Durable commitment lifecycle, verification, governance and recovery layer for agentic commerce.
Scored across 26 tools
Most tools occupy clearly distinct lifecycle slots, and descriptions actively cross-reference siblings (get_commitment vs get_commitment_status vs list_commitments, etc.), which strongly aids selection. The remaining friction is the dense read cluster (get_commitment_status / get_commitment_history / get_recovery_status / get_pending_actions) and the easy-to-confuse pair get_evidence_verification (an action) vs verify_evidence (also an action) vs list_evidence.
Nearly everything follows a clean verb_noun snake_case pattern (create_commitment, accept_commitment, submit_evidence, raise_dispute, list_capabilities). Exceptions are minor: `ping` has no verb_noun form, and `get_evidence_verification` uses a get_ prefix for what is actually a verification operation, which slightly misleads.
26 tools sits just past the heavy threshold, and the domain (governance lifecycle + evidence + disputes + routing + discovery) is genuinely large, so most tools earn their place. Still, the several overlapping commitment-read tools could plausibly be consolidated into fewer calls, making the surface heavier than necessary.
The surface covers the full nonfinancial lifecycle: prepare -> accept -> create -> cancel/close/resume, plus history, recovery, evidence submit/verify/list, and dispute raise/resolve/list, with discovery and fee tools. Gaps are mostly deliberate (no settlement, escrow release, or refund tools; no commitment amendment/update) and are documented, but an agent needing a financial step or term amendment hits a dead end inside this tool set.
Accepts a signed preflight proposal with explicit buyer authorization and creates exactly ONE authenticated SAAX commitment. Revalidates the proposal (trusted provider key, profile version, expiry, combination, manifest digest), verifies the BUYER'S SIGNATURE over the exact proposal digest and terms digest, durably accepts once (single-writer store), and returns the operation + commitment. Creates NO payment authorization, custody funding, service execution, or release. A buyer acceptance is NOT a payment authorization or evaluator release verdict. Errors are typed DSC_* codes. Idempotent: same idempotencyKey + same request returns the same operation; same key + different request -> DSC_NONCE_CONFLICT; a single-use proposal cannot be re-accepted under a new key -> DSC_PROPOSAL_REUSED.
Inputs: proposal (required), acceptance (required), idempotencyKey (required).
Cancels a commitment when the caller (verified by EIP-712 proof) holds buyer or authority authorization with cancel scope. Terminal and nonfinancial � no payment, refund, or settlement is executed. Reconciles authoritative state first. Idempotent via idempotencyRef.
Inputs: role (required), proof (required), agentId (required), commitmentId (required), +2 more.
Closes a fulfilled commitment (settled -> finalized) when the caller (verified by EIP-712 proof) holds system or authority authorization. Nonfinancial � no settlement, escrow release, or refund is executed. Reconciles authoritative state first. Idempotent via idempotencyRef.
Inputs: role (required), proof (required), agentId (required), commitmentId (required), +1 more.
Creates a governed commitment between a buyer and a seller and persists it to the SAAX commitment store. The commitment is settlement-rail-neutral: settlementRail is metadata only (x402, mpp, ap2, acp, or unspecified) and is NEVER a prerequisite. Returns the new commitment id (saax_), createdAt, status, and the settlementRail. Call this BEFORE any payment flow to establish the governed commitment record. Once created, use get_commitment to read the manifest.
Inputs: terms (required), buyerId (required), sellerId (required), acceptanceCriteria (required), +3 more.
Validates an authority proof against a commitment. Requires an active SAAX Premium subscription. For evidence verification, use get_evidence_verification.
Inputs: proof (required), commitment (required), subscriptionEmail (required).
Returns the full commitment object for a given commitment ID — including terms, state, manifest hash, and evidence references. Call this when an agent needs the complete commitment record. For status-only polling, use get_commitment_status. For listing all commitments for a subscriber, use list_commitments.
Inputs: commitmentId (required).
Returns the append-only lifecycle event ledger for a commitment � every recorded transition with actor, authority reference, state version, and evidence reference. The caller must present an EIP-712 authority proof binding its identity to the commitment. Read-only; reconciles the authoritative commitment before returning. For a compact status, use get_commitment_status; for recovery guidance, use get_recovery_status.
Inputs: role (required), proof (required), agentId (required), commitmentId (required).
Returns only the current lifecycle state for a given commitment ID, plus the recommended next action for the calling agent. Call this before retrying any commitment that timed out — an unknown outcome is a status check, not another POST. The next_action field tells the agent whether to retry, poll, or stop. For the full commitment record, use get_commitment.
Inputs: commitmentId (required).
Verifies external evidence against a commitment's acceptance criteria. Requires an active SAAX Premium subscription. For authority proof validation, use get_authority_validation.
Inputs: evidence (required), criterion (required), commitment (required), subscriptionEmail (required).
Returns the lifecycle actions the caller (verified by EIP-712 proof) may currently perform on a commitment � derived from the canonical transition map, the caller's role, and the caller's durable authorization scope. Read-only. For full recovery context, use get_recovery_status.
Inputs: role (required), proof (required), agentId (required), commitmentId (required).
Returns the SAAX Protocol version, available capability count, and the URL to the specification. Call this when an agent needs a one-time overview of the protocol. For pricing, use get_routing_fee. For the full capability list, use list_capabilities. For a liveness check, use ping.
Inputs: no named parameters.
Returns the authoritative commitment state, the caller's authorization status (active/revoked/expired), whether the commitment is recoverable, and the caller's permitted next actions. Reconciles the durable commitment row and the caller's authorization record before returning. The caller must present an EIP-712 authority proof. Read-only. For the raw journal, use get_commitment_history; to continue a workflow, use resume_commitment.
Inputs: role (required), proof (required), agentId (required), commitmentId (required).
Returns the current routing fee schedule. Call this before initiating a routing request to determine the expected cost. For capability discovery, use list_capabilities. For protocol overview, use get_protocol_info.
Inputs: no named parameters.
Returns the detailed record for one supplier in the SAAX Router index: identifier, name, description, services (name/endpoint/version), owner and source provenance. Call this after route_request or list_capabilities to inspect a specific supplier before preparing a commitment. Read-only; exact supplier_id match only (no enumeration). A registry entry is not a guarantee of service quality or verification.
Inputs: supplier_id (required).
Returns the capabilities currently indexed by the SAAX Router, with supplier counts per capability. Call this to discover what can be routed. For pricing of a specific capability, use get_routing_fee. For protocol overview, use get_protocol_info.
Inputs: no named parameters.
Returns all commitments associated with a subscription email. Requires an active SAAX Premium subscription. Call this to retrieve commitment history for a subscriber. For a single commitment by ID, use get_commitment. For status-only checks, use get_commitment_status.
Inputs: subscriptionEmail (required).
Returns the durable dispute records for a commitment (dispute identifiers, status, resolution, attribution, timestamps). The caller must present an EIP-712 authority proof and hold an active authorization on the commitment. Commitment-scoped: callers with no authorization see nothing. Optional status filter. Read-only.
Inputs: proof (required), agentId (required), commitmentId (required), limit, +2 more.
Returns the durable evidence records for a commitment (stable identifiers, integrity references, submitter attribution, status, timestamps � never raw payload content). The caller must present an EIP-712 authority proof and hold an active authorization on the commitment. Commitment-scoped: callers with no authorization on the commitment see nothing. Optional status filter (submitted|verified|rejected|disputed). Read-only.
Inputs: proof (required), agentId (required), commitmentId (required), limit, +2 more.
Returns a lightweight liveness response. Call this to verify the endpoint is reachable. Do not use for discovery, capability listing, or pricing — use get_protocol_info, list_capabilities, or get_routing_fee instead.
Inputs: no named parameters.
Prepares a free, NONBINDING signed proposal (preflight) for a desired SAAX capability. Validates capability, schema/version/digest, units, and the exact supported network/asset/rail/mode combination; returns a provider-signed proposal binding the request digest and normalized terms. Creates NO agreement, payment, custody deposit, service execution, resource reservation, or spending authority. A provider signature is NOT buyer acceptance. No preflight fee. Errors are typed DSC_* codes.
Inputs: units (required), schema (required), issuedAt (required), capability (required), +5 more.
Raises a durable dispute on a commitment and transitions it to the disputed state. The caller must present an EIP-712 authority proof and hold an unrevoked, unexpired authorization on the commitment (verified in-transaction). Disputes may only be raised from evidence_submitted or fulfilled states per the canonical lifecycle. Dispute resolution NEVER triggers a financial transfer. Idempotent per idempotencyRef.
Inputs: proof (required), reason (required), agentId (required), commitmentId (required), +3 more.
Records an evaluator decision on an open dispute and transitions the commitment to the canonical nonfinancial outcome (continue|rework|satisfied|against). The caller must present an EIP-712 authority proof and hold an unrevoked, unexpired EVALUATOR authorization on the commitment (verified in-transaction). Resolution NEVER executes a financial transfer or settlement. Idempotent per idempotencyRef.
Inputs: proof (required), agentId (required), outcome (required), disputeId (required), +2 more.
Lets an independently authorized replacement agent continue a commitment. Reconciles the authoritative state, verifies the caller's EIP-712 authority proof, and executes the requested nonfinancial transition through the canonical transition engine. The replacement agent must hold its OWN durable authorization (no automatic inheritance). Duplicate requests are idempotent. Financial transitions (settle/finalize with settlement, escrow release, refunds) are NOT exposed. For inspection first, use get_recovery_status or get_pending_actions.
Inputs: role (required), proof (required), action (required), agentId (required), +5 more.
Submits a capability request and returns ranked supplier matches. Commitment creation with payment runs through the HTTP POST /route endpoint, not this tool. Use list_capabilities first to discover available capabilities. For commitment lookup after routing, use get_commitment.
Inputs: capability (required), budget, deadline.
Durably submits evidence for a commitment. The caller must present an EIP-712 authority proof; the recovered signer must hold an unrevoked, unexpired provider or buyer authorization on the commitment (verified in-transaction against the durable registry). The evidence envelope is validated for structure and size, bound to the commitment and optional acceptance criterion, and persisted with the verified submitter attribution and an integrity payload hash. Idempotent per idempotencyRef: a replay returns the original record; reuse with a materially different payload is rejected. Submission does NOT transition the commitment state and does NOT trigger settlement, escrow release, or finalization � those require separate authorized lifecycle actions.
Inputs: proof (required), agentId (required), evidence (required), commitmentId (required), +2 more.
Sets the verification status of a submitted evidence record to verified or rejected. The caller must present an EIP-712 authority proof and hold an unrevoked, unexpired EVALUATOR authorization on the commitment (verified in-transaction). Idempotent per verdict: re-verifying with the same verdict replays the original outcome; changing a verified record to rejected (or vice versa) is rejected without a dispute path. Does NOT auto-transition the commitment state � the caller must perform the authorized lifecycle transition separately. Rejection requires a reason.
Inputs: proof (required), agentId (required), verdict (required), evidenceId (required), +2 more.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Agent-native MCP for governed commerce, x402 payments, paid capabilities, and verifiable receipts.
Deterministic, machine-verifiable dispute resolution for A2A escrows.
Machine-native capabilities with explicit contracts and machine-readable commerce.
Agent routing, safety preflight, execution receipts, best execution and verified outcomes.
Add one secure layer between your agents and this server.
