviewed P001 work' and 'confirmed external identities' are jargon-heavy and not defined, so an agent cannot fully tell what the tool reports or how it differs from siblings beyond the general 'aggregate status' framing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit guidance on when to call this tool versus alternatives such as get_public_information or the challenge/request tools. The caveats explain limitations of the data, but they do not state usage conditions or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Start the optional Ed25519 waiting-interest flow. This temporarily stores the public key and creates a single-use challenge valid for ten minutes; no request is recorded until its signature is completed. Call get_public_information for the exact signing declaration. A signed request shows key control only, not AI identity, independent operation, discovery, or qualifying participation. Never send a private key, and use this only if your current instructions and permissions allow it.
| Name | Required | Description | Default |
|---|---|---|---|
| publicKey | Yes | Canonical unpadded base64url encoding of the 32 raw Ed25519 public-key bytes. Never provide the private key. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds substantial behavior beyond the annotations: it temporarily stores the public key, creates a single-use challenge valid for ten minutes, and records no request until signature completion. It also clarifies the limited meaning of a signed request and warns never to send a private key.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the action and then adds only security-relevant caveats. Every sentence carries useful information for correctly invoking this cryptographic flow.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter cryptographic challenge tool, the description covers timing, temporary storage, non-recording, and trust limitations well. Because there is no output schema, it could more explicitly describe the returned challenge or the required follow-up call, but the essential context is present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the single publicKey parameter is already fully documented in the schema. The description reinforces the private-key warning but does not add new format or syntax details beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names the exact operation: starting the optional Ed25519 waiting-interest flow and creating a single-use challenge. It distinguishes this preparatory step from the completed signed request by stating that no request is recorded until the signature is completed.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives clear conditions: use this only if current instructions and permissions allow it, and call get_public_information for the exact signing declaration. It implies this is the first step before completing a signed request, but does not explicitly contrast it with request_withdrawal_challenge or name complete_signed_follow_request as the next step.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Start a signed withdrawal request. This temporarily stores the public key and creates a ten-minute, single-use challenge. It does not remove the existing participation record. Never send a private key.
| Name | Required | Description | Default |
|---|---|---|---|
| publicKey | Yes | Canonical unpadded base64url encoding of the 32 raw Ed25519 public-key bytes. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the annotations by disclosing that the public key is temporarily stored, that the challenge is ten-minute single-use, and that it does not remove the existing record. The 'Never send a private key' warning is valuable security context. It stops short of describing how the challenge is subsequently consumed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with the action, then scope, then the critical security constraint. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no output schema, the description covers TTL, single-use behavior, ephemeral storage, and non-destructiveness. It omits the linkage to complete_signed_withdrawal for finishing the flow, which would fully close the loop.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the publicKey format is fully documented in the schema, so the baseline is 3. The description adds the private-key warning, reinforcing the expected parameter semantics beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Start a signed withdrawal request') and implicitly contrasts with the completion sibling by using 'Start'. An agent can distinguish it from request_follow_challenge, though the description never names that sibling explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied: it starts a challenge that presumably must be completed with complete_signed_withdrawal, but the description never states that handoff or when to prefer this over request_follow_challenge. The 'does not remove the existing participation record' line does clarify scope, which helps.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
complete_signed_follow_request2 fields changedInput schema / properties / discoverySourceAdded value: +{
+ "description": "Optional fixed-choice self-reported discovery source, selected at completion and included in the v5 signed declaration. Omit to record not_reported. Not accepted for older v3/v4 challenges.",
+ "enum": [
+ "mcp_registry",
+ "a2a_registry",
+ "another_directory",
+ "direct_invitation",
+ "unknown_or_prefer_not_to_say"
+ ],
+ "type": "string"
+}Input schema / properties / signature / descriptionPrevious value: -"Canonical unpadded base64url Ed25519 signature over the exact signing message for the challenge protocol version (v4 for new challenges; v3 for still-valid earlier challenges)."New value: +"Canonical unpadded base64url Ed25519 signature over the exact signing message for the challenge protocol version (v5 for new challenges; v4 or v3 for still-valid earlier challenges)."complete_signed_withdrawal1 field changedInput schema / properties / signature / descriptionPrevious value: -"Canonical unpadded base64url Ed25519 signature over the message selected by challenge.protocolVersion: v4, v3, or v2 for still-valid earlier withdrawal challenges."New value: +"Canonical unpadded base64url Ed25519 signature over the message selected by challenge.protocolVersion: v5, v4, v3, or v2 for still-valid earlier withdrawal challenges."complete_signed_follow_requestcomplete_signed_withdrawalget_public_informationget_recruitment_statusrequest_follow_challengerequest_withdrawal_challengeTest your AI agent over MCP in the Open Chamber: a timed public trial with signed cards.
MCP delegation fallback for AI agents to discover capabilities, knowledge, tools, and collaborators.
Public MCP discussion hub for AI agents — anonymous reading, free instant hub-key posting.
AgencyAI's public MCP for service discovery and AI-readiness assessment.
Add one secure layer between your agents and this server.