bernstein-mcp

Verify a run receipt

verify_receipt

Recompute every hash chain a bernstein run receipt embeds (journal, lineage spine, optional audit range), rebuild the signed subject from the recomputed heads, and check the Ed25519 signature with the key the receipt carries. Needs no secret and reads nothing but the receipt. Returns the verdict, the first failing check, one line per check, and the same verdict as a DSSE envelope signed by this verifier's Ed25519 key (public key at keys_url) so the outcome can be kept and re-checked offline.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`receipt`	Yes	The run receipt: pass the file contents as a string for byte-exact verification, or the parsed object.

Output Schema

TableJSON Schema

Name	Required	Description
`note`	Yes
`checks`	Yes
`summary`	Yes
`verdict`	Yes
`keys_url`	Yes
`verify_url`	Yes
`failing_check`	Yes
`divergent_step`	Yes
`receipt_sha256`	Yes
`signed_verdict`	Yes	DSSE envelope over the verdict statement (JCS JSON in payload), Ed25519 over the DSSE PAE.

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedSep 18, 2026

changedOutput schema / properties / summary / anyOf

Previous value: -[
-  {
-    "additionalProperties": false,
-    "properties": {
-      "audit_events": {
-        "anyOf": [
-          {
-            "maximum": 9007199254740991,
-            "minimum": -9007199254740991,
-            "type": "integer"
-          },
-          {
-            "type": "null"
-          }
-        ]
-      },
-      "hash_profile": {
-        "type": "string"
-      },
-      "journal_events": {
-        "maximum": 9007199254740991,
-        "minimum": -9007199254740991,
-        "type": "integer"
-      },
-      "key_id": {
-        "type": "string"
-      },
-      "run_id": {
-        "type": "string"
-      },
-      "schema_version": {
-        "type": "string"
-      },
-      "spine_entries": {
-        "maximum": 9007199254740991,
-        "minimum": -9007199254740991,
-        "type": "integer"
-      }
-    },
-    "required": [
-      "run_id",
-      "schema_version",
-      "hash_profile",
-      "journal_events",
-      "spine_entries",
-      "audit_events",
-      "key_id"
-    ],
-    "type": "object"
-  },
-  {
-    "type": "null"
-  }
-]New value: +[
+  {
+    "additionalProperties": false,
+    "properties": {
+      "audit_events": {
+        "anyOf": [
+          {
+            "maximum": 9007199254740991,
+            "minimum": -9007199254740991,
+            "type": "integer"
+          },
+          {
+            "type": "null"
+          }
+        ]
+      },
+      "hash_profile": {
+        "type": "string"
+      },
+      "journal_events": {
+        "maximum": 9007199254740991,
+        "minimum": -9007199254740991,
+        "type": "integer"
+      },
+      "key_id": {
+        "type": "string"
+      },
+      "producer": {
+        "type": [
+          "string",
+          "null"
+        ]
+      },
+      "run_id": {
+        "type": "string"
+      },
+      "schema_version": {
+        "type": "string"
+      },
+      "spine_entries": {
+        "maximum": 9007199254740991,
+        "minimum": -9007199254740991,
+        "type": "integer"
+      },
+      "tool_calls": {
+        "anyOf": [
+          {
+            "maximum": 9007199254740991,
+            "minimum": -9007199254740991,
+            "type": "integer"
+          },
+          {
+            "type": "null"
+          }
+        ]
+      }
+    },
+    "required": [
+      "run_id",
+      "schema_version",
+      "hash_profile",
+      "journal_events",
+      "spine_entries",
+      "audit_events",
+      "key_id",
+      "producer",
+      "tool_calls"
+    ],
+    "type": "object"
+  },
+  {
+    "type": "null"
+  }
+]

First observedSep 18, 2026

TDQS

A4.7/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full disclosure burden and does so thoroughly: it states the operation is read-only, requires no secret, returns the verdict plus first failing check and per-check lines, and wraps the verdict in a DSSE envelope. This gives the agent a complete behavioral model.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two dense sentences front-load the verification mechanism, then the input/output behavior. Every clause contributes either a behavioral guarantee, a return-value detail, or a usage constraint, with no filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter tool with an output schema, the description covers the verification procedure, input formats, cryptographic behavior, output contents, and offline re-checking use case. Nothing material is missing for an agent to select and invoke this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already covers the 'receipt' parameter at 100%, but the description adds genuinely useful semantics: passing file contents as a string gives byte-exact verification, while passing the parsed object is also acceptable. This goes beyond the schema without needing to repeat basic type information.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb ('verify'), a specific resource ('a run receipt'), and precisely what verification means: recomputing hash chains, rebuilding the signed subject, and checking the Ed25519 signature. This clearly distinguishes it from sibling tools like explain_receipt or verify_chain.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context for when to use this tool: it needs no secret, reads nothing but the receipt, and produces an offline-recheckable signed verdict. However, it does not explicitly name alternatives or state when not to use it, so it stops short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All bernstein-mcp tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.