Mnemom — Trust Ratings for AI Agents

preview_compose_protection_by_agent

Read-onlyIdempotent

Dry-run a protection card: shows the card that would result after merging with the platform, organization and team policies above it, plus any conflicts. Nothing is saved, and no publish grant is needed.

Input Schema

TableJSON Schema

Name	Required	Description
`mode`	Yes	Screening mode for the protection pipeline. Required. `off` disables screening; `observe` records only; `nudge` warns; `enforce` blocks.
`agent_id`	Yes	The agent this card belongs to (e.g. `smolt-abc123`). Identifier only — never place an API key, a secret, an email address, or any other personal data in this field.
`thresholds`	Yes	Risk-score cutoffs, each in [0, 1] and ordered warn ≤ quarantine ≤ block. Required. Send the full set: a publish replaces the agent's current card rather than patching it.
`card_version`	Yes	Card schema version. REQUIRED by the server-side validator. Current canonical value: `protection/2026-04-26`.
`screen_surfaces`	Yes	Which traffic surfaces are screened. Required, with all four flags set.
`trusted_sources`	Yes	Sources exempt from screening. Required, with all three lists present; send empty lists to trust nothing extra. Enumerate specific hosts — wildcards are rejected, and a server-side deny-list (public LLM/DNS endpoints, 0.0.0.0/0, ::/0, link-local, multicast) is always applied.
`protected_surface`	No	The assets and operations this agent must protect. Omit to accept the composed default (empty surface).

Output Schema

TableJSON Schema

Name	Required	Description
`ok`	Yes	True when composition succeeded (no blocking conflicts).
`summary`	Yes	One-line human-readable summary of composition status.
`full_report`	No	Optional pointer to the full /v1 conflict report (method + path).
`conflicts_count`	Yes	Total number of conflicts detected (0 = none).
`composition_valid`	Yes	True when the composed card is valid.

Schema Changelog

Changes observed during successful MCP inspections.

Changed6 schema fields changedSep 30, 2026

changedInput schema / properties / screen_surfaces / description

Previous value: -"Which traffic surfaces are screened. Omit to accept the composed defaults."New value: +"Which traffic surfaces are screened. Required, with all four flags set."

addedInput schema / properties / screen_surfaces / required

Added value: +[
+  "incoming",
+  "outgoing",
+  "tool_calls",
+  "tool_responses"
+]

changedInput schema / properties / thresholds / description

Previous value: -"Risk-score cutoffs, each in [0, 1] and ordered warn ≤ quarantine ≤ block. All three are required if this object is sent at all — omit the whole object to accept the composed defaults."New value: +"Risk-score cutoffs, each in [0, 1] and ordered warn ≤ quarantine ≤ block. Required. Send the full set: a publish replaces the agent's current card rather than patching it."

changedInput schema / properties / trusted_sources / description

Previous value: -"Sources exempt from screening. Enumerate specific hosts — wildcards are rejected, and a server-side deny-list (public LLM/DNS endpoints, 0.0.0.0/0, ::/0, link-local, multicast) is always applied."New value: +"Sources exempt from screening. Required, with all three lists present; send empty lists to trust nothing extra. Enumerate specific hosts — wildcards are rejected, and a server-side deny-list (public LLM/DNS endpoints, 0.0.0.0/0, ::/0, link-local, multicast) is always applied."

addedInput schema / properties / trusted_sources / required

Added value: +[
+  "domains",
+  "agent_ids",
+  "ip_ranges"
+]

changedInput schema / required

Previous value: -[
-  "agent_id",
-  "card_version",
-  "mode"
-]New value: +[
+  "agent_id",
+  "card_version",
+  "mode",
+  "thresholds",
+  "screen_surfaces",
+  "trusted_sources"
+]

Changed32 schema fields changedAug 5, 2026

removedInput schema / $defs

Removed value: -{
-  "CompositionMetadata": {
-    "description": "System-managed block describing which scope sources merged into the canonical card. Only returned when `?include_composition=true`.",
-    "properties": {
-      "canonical_id": {
-        "type": "string"
-      },
-      "composed_at": {
-        "format": "date-time",
-        "type": "string"
-      },
-      "exemptions_applied": {
-        "items": {
-          "type": "string"
-        },
-        "type": "array"
-      },
-      "scopes_applied": {
-        "items": {
-          "properties": {
-            "card_id": {
-              "type": "string"
-            },
-            "scope": {
-              "description": "`platform`, `org:<id>`, or `agent:<id>`.",
-              "type": "string"
-            },
-            "template_version": {
-              "type": "integer"
-            },
-            "version": {
-              "type": "integer"
-            }
-          },
-          "type": "object"
-        },
-        "type": "array"
-      },
-      "source_card_id": {
-        "type": "string"
-      },
-      "source_policy_id": {
-        "type": "string"
-      }
-    },
-    "type": "object"
-  },
-  "UnifiedProtectionCard": {
-    "description": "Unified protection card (ADR-037). Safe House thresholds + trusted-source policy for a single agent. Shape matches src/composition/types.ts::UnifiedProtectionCard (canonical) and what the runtime validator at src/composition/validate.ts accepts. The customer-facing docs at /concepts/protection-card and /specifications/protection-card-schema document this same shape.",
-    "properties": {
-      "_composition": {
-        "$ref": "#/$defs/CompositionMetadata"
-      },
-      "agent_id": {
-        "type": "string"
-      },
-      "card_id": {
-        "type": "string"
-      },
-      "card_version": {
-        "type": "string"
-      },
-      "content_hash": {
-        "description": "Response-only: content hash of the composed card (`sha256:<hex>`), injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-        "type": "string"
-      },
-      "expires_at": {
-        "format": "date-time",
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "extensions": {
-        "additionalProperties": true,
-        "description": "Free-form extension slot for non-canonical fields. Ignored by the composer; preserved on read for tooling that needs an audit-tail metadata bag.",
-        "type": "object"
-      },
-      "issued_at": {
-        "format": "date-time",
-        "type": "string"
-      },
-      "mode": {
-        "description": "Strictest-wins composition: enforce > nudge > observe > off.",
-        "enum": [
-          "off",
-          "observe",
-          "nudge",
-          "enforce"
-        ],
-        "type": "string"
-      },
-      "protected_surface": {
-        "description": "Org-declared protected surface policy (MNE-830). Strengthen-only UNION across platform → org → team → agent: each scope may add entries; none may remove. The composer always emits this block; callers omit it to inherit the composed floor. See ADR-037 §protected_surface.",
-        "properties": {
-          "assets": {
-            "description": "Protected assets. Intrinsic identity = `${kind}:${selector}` (normalized). Composer merges by identity, keeping the strictest entry per scope.",
-            "items": {
-              "properties": {
-                "kind": {
-                  "description": "Asset kind (e.g. `row`, `field`, `resource`, `table`).",
-                  "type": "string"
-                },
-                "label": {
-                  "description": "Human-facing display label (optional).",
-                  "type": "string"
-                },
-                "reason": {
-                  "description": "Why this asset is protected (optional).",
-                  "type": "string"
-                },
-                "selector": {
-                  "description": "Asset selector (e.g. `customer:critical-0000`, `replica_dsn`).",
-                  "type": "string"
-                },
-                "source_scope": {
-                  "description": "Composer-assigned provenance (`platform`, `org:<id>`, `team:<id>`, `agent:<id>`). Server-assigned — do not send on a PUT.",
-                  "type": "string"
-                }
-              },
-              "required": [
-                "kind",
-                "selector"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "escalation_required": {
-            "description": "Operations that require escalation before proceeding. Same intrinsic-identity + union rules as forbidden_operations (minus severity).",
-            "items": {
-              "properties": {
-                "applies_to": {
-                  "description": "Asset identities this escalation applies to. Empty/absent = GLOBAL.",
-                  "items": {
-                    "type": "string"
-                  },
-                  "type": "array"
-                },
-                "pattern": {
-                  "description": "Operation pattern requiring escalation.",
-                  "type": "string"
-                },
-                "reason": {
-                  "description": "Why escalation is required (optional).",
-                  "type": "string"
-                },
-                "source_scope": {
-                  "description": "Composer-assigned provenance. Server-assigned — do not send on a PUT.",
-                  "type": "string"
-                }
-              },
-              "required": [
-                "pattern"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "forbidden_operations": {
-            "description": "Operations that are unconditionally forbidden. Intrinsic identity = normalized `pattern`. Composer unions across scopes; on identity collision, severity → max.",
-            "items": {
-              "properties": {
-                "applies_to": {
-                  "description": "Asset identities (`${kind}:${selector}`) this operation applies to. Empty/absent means GLOBAL.",
-                  "items": {
-                    "type": "string"
-                  },
-                  "type": "array"
-                },
-                "pattern": {
-                  "description": "Operation pattern (e.g. `TRUNCATE`, `unscoped UPDATE/DELETE`, `exfiltrate:pii`).",
-                  "type": "string"
-                },
-                "reason": {
-                  "description": "Why this operation is forbidden (optional).",
-                  "type": "string"
-                },
-                "severity": {
-                  "description": "Severity level. Composer merges to strictest across scopes.",
-                  "enum": [
-                    "low",
-                    "medium",
-                    "high",
-                    "critical"
-                  ],
-                  "type": "string"
-                },
-                "source_scope": {
-                  "description": "Composer-assigned provenance. Server-assigned — do not send on a PUT.",
-                  "type": "string"
-                }
-              },
-              "required": [
-                "pattern"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          }
-        },
-        "type": "object"
-      },
-      "review": {
-        "description": "Review-hold policy (Safe House Review, Slice 2a — MNE-920 design). gate_on is the minimum verdict band per surface that escalates to a review-hold. Composition is strictest-wins; on_timeout defaults to 'reject' (fail-closed). reviewer.kind 'endpoint' is designed for MNE-1650 and not consumed yet.",
-        "properties": {
-          "enabled": {
-            "type": "boolean"
-          },
-          "gate_on": {
-            "properties": {
-              "incoming": {
-                "enum": [
-                  "off",
-                  "warn",
-                  "quarantine",
-                  "block"
-                ],
-                "type": "string"
-              },
-              "integrity": {
-                "enum": [
-                  "off",
-                  "review_needed",
-                  "boundary_violation"
-                ],
-                "type": "string"
-              },
-              "outgoing": {
-                "enum": [
-                  "off",
-                  "warn",
-                  "quarantine",
-                  "block"
-                ],
-                "type": "string"
-              },
-              "tool_calls": {
-                "enum": [
-                  "off",
-                  "warn",
-                  "quarantine",
-                  "block"
-                ],
-                "type": "string"
-              },
-              "tool_responses": {
-                "enum": [
-                  "off",
-                  "warn",
-                  "quarantine",
-                  "block"
-                ],
-                "type": "string"
-              }
-            },
-            "type": "object"
-          },
-          "notify": {
-            "properties": {
-              "sse": {
-                "type": "boolean"
-              },
-              "webhooks": {
-                "type": "boolean"
-              }
-            },
-            "type": "object"
-          },
-          "on_timeout": {
-            "enum": [
-              "reject",
-              "release"
-            ],
-            "type": "string"
-          },
-          "quarantine_notice": {
-            "maxLength": 2000,
-            "type": "string"
-          },
-          "reviewer": {
-            "properties": {
-              "endpoint_url": {
-                "format": "uri",
-                "type": "string"
-              },
-              "kind": {
-                "enum": [
-                  "builtin_opus",
-                  "endpoint"
-                ],
-                "type": "string"
-              }
-            },
-            "required": [
-              "kind"
-            ],
-            "type": "object"
-          },
-          "sla_seconds": {
-            "minimum": 1,
-            "type": "number"
-          }
-        },
-        "required": [
-          "enabled"
-        ],
-        "type": "object"
-      },
-      "screen_surfaces": {
-        "description": "Which request surfaces Safe House inspects. Composed across scopes by OR-per-field (any scope requiring inspection wins).",
-        "properties": {
-          "incoming": {
-            "description": "The user/principal prompt entering the agent.",
-            "type": "boolean"
-          },
-          "outgoing": {
-            "description": "The agent's response leaving the agent.",
-            "type": "boolean"
-          },
-          "tool_calls": {
-            "description": "Tool-use invocations the agent makes.",
-            "type": "boolean"
-          },
-          "tool_responses": {
-            "description": "Responses to tool calls returning to the agent.",
-            "type": "boolean"
-          }
-        },
-        "required": [
-          "incoming",
-          "outgoing",
-          "tool_calls",
-          "tool_responses"
-        ],
-        "type": "object"
-      },
-      "thresholds": {
-        "description": "Score bands. Must satisfy warn <= quarantine <= block; each value in [0, 1].",
-        "properties": {
-          "block": {
-            "maximum": 1,
-            "minimum": 0,
-            "type": "number"
-          },
-          "quarantine": {
-            "maximum": 1,
-            "minimum": 0,
-            "type": "number"
-          },
-          "warn": {
-            "maximum": 1,
-            "minimum": 0,
-            "type": "number"
-          }
-        },
-        "required": [
-          "warn",
-          "quarantine",
-          "block"
-        ],
-        "type": "object"
-      },
-      "trusted_sources": {
-        "description": "Sources for which detectors short-circuit (each match logged in the trace). Composed as platform->agent intersection (compliance ceiling) with org+agent union inside that ceiling — an agent cannot widen trust beyond what the platform allows.",
-        "properties": {
-          "agent_ids": {
-            "description": "Mnemom agent IDs (mnm-* / smolt-* prefixed).",
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "domains": {
-            "description": "DNS names or host:port entries.",
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "ip_ranges": {
-            "description": "IPv4 or IPv6 CIDR ranges.",
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          }
-        },
-        "required": [
-          "domains",
-          "agent_ids",
-          "ip_ranges"
-        ],
-        "type": "object"
-      },
-      "version": {
-        "description": "Response-only: monotonic card version, injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-        "type": "integer"
-      }
-    },
-    "required": [
-      "card_version",
-      "agent_id",
-      "mode",
-      "thresholds",
-      "screen_surfaces",
-      "trusted_sources"
-    ],
-    "type": "object"
-  }
-}

changedInput schema / properties / agent_id / description

Previous value: -"Agent identifier (e.g. smolt-abc123)"New value: +"The agent this card belongs to (e.g. `smolt-abc123`). Identifier only — never place an API key, a secret, an email address, or any other personal data in this field."

addedInput schema / properties / agent_id / maxLength
```
Added value: +64
```
addedInput schema / properties / agent_id / minLength
```
Added value: +3
```

addedInput schema / properties / agent_id / pattern

Added value: +"^[A-Za-z0-9][A-Za-z0-9_-]{1,62}[A-Za-z0-9]$"

removedInput schema / properties / body

Removed value: -{
-  "description": "Unified protection card (ADR-037). Safe House thresholds + trusted-source policy for a single agent. Shape matches src/composition/types.ts::UnifiedProtectionCard (canonical) and what the runtime validator at src/composition/validate.ts accepts. The customer-facing docs at /concepts/protection-card and /specifications/protection-card-schema document this same shape.",
-  "properties": {
-    "_composition": {
-      "$ref": "#/$defs/CompositionMetadata"
-    },
-    "agent_id": {
-      "type": "string"
-    },
-    "card_id": {
-      "type": "string"
-    },
-    "card_version": {
-      "type": "string"
-    },
-    "content_hash": {
-      "description": "Response-only: content hash of the composed card (`sha256:<hex>`), injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-      "type": "string"
-    },
-    "expires_at": {
-      "format": "date-time",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "extensions": {
-      "additionalProperties": true,
-      "description": "Free-form extension slot for non-canonical fields. Ignored by the composer; preserved on read for tooling that needs an audit-tail metadata bag.",
-      "type": "object"
-    },
-    "issued_at": {
-      "format": "date-time",
-      "type": "string"
-    },
-    "mode": {
-      "description": "Strictest-wins composition: enforce > nudge > observe > off.",
-      "enum": [
-        "off",
-        "observe",
-        "nudge",
-        "enforce"
-      ],
-      "type": "string"
-    },
-    "protected_surface": {
-      "description": "Org-declared protected surface policy (MNE-830). Strengthen-only UNION across platform → org → team → agent: each scope may add entries; none may remove. The composer always emits this block; callers omit it to inherit the composed floor. See ADR-037 §protected_surface.",
-      "properties": {
-        "assets": {
-          "description": "Protected assets. Intrinsic identity = `${kind}:${selector}` (normalized). Composer merges by identity, keeping the strictest entry per scope.",
-          "items": {
-            "properties": {
-              "kind": {
-                "description": "Asset kind (e.g. `row`, `field`, `resource`, `table`).",
-                "type": "string"
-              },
-              "label": {
-                "description": "Human-facing display label (optional).",
-                "type": "string"
-              },
-              "reason": {
-                "description": "Why this asset is protected (optional).",
-                "type": "string"
-              },
-              "selector": {
-                "description": "Asset selector (e.g. `customer:critical-0000`, `replica_dsn`).",
-                "type": "string"
-              },
-              "source_scope": {
-                "description": "Composer-assigned provenance (`platform`, `org:<id>`, `team:<id>`, `agent:<id>`). Server-assigned — do not send on a PUT.",
-                "type": "string"
-              }
-            },
-            "required": [
-              "kind",
-              "selector"
-            ],
-            "type": "object"
-          },
-          "type": "array"
-        },
-        "escalation_required": {
-          "description": "Operations that require escalation before proceeding. Same intrinsic-identity + union rules as forbidden_operations (minus severity).",
-          "items": {
-            "properties": {
-              "applies_to": {
-                "description": "Asset identities this escalation applies to. Empty/absent = GLOBAL.",
-                "items": {
-                  "type": "string"
-                },
-                "type": "array"
-              },
-              "pattern": {
-                "description": "Operation pattern requiring escalation.",
-                "type": "string"
-              },
-              "reason": {
-                "description": "Why escalation is required (optional).",
-                "type": "string"
-              },
-              "source_scope": {
-                "description": "Composer-assigned provenance. Server-assigned — do not send on a PUT.",
-                "type": "string"
-              }
-            },
-            "required": [
-              "pattern"
-            ],
-            "type": "object"
-          },
-          "type": "array"
-        },
-        "forbidden_operations": {
-          "description": "Operations that are unconditionally forbidden. Intrinsic identity = normalized `pattern`. Composer unions across scopes; on identity collision, severity → max.",
-          "items": {
-            "properties": {
-              "applies_to": {
-                "description": "Asset identities (`${kind}:${selector}`) this operation applies to. Empty/absent means GLOBAL.",
-                "items": {
-                  "type": "string"
-                },
-                "type": "array"
-              },
-              "pattern": {
-                "description": "Operation pattern (e.g. `TRUNCATE`, `unscoped UPDATE/DELETE`, `exfiltrate:pii`).",
-                "type": "string"
-              },
-              "reason": {
-                "description": "Why this operation is forbidden (optional).",
-                "type": "string"
-              },
-              "severity": {
-                "description": "Severity level. Composer merges to strictest across scopes.",
-                "enum": [
-                  "low",
-                  "medium",
-                  "high",
-                  "critical"
-                ],
-                "type": "string"
-              },
-              "source_scope": {
-                "description": "Composer-assigned provenance. Server-assigned — do not send on a PUT.",
-                "type": "string"
-              }
-            },
-            "required": [
-              "pattern"
-            ],
-            "type": "object"
-          },
-          "type": "array"
-        }
-      },
-      "type": "object"
-    },
-    "review": {
-      "description": "Review-hold policy (Safe House Review, Slice 2a — MNE-920 design). gate_on is the minimum verdict band per surface that escalates to a review-hold. Composition is strictest-wins; on_timeout defaults to 'reject' (fail-closed). reviewer.kind 'endpoint' is designed for MNE-1650 and not consumed yet.",
-      "properties": {
-        "enabled": {
-          "type": "boolean"
-        },
-        "gate_on": {
-          "properties": {
-            "incoming": {
-              "enum": [
-                "off",
-                "warn",
-                "quarantine",
-                "block"
-              ],
-              "type": "string"
-            },
-            "integrity": {
-              "enum": [
-                "off",
-                "review_needed",
-                "boundary_violation"
-              ],
-              "type": "string"
-            },
-            "outgoing": {
-              "enum": [
-                "off",
-                "warn",
-                "quarantine",
-                "block"
-              ],
-              "type": "string"
-            },
-            "tool_calls": {
-              "enum": [
-                "off",
-                "warn",
-                "quarantine",
-                "block"
-              ],
-              "type": "string"
-            },
-            "tool_responses": {
-              "enum": [
-                "off",
-                "warn",
-                "quarantine",
-                "block"
-              ],
-              "type": "string"
-            }
-          },
-          "type": "object"
-        },
-        "notify": {
-          "properties": {
-            "sse": {
-              "type": "boolean"
-            },
-            "webhooks": {
-              "type": "boolean"
-            }
-          },
-          "type": "object"
-        },
-        "on_timeout": {
-          "enum": [
-            "reject",
-            "release"
-          ],
-          "type": "string"
-        },
-        "quarantine_notice": {
-          "maxLength": 2000,
-          "type": "string"
-        },
-        "reviewer": {
-          "properties": {
-            "endpoint_url": {
-              "format": "uri",
-              "type": "string"
-            },
-            "kind": {
-              "enum": [
-                "builtin_opus",
-                "endpoint"
-              ],
-              "type": "string"
-            }
-          },
-          "required": [
-            "kind"
-          ],
-          "type": "object"
-        },
-        "sla_seconds": {
-          "minimum": 1,
-          "type": "number"
-        }
-      },
-      "required": [
-        "enabled"
-      ],
-      "type": "object"
-    },
-    "screen_surfaces": {
-      "description": "Which request surfaces Safe House inspects. Composed across scopes by OR-per-field (any scope requiring inspection wins).",
-      "properties": {
-        "incoming": {
-          "description": "The user/principal prompt entering the agent.",
-          "type": "boolean"
-        },
-        "outgoing": {
-          "description": "The agent's response leaving the agent.",
-          "type": "boolean"
-        },
-        "tool_calls": {
-          "description": "Tool-use invocations the agent makes.",
-          "type": "boolean"
-        },
-        "tool_responses": {
-          "description": "Responses to tool calls returning to the agent.",
-          "type": "boolean"
-        }
-      },
-      "required": [
-        "incoming",
-        "outgoing",
-        "tool_calls",
-        "tool_responses"
-      ],
-      "type": "object"
-    },
-    "thresholds": {
-      "description": "Score bands. Must satisfy warn <= quarantine <= block; each value in [0, 1].",
-      "properties": {
-        "block": {
-          "maximum": 1,
-          "minimum": 0,
-          "type": "number"
-        },
-        "quarantine": {
-          "maximum": 1,
-          "minimum": 0,
-          "type": "number"
-        },
-        "warn": {
-          "maximum": 1,
-          "minimum": 0,
-          "type": "number"
-        }
-      },
-      "required": [
-        "warn",
-        "quarantine",
-        "block"
-      ],
-      "type": "object"
-    },
-    "trusted_sources": {
-      "description": "Sources for which detectors short-circuit (each match logged in the trace). Composed as platform->agent intersection (compliance ceiling) with org+agent union inside that ceiling — an agent cannot widen trust beyond what the platform allows.",
-      "properties": {
-        "agent_ids": {
-          "description": "Mnemom agent IDs (mnm-* / smolt-* prefixed).",
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "domains": {
-          "description": "DNS names or host:port entries.",
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "ip_ranges": {
-          "description": "IPv4 or IPv6 CIDR ranges.",
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        }
-      },
-      "required": [
-        "domains",
-        "agent_ids",
-        "ip_ranges"
-      ],
-      "type": "object"
-    },
-    "version": {
-      "description": "Response-only: monotonic card version, injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-      "type": "integer"
-    }
-  },
-  "required": [
-    "card_version",
-    "agent_id",
-    "mode",
-    "thresholds",
-    "screen_surfaces",
-    "trusted_sources"
-  ],
-  "type": "object"
-}

addedInput schema / properties / card_version

Added value: +{
+  "description": "Card schema version. REQUIRED by the server-side validator. Current canonical value: `protection/2026-04-26`.",
+  "maxLength": 40,
+  "minLength": 3,
+  "pattern": "^[A-Za-z0-9][A-Za-z0-9._/-]{1,38}[A-Za-z0-9]$",
+  "type": "string"
+}

addedInput schema / properties / mode

Added value: +{
+  "description": "Screening mode for the protection pipeline. Required. `off` disables screening; `observe` records only; `nudge` warns; `enforce` blocks.",
+  "enum": [
+    "off",
+    "observe",
+    "nudge",
+    "enforce"
+  ],
+  "type": "string"
+}

addedInput schema / properties / protected_surface

Added value: +{
+  "additionalProperties": false,
+  "description": "The assets and operations this agent must protect. Omit to accept the composed default (empty surface).",
+  "properties": {
+    "assets": {
+      "description": "The assets under protection.",
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "kind": {
+            "description": "Asset class — e.g. \"repo\", \"database\", \"bucket\".",
+            "maxLength": 64,
+            "minLength": 1,
+            "type": "string"
+          },
+          "label": {
+            "description": "Short human-readable name for the asset.",
+            "maxLength": 120,
+            "minLength": 1,
+            "type": "string"
+          },
+          "reason": {
+            "description": "Why it is protected, in one short sentence. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          },
+          "selector": {
+            "description": "Which instance — e.g. \"mnemom/mnemom-api\". A resource identifier only: no credentials, no connection strings, no personal data.",
+            "maxLength": 256,
+            "minLength": 1,
+            "type": "string"
+          }
+        },
+        "required": [
+          "kind",
+          "selector"
+        ],
+        "type": "object"
+      },
+      "maxItems": 64,
+      "type": "array"
+    },
+    "escalation_required": {
+      "description": "Operations that require human approval before the agent may proceed.",
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "applies_to": {
+            "description": "Asset identities this entry applies to. Omit to apply to every protected asset.",
+            "items": {
+              "maxLength": 256,
+              "minLength": 1,
+              "type": "string"
+            },
+            "maxItems": 64,
+            "type": "array"
+          },
+          "pattern": {
+            "description": "Operation matcher — e.g. \"force_push\", \"drop_table*\". A short pattern, not a description.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          },
+          "reason": {
+            "description": "Why this entry exists, in one short sentence. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          }
+        },
+        "required": [
+          "pattern"
+        ],
+        "type": "object"
+      },
+      "maxItems": 64,
+      "type": "array"
+    },
+    "forbidden_operations": {
+      "description": "Operations the agent must never perform on the protected assets.",
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "applies_to": {
+            "description": "Asset identities this entry applies to. Omit to apply to every protected asset.",
+            "items": {
+              "maxLength": 256,
+              "minLength": 1,
+              "type": "string"
+            },
+            "maxItems": 64,
+            "type": "array"
+          },
+          "pattern": {
+            "description": "Operation matcher — e.g. \"force_push\", \"drop_table*\". A short pattern, not a description.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          },
+          "reason": {
+            "description": "Why this entry exists, in one short sentence. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          },
+          "severity": {
+            "description": "How serious a violation of this entry is.",
+            "enum": [
+              "low",
+              "medium",
+              "high",
+              "critical"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "pattern"
+        ],
+        "type": "object"
+      },
+      "maxItems": 64,
+      "type": "array"
+    }
+  },
+  "type": "object"
+}

addedInput schema / properties / screen_surfaces

Added value: +{
+  "additionalProperties": false,
+  "description": "Which traffic surfaces are screened. Omit to accept the composed defaults.",
+  "properties": {
+    "incoming": {
+      "description": "Screen prompts arriving at the agent.",
+      "type": "boolean"
+    },
+    "outgoing": {
+      "description": "Screen the agent's outbound messages.",
+      "type": "boolean"
+    },
+    "tool_calls": {
+      "description": "Screen the tool calls the agent makes.",
+      "type": "boolean"
+    },
+    "tool_responses": {
+      "description": "Screen tool responses returned to the agent.",
+      "type": "boolean"
+    }
+  },
+  "type": "object"
+}

addedInput schema / properties / thresholds

Added value: +{
+  "additionalProperties": false,
+  "description": "Risk-score cutoffs, each in [0, 1] and ordered warn ≤ quarantine ≤ block. All three are required if this object is sent at all — omit the whole object to accept the composed defaults.",
+  "properties": {
+    "block": {
+      "description": "Score at or above which the request is refused.",
+      "maximum": 1,
+      "minimum": 0,
+      "type": "number"
+    },
+    "quarantine": {
+      "description": "Score at or above which the request is held for review.",
+      "maximum": 1,
+      "minimum": 0,
+      "type": "number"
+    },
+    "warn": {
+      "description": "Score at or above which the request is flagged.",
+      "maximum": 1,
+      "minimum": 0,
+      "type": "number"
+    }
+  },
+  "required": [
+    "warn",
+    "quarantine",
+    "block"
+  ],
+  "type": "object"
+}

addedInput schema / properties / trusted_sources

Added value: +{
+  "additionalProperties": false,
+  "description": "Sources exempt from screening. Enumerate specific hosts — wildcards are rejected, and a server-side deny-list (public LLM/DNS endpoints, 0.0.0.0/0, ::/0, link-local, multicast) is always applied.",
+  "properties": {
+    "agent_ids": {
+      "description": "Trusted Mnemom agent IDs. Must be in canonical `mnm-*` form.",
+      "items": {
+        "maxLength": 64,
+        "minLength": 8,
+        "pattern": "^mnm-[A-Za-z0-9-]{4,}$",
+        "type": "string"
+      },
+      "maxItems": 64,
+      "type": "array"
+    },
+    "domains": {
+      "description": "Trusted DNS names, optionally with `:port`. No wildcards.",
+      "items": {
+        "maxLength": 253,
+        "minLength": 3,
+        "type": "string"
+      },
+      "maxItems": 64,
+      "type": "array"
+    },
+    "ip_ranges": {
+      "description": "Trusted CIDR ranges (e.g. `10.0.0.0/8`).",
+      "items": {
+        "maxLength": 43,
+        "minLength": 4,
+        "type": "string"
+      },
+      "maxItems": 64,
+      "type": "array"
+    }
+  },
+  "type": "object"
+}

changedInput schema / required

Previous value: -[
-  "agent_id"
-]New value: +[
+  "agent_id",
+  "card_version",
+  "mode"
+]

addedOutput schema / properties / composition_valid

Added value: +{
+  "description": "True when the composed card is valid.",
+  "type": "boolean"
+}

removedOutput schema / properties / conflicts

Removed value: -{
-  "additionalProperties": false,
-  "properties": {
-    "by_reason": {
-      "additionalProperties": {
-        "type": "integer"
-      },
-      "type": "object"
-    },
-    "not_shown": {
-      "description": "Conflicts beyond the inline top-N (present only when > top-N).",
-      "type": "integer"
-    },
-    "overrides": {
-      "items": {
-        "additionalProperties": false,
-        "properties": {
-          "field": {},
-          "from": {},
-          "reason": {},
-          "to": {},
-          "won_by": {}
-        },
-        "type": "object"
-      },
-      "type": "array"
-    },
-    "total": {
-      "type": "integer"
-    }
-  },
-  "required": [
-    "total",
-    "by_reason",
-    "overrides"
-  ],
-  "type": "object"
-}

addedOutput schema / properties / conflicts_count

Added value: +{
+  "description": "Total number of conflicts detected (0 = none).",
+  "type": "integer"
+}

removedOutput schema / properties / effective

Removed value: -{
-  "additionalProperties": false,
-  "properties": {
-    "mode": {
-      "type": "string"
-    },
-    "screen_surfaces": {},
-    "thresholds": {},
-    "trusted_sources_counts": {
-      "additionalProperties": false,
-      "properties": {
-        "agent_ids": {
-          "type": "integer"
-        },
-        "domains": {
-          "type": "integer"
-        },
-        "ip_ranges": {
-          "type": "integer"
-        }
-      },
-      "required": [
-        "domains",
-        "agent_ids",
-        "ip_ranges"
-      ],
-      "type": "object"
-    }
-  },
-  "required": [
-    "trusted_sources_counts"
-  ],
-  "type": "object"
-}

removedOutput schema / properties / full_report / additionalProperties
```
Removed value: -false
```

addedOutput schema / properties / full_report / description

Added value: +"Optional pointer to the full /v1 conflict report (method + path)."

addedOutput schema / properties / full_report / oneOf

Added value: +[
+  {
+    "type": "null"
+  },
+  {
+    "additionalProperties": false,
+    "properties": {
+      "method": {
+        "type": "string"
+      },
+      "note": {
+        "type": "string"
+      },
+      "path": {
+        "type": "string"
+      }
+    },
+    "required": [
+      "method",
+      "path",
+      "note"
+    ],
+    "type": "object"
+  }
+]

removedOutput schema / properties / full_report / properties

Removed value: -{
-  "method": {
-    "type": "string"
-  },
-  "note": {
-    "type": "string"
-  },
-  "path": {
-    "type": "string"
-  }
-}

removedOutput schema / properties / full_report / required
```
Removed value: -[
-  "method",
-  "path",
-  "note"
-]
```
removedOutput schema / properties / full_report / type
```
Removed value: -"object"
```

addedOutput schema / properties / ok / description

Added value: +"True when composition succeeded (no blocking conflicts)."

addedOutput schema / properties / summary / description

Added value: +"One-line human-readable summary of composition status."

removedOutput schema / properties / summary / enum
```
Removed value: -[
-  true
-]
```

changedOutput schema / properties / summary / type

Previous value: -"boolean"New value: +"string"

removedOutput schema / properties / tool

Removed value: -{
-  "enum": [
-    "preview_compose_protection_by_agent"
-  ],
-  "type": "string"
-}

removedOutput schema / properties / what_changed
```
Removed value: -{
-  "type": "string"
-}
```
removedOutput schema / properties / what_to_do_next
```
Removed value: -{
-  "type": "string"
-}
```
removedOutput schema / properties / what_would_break
```
Removed value: -{
-  "type": "string"
-}
```

changedOutput schema / required

Previous value: -[
-  "summary",
-  "tool",
-  "ok",
-  "effective",
-  "conflicts",
-  "what_changed",
-  "what_would_break",
-  "what_to_do_next",
-  "full_report"
-]New value: +[
+  "ok",
+  "composition_valid",
+  "conflicts_count",
+  "summary"
+]

Changed2 schema fields changedJul 10, 2026

addedInput schema / $defs / UnifiedProtectionCard / properties / review

Added value: +{
+  "description": "Review-hold policy (Safe House Review, Slice 2a — MNE-920 design). gate_on is the minimum verdict band per surface that escalates to a review-hold. Composition is strictest-wins; on_timeout defaults to 'reject' (fail-closed). reviewer.kind 'endpoint' is designed for MNE-1650 and not consumed yet.",
+  "properties": {
+    "enabled": {
+      "type": "boolean"
+    },
+    "gate_on": {
+      "properties": {
+        "incoming": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "integrity": {
+          "enum": [
+            "off",
+            "review_needed",
+            "boundary_violation"
+          ],
+          "type": "string"
+        },
+        "outgoing": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "tool_calls": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "tool_responses": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "notify": {
+      "properties": {
+        "sse": {
+          "type": "boolean"
+        },
+        "webhooks": {
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "on_timeout": {
+      "enum": [
+        "reject",
+        "release"
+      ],
+      "type": "string"
+    },
+    "quarantine_notice": {
+      "maxLength": 2000,
+      "type": "string"
+    },
+    "reviewer": {
+      "properties": {
+        "endpoint_url": {
+          "format": "uri",
+          "type": "string"
+        },
+        "kind": {
+          "enum": [
+            "builtin_opus",
+            "endpoint"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "kind"
+      ],
+      "type": "object"
+    },
+    "sla_seconds": {
+      "minimum": 1,
+      "type": "number"
+    }
+  },
+  "required": [
+    "enabled"
+  ],
+  "type": "object"
+}

addedInput schema / properties / body / properties / review

Added value: +{
+  "description": "Review-hold policy (Safe House Review, Slice 2a — MNE-920 design). gate_on is the minimum verdict band per surface that escalates to a review-hold. Composition is strictest-wins; on_timeout defaults to 'reject' (fail-closed). reviewer.kind 'endpoint' is designed for MNE-1650 and not consumed yet.",
+  "properties": {
+    "enabled": {
+      "type": "boolean"
+    },
+    "gate_on": {
+      "properties": {
+        "incoming": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "integrity": {
+          "enum": [
+            "off",
+            "review_needed",
+            "boundary_violation"
+          ],
+          "type": "string"
+        },
+        "outgoing": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "tool_calls": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "tool_responses": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "notify": {
+      "properties": {
+        "sse": {
+          "type": "boolean"
+        },
+        "webhooks": {
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "on_timeout": {
+      "enum": [
+        "reject",
+        "release"
+      ],
+      "type": "string"
+    },
+    "quarantine_notice": {
+      "maxLength": 2000,
+      "type": "string"
+    },
+    "reviewer": {
+      "properties": {
+        "endpoint_url": {
+          "format": "uri",
+          "type": "string"
+        },
+        "kind": {
+          "enum": [
+            "builtin_opus",
+            "endpoint"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "kind"
+      ],
+      "type": "object"
+    },
+    "sla_seconds": {
+      "minimum": 1,
+      "type": "number"
+    }
+  },
+  "required": [
+    "enabled"
+  ],
+  "type": "object"
+}

AddedJun 23, 2026

TDQS

A4.2/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish readOnly, idempotent and non-destructive, so the bar is lower, and the description still adds real value: nothing is persisted and no publish grant is needed, and the response surfaces conflicts. It doesn't state any auth/prerequisite constraints (e.g. whether the agent must already exist or be claimable), leaving one behavioral gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences with no waste; the dry-run framing and merge behavior are front-loaded, and the safety note (nothing saved, no grant needed) closes the thought efficiently.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, return-value explanation is not needed, and the description covers the essential behavioral facts: composed result, conflicts, no persistence. Minor gaps remain around prerequisites (whether the agent_id must reference an existing/claimable agent) that an agent would still have to infer.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% with unusually detailed field docs (enums, ordering constraint on thresholds, deny-listed sources), so the schema carries the parameter burden. The description adds only the high-level notion that a supplied card is merged with policies above it, and never names a parameter or its semantics, so baseline 3 is correct.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("Dry-run a protection card") and explains the output semantics: the composed card after merging platform, org, and team policies, plus conflicts. The "Nothing is saved" clause implicitly separates it from the write sibling put_protection_by_agent, and the protection-vs-alignment distinction from preview_compose_alignment_by_agent is obvious from the resource name.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear context for when this applies (dry-run, no publish grant required), which is exactly the situation where an agent should prefer this over the publish counterpart. It stops short of an explicit "use this before calling put_protection_by_agent" or any exclusion, so it lands just under the top tier.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Mnemom — Trust Ratings for AI Agents tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.