MONARK

gate

Coverage-gated decision from the real HIKAE L3 policy (commit/defer/abstain) over a caller-carried authorization budget B_t. Dispatches on task_class. The class 'btc-dir-15m' is retired and answers a named refusal. For 'cascade-liquidable-24h' no cascade calibration is committed; the gate abstains (under_calib) on this class. For 'stable-run-velocity-24h' (Narabi: a redemption-flow velocity forecast) the gate holds a committed stable-run velocity calibration for the USDe synthetic-dollar-whitelisted-redeem population (key narabi:persistence-v2@eip155:1/erc20:0x4c9edd5852cd905f086c759e8383e09bff1e68b3) over calm-window redemption flow; coverage is stated under the split-conformal bound of Barber, Candes, Ramdas and Tibshirani 2023 (Thm 2, unit weights): at least 1 − α minus the average total-variation gap between calibration windows and the next one; that gap is not estimated here and the calibration is measured non-stationary across half-years, so 1 − α is the coverage only if that gap is zero (exchangeability), which is not assumed here; no coverage is measured; on that key it requires alpha = 0.1, nMin = 50; for any other population, no stable-run velocity calibration is committed for this population; the gate abstains (under_calib). For 'liquidation-eligible-coverage' (Ukemi: a per-account liquidable-amount class, class A only) the served region is a conformal upper bound on the liquidable amount for the calibrated class; the lower edge is 0 by construction, not a calibrated bound; abstains (under_calib) outside it; this class requires alpha = 0.01, nMin = 100; calibrated on one recorded episode; no coverage is claimed on any other event; the H-3 exchangeability check is a report, a YES licenses nothing more; the bound holds only if yhat was produced by the frozen close-factor rule on a mono-collateral WETH account at the first crossing, which the gate does not check. The 32 kata classes {btc,eth,bnb,sol}-{dir,range,mae-down,mae-up}-{1h,4h} are served from their policy tables, which hold no committed calibration row: every well-formed kata call abstains with no region (under_calib, or non_evaluable on a dir lean of exactly 0), and no kata class has an attestation subject. A kata call carries a predictor_id of the form kata:<kataId>@<venue>/<SYMBOL>/<h> (no bucket, the class horizon), a features_digest, alpha = 0.45, nMin = 6 on dir classes and alpha = 0.01, nMin = 299 on the others, tau at most 1 on dir classes, and a produced_at on the class horizon grid, received at most 300 s after it; the full request rules are in section 9 of the contract 1.1.0 specification. When the caller instead supplies a calibration (its own nonconformity scores plus a mode: interval ⇒ region [yhat - q̂, yhat + q̂], or set ⇒ a conformal set over caller candidates), the gate conformalizes against THOSE caller-supplied scores (BYO): split-conformal quantile at miscoverage α over caller-supplied nonconformity scores. MONARK does not see, store, or verify the caller's data or model, and does not validate that the supplied numbers are nonconformity scores of any model. Marginal 1−α coverage holds ONLY for future points exchangeable with the supplied scores; non-exchangeable data (e.g. distribution-shifted or time-ordered) voids it. Never a probability of being right. A caller-carried attested price must declare a subject consistent with the committed task class (exact committed-URL membership; BYO classes do not accept attested in P1); the attestation is carried by the caller and is not re-verified at call time (the verifier is not executed here); attest only projects the committed witness — verify a caller-carried attestation offline with the Shōgen verifier; no temporal binding in P1. No served class has a committed attestation subject (the retired 'btc-dir-15m' held the only one), so any attested is refused. The gate only emits a decision; it never calls the named tool.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`params`	Yes
`attested`	No
`prediction`	Yes

Output Schema

TableJSON Schema

Name	Required	Description	Default
`tool`	Yes
`allow`	Yes
`action`	Yes
`intent`	Yes
`reason`	Yes
`verdict`	Yes
`request_sha256`	Yes
`schema_version`	Yes
`remaining_budget`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

Changed20 schema fields changedOct 6, 2026

changedOutput schema / properties / reason / enum

Previous value: -[
-  "covered",
-  "set_too_large",
-  "interval_too_wide",
-  "intent_not_in_region",
-  "under_calib",
-  "no_label_schema",
-  "budget_exhausted",
-  "clock_expired",
-  "upstream_timeout",
-  "attestation_absent",
-  "attestation_refused",
-  "binding_broken",
-  "non_evaluable"
-]New value: +[
+  "covered",
+  "set_too_large",
+  "interval_too_wide",
+  "intent_not_in_region",
+  "under_calib",
+  "no_label_schema",
+  "budget_exhausted",
+  "clock_expired",
+  "upstream_timeout",
+  "attestation_absent",
+  "attestation_refused",
+  "binding_broken",
+  "non_evaluable",
+  "calib_silence",
+  "calib_vetoed",
+  "calib_retired",
+  "out_of_support",
+  "region_degenerate"
+]

addedOutput schema / properties / request_sha256

Added value: +{
+  "pattern": "^[0-9a-f]{64}$",
+  "type": "string"
+}

addedOutput schema / properties / schema_version / const
```
Added value: +"1.1.0"
```
removedOutput schema / properties / schema_version / pattern
```
Removed value: -"^\\d+\\.\\d+\\.\\d+$"
```
removedOutput schema / properties / schema_version / type
```
Removed value: -"string"
```

removedOutput schema / properties / verdict / properties / calib_digest

Removed value: -{
-  "pattern": "^[0-9a-f]{64}$",
-  "type": "string"
-}

addedOutput schema / properties / verdict / properties / cell_key

Added value: +{
+  "minLength": 1,
+  "pattern": "^[ -~]+$",
+  "type": [
+    "string",
+    "null"
+  ]
+}

changedOutput schema / properties / verdict / properties / method / enum

Previous value: -[
-  "split",
-  "hac-cp"
-]New value: +[
+  "split",
+  "hac-cp",
+  "risk-control"
+]

addedOutput schema / properties / verdict / properties / policy_row_sha256

Added value: +{
+  "pattern": "^[0-9a-f]{64}$",
+  "type": [
+    "string",
+    "null"
+  ]
+}

addedOutput schema / properties / verdict / properties / policy_table_sha256

Added value: +{
+  "pattern": "^[0-9a-f]{64}$",
+  "type": [
+    "string",
+    "null"
+  ]
+}

addedOutput schema / properties / verdict / properties / qhat_unit

Added value: +{
+  "enum": [
+    "label",
+    "scale",
+    "score"
+  ]
+}

changedOutput schema / properties / verdict / properties / reason / enum

Previous value: -[
-  "covered",
-  "set_too_large",
-  "interval_too_wide",
-  "intent_not_in_region",
-  "under_calib",
-  "no_label_schema",
-  "budget_exhausted",
-  "clock_expired",
-  "upstream_timeout",
-  "attestation_absent",
-  "attestation_refused",
-  "binding_broken",
-  "non_evaluable"
-]New value: +[
+  "covered",
+  "set_too_large",
+  "interval_too_wide",
+  "intent_not_in_region",
+  "under_calib",
+  "no_label_schema",
+  "budget_exhausted",
+  "clock_expired",
+  "upstream_timeout",
+  "attestation_absent",
+  "attestation_refused",
+  "binding_broken",
+  "non_evaluable",
+  "calib_silence",
+  "calib_vetoed",
+  "calib_retired",
+  "out_of_support",
+  "region_degenerate"
+]

changedOutput schema / properties / verdict / properties / region / oneOf

Previous value: -[
-  {
-    "additionalProperties": false,
-    "properties": {
-      "kind": {
-        "const": "set"
-      },
-      "label_schema": {
-        "minLength": 1,
-        "pattern": "^[ -~]+$",
-        "type": "string"
-      },
-      "labels": {
-        "items": {
-          "pattern": "^[ -~]+$",
-          "type": "string"
-        },
-        "type": "array"
-      }
-    },
-    "required": [
-      "kind",
-      "labels",
-      "label_schema"
-    ],
-    "type": "object"
-  },
-  {
-    "additionalProperties": false,
-    "properties": {
-      "hi": {
-        "type": "number"
-      },
-      "kind": {
-        "const": "interval"
-      },
-      "lo": {
-        "type": "number"
-      }
-    },
-    "required": [
-      "kind",
-      "lo",
-      "hi"
-    ],
-    "type": "object"
-  }
-]New value: +[
+  {
+    "additionalProperties": false,
+    "properties": {
+      "kind": {
+        "const": "set"
+      },
+      "label_schema": {
+        "minLength": 1,
+        "pattern": "^[ -~]+$",
+        "type": "string"
+      },
+      "labels": {
+        "items": {
+          "pattern": "^[ -~]+$",
+          "type": "string"
+        },
+        "type": "array"
+      }
+    },
+    "required": [
+      "kind",
+      "labels",
+      "label_schema"
+    ],
+    "type": "object"
+  },
+  {
+    "additionalProperties": false,
+    "properties": {
+      "hi": {
+        "type": "number"
+      },
+      "kind": {
+        "const": "interval"
+      },
+      "lo": {
+        "type": "number"
+      }
+    },
+    "required": [
+      "kind",
+      "lo",
+      "hi"
+    ],
+    "type": "object"
+  },
+  {
+    "type": "null"
+  }
+]

addedOutput schema / properties / verdict / properties / scale

Added value: +{
+  "type": [
+    "number",
+    "null"
+  ]
+}

addedOutput schema / properties / verdict / properties / schema_version / const
```
Added value: +"1.1.0"
```
removedOutput schema / properties / verdict / properties / schema_version / pattern
```
Removed value: -"^\\d+\\.\\d+\\.\\d+$"
```
removedOutput schema / properties / verdict / properties / schema_version / type
```
Removed value: -"string"
```

addedOutput schema / properties / verdict / properties / scores_sha256

Added value: +{
+  "pattern": "^[0-9a-f]{64}$",
+  "type": "string"
+}

changedOutput schema / properties / verdict / required

Previous value: -[
-  "schema_version",
-  "task_class",
-  "method",
-  "alpha",
-  "n_calib",
-  "region",
-  "qhat",
-  "abstain",
-  "reason",
-  "residual",
-  "calib_digest",
-  "produced_at"
-]New value: +[
+  "schema_version",
+  "task_class",
+  "method",
+  "alpha",
+  "n_calib",
+  "region",
+  "qhat",
+  "abstain",
+  "reason",
+  "qhat_unit",
+  "scale",
+  "residual",
+  "scores_sha256",
+  "cell_key",
+  "policy_row_sha256",
+  "policy_table_sha256",
+  "produced_at"
+]

changedOutput schema / required

Previous value: -[
-  "schema_version",
-  "action",
-  "allow",
-  "tool",
-  "intent",
-  "verdict",
-  "remaining_budget",
-  "reason"
-]New value: +[
+  "schema_version",
+  "action",
+  "allow",
+  "tool",
+  "intent",
+  "verdict",
+  "remaining_budget",
+  "request_sha256",
+  "reason"
+]

Changed1 schema field changedSep 23, 2026

addedInput schema / properties / attested

Added value: +{
+  "additionalProperties": false,
+  "properties": {
+    "attestor": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "identity": {
+            "minLength": 1,
+            "pattern": "^[ -~]+$",
+            "type": "string"
+          },
+          "key": {
+            "pattern": "^([0-9a-f]{2})+$",
+            "type": "string"
+          }
+        },
+        "required": [
+          "identity",
+          "key"
+        ],
+        "type": "object"
+      },
+      "minItems": 1,
+      "type": "array",
+      "uniqueItems": true
+    },
+    "observed_at": {
+      "additionalProperties": false,
+      "properties": {
+        "clock": {
+          "minLength": 1,
+          "pattern": "^[ -~]+$",
+          "type": "string"
+        },
+        "instant": {
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "required": [
+        "clock",
+        "instant"
+      ],
+      "type": "object"
+    },
+    "octets_recalcules": {
+      "type": "boolean"
+    },
+    "residual": {
+      "items": {
+        "minLength": 1,
+        "pattern": "^[ -~]+$",
+        "type": "string"
+      },
+      "minItems": 1,
+      "type": "array",
+      "uniqueItems": true
+    },
+    "schema_version": {
+      "pattern": "^\\d+\\.\\d+\\.\\d+$",
+      "type": "string"
+    },
+    "sens_emis_digest": {
+      "pattern": "^[0-9a-f]{64}$",
+      "type": "string"
+    },
+    "subject": {
+      "minLength": 1,
+      "pattern": "^[ -~]+$",
+      "type": "string"
+    },
+    "transport": {
+      "minLength": 1,
+      "pattern": "^[ -~]+$",
+      "type": "string"
+    },
+    "utterance": {
+      "additionalProperties": false,
+      "properties": {
+        "bytes": {
+          "pattern": "^([0-9a-f]{2})*$",
+          "type": "string"
+        },
+        "hash": {
+          "pattern": "^[0-9a-f]{64}$",
+          "type": "string"
+        }
+      },
+      "required": [
+        "hash"
+      ],
+      "type": "object"
+    },
+    "verifier_revision": {
+      "minLength": 1,
+      "pattern": "^[ -~]+$",
+      "type": "string"
+    }
+  },
+  "required": [
+    "schema_version",
+    "subject",
+    "attestor",
+    "residual",
+    "transport",
+    "utterance",
+    "observed_at",
+    "octets_recalcules",
+    "verifier_revision"
+  ],
+  "type": "object"
+}

First observedSep 18, 2026

TDQS

A3.8/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does disclose a lot: it never stores/verifies caller data, never re-verifies attestations, abstains under_calib, coverage voids under non-exchangeability, and never invokes the named tool. The self-caveating coverage language ('no coverage is measured', 'never a probability of being right') is unusually honest. Minor deduction for the sheer volume that makes the key behavioral guarantees hard to isolate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single unbroken wall of text mixing purpose, per-class policy, BYO rules, attestation rules, and statistical caveats. It is front-loaded on the core purpose, but sentences are long, redundant, and hard to navigate; the structure actively impedes extraction of the decision rules.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the very rich nested schema and an output schema (so return values need not be explained), the description is substantively complete: it covers class dispatch, refusal modes, BYO calibration, and attestation constraints. It is dense rather than missing content.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema carries no computed description coverage, so the description must compensate, and it does add real meaning: fixed alpha/nMin per class (e.g. 0.1/50, 0.01/100), tau <= 1 on dir classes, predictor_id format, produced_at grid and 300s receipt bound. It does not explain remainingBudget/bFloor/clockOpen semantics, leaving some required params unclarified.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening states a specific verb+resource: a coverage-gated decision (commit/defer/abstain) over a caller-carried budget, dispatching on task_class. It also distinguishes itself from the sibling 'attest' ('only emits a decision; it never calls the named tool'). However, the purpose is buried under dense jargon and per-class policy detail, so an agent must work to extract the core function.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives extensive conditional routing: which classes abstain (under_calib), which are retired, when BYO calibration activates, and that 'attest' handles offline attestation verification. What is missing is a crisp statement of when an agent should call gate versus calibrate or cascade; the guidance is embedded in class-by-class prose rather than framed as selection criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All MONARK tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.