Trust Gate

mint_action_receipt

Mint a signed receipt (Ed25519, plus ML-DSA-65 when the post-quantum backend is available) for an arbitrary consequential agent action. Optional attestation: triggered_by_type (human/agent/script), triggered_by_source (api/cli/cron), decision_model (the LLM model used). Attestation values are caller claims: allowlisted to safe characters, signed, not verified. Decisions that contain a gate verdict word are reserved for gate_decision.

Input Schema

TableJSON Schema

Name	Required	Default
`inputs`	No
`policy`	No	agent action evidence
`target`	Yes
`agent_id`	Yes
`decision`	No	ACTION_GOVERNED
`operation`	Yes
`decision_model`	No
`triggered_by_type`	No
`triggered_by_source`	No

Output Schema

TableJSON Schema

Name	Required	Description	Default
`result`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

Changed3 schema fields changedOct 2, 2026

addedInput schema / properties / decision_model

Added value: +{
+  "anyOf": [
+    {
+      "type": "string"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "title": "Decision Model"
+}

addedInput schema / properties / triggered_by_source

Added value: +{
+  "anyOf": [
+    {
+      "type": "string"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "title": "Triggered By Source"
+}

addedInput schema / properties / triggered_by_type

Added value: +{
+  "anyOf": [
+    {
+      "type": "string"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "title": "Triggered By Type"
+}

First observedJun 25, 2026

TDQS

A4.1/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden, and it does disclose meaningful traits: Ed25519 signing with ML-DSA-65 fallback, attestation values being caller claims (allowlisted, signed, not verified), and the reservation rule. It omits permissions/auth requirements and durability of the emitted receipt.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core action and mechanism, then the optional attestation, then the exclusion rule. Dense but each sentence carries information; only the parenthetical backend caveat is slightly incidental.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need no explanation, and the description covers mechanism, optional fields, and sibling routing. It would be complete if it addressed the overlap with mint_receipt_for_record_change and any auth prerequisites for minting.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% across 9 params, so the description must compensate. It documents three parameters with example values (triggered_by_type human/agent/script, triggered_by_source api/cli/cron, decision_model) and implicitly constrains 'decision' via the gate-verdict rule, but agent_id, operation, target, inputs, policy, and the ACTION_GOVERNED default are left undefined.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('mint a signed receipt ... for an arbitrary consequential agent action') with the crypto mechanism named, and explicitly carves out the sibling gate_decision for gate-verdict decisions. An agent can distinguish it from verify_receipt and gate_decision without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly routes gate-verdict-word decisions to gate_decision, which is genuine when-not guidance. However it never mentions mint_receipt_for_record_change, the nearest-scoped sibling, so the agent must infer the boundary between 'arbitrary action' and 'record change'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Trust Gate tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.