@cubiczan/chp-mcp
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@@cubiczan/chp-mcpCheck if a $300 ETH long with 0.9 confidence passes the spend gate policy."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
@cubiczan/chp-mcp
One-command MCP install for CHP Profile B spend / capital gates and tool-approval receipts (an allowlist is not authorization), plus a structured deny ledger and receipt-gated finance tools.
Wraps @cubiczan/chp so Cursor,
Claude Code, or any MCP client can call evaluate_spend_gate without vendoring
protocol code. Engine digests match the normative golden vectors
(Profile B 30/30).
How the pieces fit
MCP client (Cursor / Claude / …)
│ tools/call
▼
┌───────────────────────────┐
│ MCP server (transport) │ ← you are here (@cubiczan/chp-mcp)
│ evaluate_spend_gate │
│ approve_spend │
│ evaluate_tool_approval │ allowlist ≠ authorization
│ issue_approval_receipt │
│ authorize_tool_call │
│ request_authorization │ finance-tool receipt / HITL / deny
│ place_equity_order │ scoped + receipt-gated (synthetic)
│ wire_treasury_transfer │
│ rebalance_portfolio │
│ inspect_audit_ledger │ CHP-signed deny / authorize / execute
│ chp_content_hash │
└─────────────┬─────────────┘
│ depends on
▼
┌───────────────────────────┐
│ Published CHP packages │
│ npm: @cubiczan/chp (Profile B)
│ PyPI: consensus-hardening-protocol (Profile A)
└───────────────────────────┘For AGENTS.md + skills + Profile A decision_gate / decision_adversary, use
agent-conductor instead.
Related MCP server: protect-mcp
Install
npm install -g @cubiczan/chp-mcp
# or one-shot
npx -y @cubiczan/chp-mcpCursor / Claude Desktop
{
"mcpServers": {
"chp": {
"command": "npx",
"args": ["-y", "@cubiczan/chp-mcp"]
}
}
}Claude Code
claude mcp add chp -- npx -y @cubiczan/chp-mcpTools
Tool | Maps to | Purpose |
|
| LOCKED / HITL_REQUIRED / BLOCKED + claims + content hash. |
|
| Human lock when HITL_REQUIRED (cannot override hard fails). Optional |
|
| Allowlist is a pre-filter; host-bound fields merge into |
|
| Human allow/deny → HMAC-signed receipt + decision log |
|
| Consume a receipt; deny on drift, host-bound override, expiry, replay, or a bad MAC |
| runtime | Mint a receipt bound to a scoped reference tool, or return HITL / structured deny |
| reference | Synthetic equity order — scope |
| reference | Synthetic treasury wire — scope |
| reference | Synthetic rebalance — scope |
| ledger | Trailing CHP-chained deny / authorize / execute entries |
|
| Float-aware canonical SHA-256 |
| — | Server + protocol versions + deny reason codes + receipt schema |
Example — evaluate a spend
// tools/call evaluate_spend_gate
{
"action": { "action": "LONG", "asset": "ETH", "notional": 300, "confidence": 0.9 },
"policy": {
"max_notional": 500,
"daily_cap": 2500,
"hitl_threshold": 250,
"min_confidence": 0.55,
"allowed_actions": ["LONG", "SHORT"]
}
}Cookbook — Claude / Cursor tool approval
Managed MCP allowlists (Cursor mcpServers, Claude Desktop, Claude Code)
only answer “is this tool name installed?”. They do not bind tenant,
arguments, risk, or a human decision. This server treats that gap as a
hard deny unless a signed approval receipt still matches the call
that is about to run.
Receipts are HMAC-SHA256 over CHP canonical JSON
(the same payload discipline as Profile B contentHash / audit-ledger
sig). The MAC covers:
Field | Role |
| Human who allowed or denied |
| Concrete tool name (no |
| Tenant / resource binding (no |
|
|
| Policy the human saw |
| Policy risk for that tool |
| Lifetime |
|
|
| Single-use; replay denies |
| HMAC-SHA256 hex |
Set CHP_RECEIPT_KEY (or AUDIT_LEDGER_KEY) in the MCP server env.
Without it the process falls back to a documented insecure default —
fine for the local cookbook, not for production.
Example policy: examples/tool-approval-policy.json.
stripe.create_charge is on the allowlist and still cannot run
without a receipt bound to acct_live_acme and the exact charge args.
Host-injected tenant/index bindings use
examples/host-injected-policy.json
(see the host-injected args cookbook below).
{
"mcpServers": {
"chp": {
"command": "npx",
"args": ["-y", "@cubiczan/chp-mcp"],
"env": { "CHP_RECEIPT_KEY": "replace-me" }
}
}
}1. Allowlist alone — denied
Claude/Cursor has stripe.create_charge enabled. That is not a grant.
// tools/call evaluate_tool_approval
{
"call": {
"tool": "stripe.create_charge",
"resource": "acct_live_acme",
"arguments": { "amount": 2500, "currency": "usd", "customer": "cus_123" }
},
"policy": { "$ref": "examples/tool-approval-policy.json" }
}Result: RECEIPT_REQUIRED, deny_code: "allowlist_is_not_authorization".
Calling authorize_tool_call with the same payload and no receipt
returns DENIED / allowlist_is_not_authorization.
2. Human allow — then authorize
// tools/call issue_approval_receipt
{
"actor": "cfo@acme.example",
"decision": "allow",
"reason": "invoice INV-104 matches amount",
"ttl_seconds": 120,
"call": { /* same as above */ },
"policy": { /* same as above */ }
}The response includes receipt (take the whole object) and
decision_log (actor, decision, args hash, nonce). Pass that receipt
into authorize_tool_call with the same call. Result: AUTHORIZED.
3. Human deny
Issue with "decision": "deny". The decision is logged. Authorizing
with that receipt returns DENIED / human_denied. A deny receipt
cannot be flipped to allow by editing decision — the MAC breaks.
4. Changed arguments after approval — denied
Approve { "amount": 2500, ... }, then authorize with
{ "amount": 2500000, ... }. Result: DENIED / changed_arguments.
Key order does not matter; the hash is CHP canonical. The original
receipt remains valid for the args that were approved (until expiry or
a successful consume).
5. Expired receipt — denied
Issue with ttl_seconds: 30. After the expiry instant,
authorize_tool_call returns DENIED / expired_receipt. The nonce is
consumed so a clock rewind cannot resurrect it.
6. Replayed receipt — denied
A successful AUTHORIZED consume burns the nonce. Presenting the same
receipt again returns DENIED / replayed_receipt.
7. Ambiguity — denied
These never produce a usable allow receipt:
resource: "*",any,all, or an empty stringmissing
argumentspolicy without a concrete
versionactor / tool wildcards
extra keys on a receipt (strict parse)
Fail-closed: deny_on_ambiguity cannot be turned off.
Cookbook — host-injected args + gateway _meta
Semantic Kernel and other hosts need to pass index, key, and tenant
without letting the model choose them
(SO-style routing).
Putting those fields on the tool schema so the LLM can “decide” is the
bug. An MCP allowlist does not fix it: the tool name can stay
allowlisted while the model swaps index_name to another tenant.
The host (or a gateway in front of this server) injects bound fields. This package hashes host ∪ model arguments into the receipt and denies when the model overrides a host-bound field. The allowlist is still only a pre-filter.
Contract — _meta.cubiczan (no hard dependency)
@cubiczan/governed-mcp-gateway
already injects identity on every tools/call and SSE frame:
{
"_meta": {
"cubiczan": {
"principal": {
"id": "agt_search",
"kind": "agent",
"orgId": "org_acme",
"displayName": "Search Runner"
}
}
}
}This server does not import that package. It reads the same
envelope. Hosts MAY add host_bound next to principal. A trusted
gateway should overwrite _meta.cubiczan so the model cannot self-attest.
{
"_meta": {
"cubiczan": {
"principal": { "id": "agt_search", "kind": "agent", "orgId": "org_acme" },
"host_bound": { "tenant_id": "acme", "index_name": "prod-docs" }
}
}
}Library callers can also pass host_bound on the proposed call
(explicit keys overlay _meta). Policy
examples/host-injected-policy.json
declares host_bound_fields so index_name and tenant_id must be
host-injected and concrete. If tenant_id is declared and omitted,
_meta.cubiczan.principal.orgId may fill it.
model args ──┐
├─ override check ─→ deny host_bound_override
host_bound ──┘ │
▼
merged args → args_hash → receipt MAC
│
allowlist ──── pre-filter only (never a grant)1. Host injects index + tenant — allowlist still denied
The model chose query / top_k. The host chose the index.
// tools/call evaluate_tool_approval
{
"call": {
"tool": "search.azure_ai",
"resource": "tenant:acme",
"arguments": { "query": "Q3 revenue", "top_k": 5 },
"_meta": {
"cubiczan": {
"principal": { "id": "agt_search", "kind": "agent", "orgId": "org_acme" },
"host_bound": { "tenant_id": "acme", "index_name": "prod-docs" }
}
}
},
"policy": { "$ref": "examples/host-injected-policy.json" }
}Result: RECEIPT_REQUIRED, deny_code: "allowlist_is_not_authorization".
args_hash is contentHash of
{ query, top_k, tenant_id, index_name } — not the model object alone.
2. Model changes a host-bound field — denied
Same host _meta, but the model adds "index_name": "other-index".
"arguments": { "query": "Q3 revenue", "top_k": 5, "index_name": "other-index" }evaluate_tool_approval, issue_approval_receipt (decision: "allow"),
and authorize_tool_call all return DENIED /
host_bound_override. Matching the host value is not an override.
3. Human allow — then authorize the merged args
Issue a receipt for the host-injected call. Authorize with the same
arguments and _meta. Result: AUTHORIZED. Change query after
approve → changed_arguments. Change index_name in model args →
host_bound_override. Omit declared host fields → ambiguous.
4. Semantic Kernel / host wiring
Do the routing in the host, not the model: disable auto-invoke, then
inject index/tenant (or put a gateway in front that writes
_meta.cubiczan.host_bound) before evaluate_tool_approval /
authorize_tool_call. Secrets such as API keys belong in the host or
the gateway vault — not in the tool schema the LLM sees.
Cookbook — deny telemetry and receipts
MCP denials are usually a bare error string. That string is gone when the client disconnects. This server treats a refuse as a structured event that must hit a CHP-signed ledger before the caller sees it.
Finance tools (place_equity_order, wire_treasury_transfer,
rebalance_portfolio) are synthetic — no live venue or bank rail — and
use a separate kind: "authorization" receipt bound to tool, scope, and
args hash. That is not the same object as a chp.tool_approval_receipt.
Reason codes
Code | When |
| Hard CHP rule failed ( |
| Receipt |
| Receipt already consumed by a successful execute |
| Tool, scope, or args hash no longer matches the receipt |
| No receipt, or the content hash does not verify |
| Unknown tool, scope mismatch, or incomplete policy |
Signing is the existing Profile B primitives: contentHash on the
receipt / ledger payload, chainHash between ledger rows. Set
CHP_AUDIT_LEDGER to a JSONL path (default ./data/chp-audit.jsonl),
or :memory: for tests.
1. Request a bound receipt
Under the HITL threshold the gate auto-locks and mints a receipt. At or
above it, pass approver (or call approve_spend with tool +
bound_args).
// tools/call request_authorization
{
"tool": "place_equity_order",
"args": {
"symbol": "AAPL",
"side": "BUY",
"quantity": 10,
"notional": 300,
"confidence": 0.9
},
"approver": "cfo@example.com"
}Treasury wires use hitl_threshold: 0. A request without approver
returns HITL_REQUIRED and no receipt — that is the approval gate,
not a weather-API demo.
2. Execute only with that receipt
receipt is optional on the wire so a missing token is a logged
missing_receipt deny, not a schema 400 that never hits the ledger.
// tools/call place_equity_order
{
"symbol": "AAPL",
"side": "BUY",
"quantity": 10,
"notional": 300,
"confidence": 0.9,
"receipt": { "kind": "authorization", "receipt_id": "…", "content_hash": "…" }
}Change notional or quantity after approve → args_changed, and the
ledger has the deny. Call again with the same receipt → replay.
Call with no receipt → missing_receipt. All three are durable.
3. Inspect the chain
// tools/call inspect_audit_ledger
{ "limit": 20 }Each row carries content_hash and sig = chainHash(prev_sig, { seq, ts, event, content_hash }).
chain.ok is false if anyone rewrote history.
Tests
npm testThis Cubiczan mirror may omit GitHub Actions; run the suite locally.
npm test builds, then runs node --test dist/*.test.js (approval
receipts + host-injected bindings) and
node --import tsx --test test/**/*.test.ts (deny ledger). Invariants
covered: an unlogged deny is impossible (ledger failure throws instead
of returning a deny object); changed args after approve deny; a receipt
is required for every gated reference tool; allowlist is not
authorization; host-bound tenant/index cannot be overridden by the
model; receipt args_hash covers host ∪ model args.
Related
Package / repo | Role |
Profile B library (this server’s dependency) | |
Profile A + normative spec | |
Full MCP: contracts, skills, Profile A gates | |
HTTP MCP control plane | |
Codebase health MCP | |
Shared retry / timeout / audit primitives |
Licence
MIT.
Available Tools
12 toolsapprove_spendA
Human-in-the-loop approval for a proposal that returned HITL_REQUIRED. Cannot approve BLOCKED / hard-rule failures (spec §6.3 / §6.5). When tool + bound_args are supplied, mints a signed authorization receipt.
| Name | Required | Description | Default |
|---|---|---|---|
| tool | No | Reference tool to bind the receipt to (e.g. place_equity_order) | |
| scope | No | ||
| action | Yes | ||
| policy | Yes | ||
| approver | Yes | Human approver identity (email or handle) | |
| bound_args | No | Canonical args the receipt will authorize | |
| ttl_seconds | No | Receipt lifetime (default 300) | |
| committed_today | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses a constraint (cannot approve BLOCKED) and a conditional side effect (mints a signed authorization receipt when tool and bound_args are supplied). This goes beyond a generic 'approve' statement, though it omits details like irreversibility or required permissions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two tight sentences, front-loading the core purpose and then adding a key constraint and side effect. Every sentence earns its place, and it references spec sections for deeper detail without bloating the text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a complex tool with 8 parameters, nested objects, and no output schema. The description does not explain the structure or intent of the action and policy objects, nor what happens when tool and bound_args are absent, nor the return value. The agent would struggle to construct valid calls without additional knowledge from spec sections or examples.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 50%, so the description should compensate for undocumented parameters like scope, action, policy, and committed_today. It only references tool and bound_args when explaining the receipt minting, adding no meaning to the other four parameters. This leaves the agent without guidance on how to populate critical nested objects.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: human-in-the-loop approval for proposals that returned HITL_REQUIRED. It specifies the verb 'approve' and the resource (proposal), and distinguishes itself by noting it cannot approve BLOCKED/hard-rule failures. This sets it apart from sibling tools like request_authorization or issue_approval_receipt.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit conditions: use for HITL_REQUIRED proposals and avoid for BLOCKED/hard-rule failures. It does not name alternative tools for other scenarios, but the context is clear enough for an agent to know when to invoke this tool versus others.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
authorize_tool_callA
Authorize a tool call against a previously issued receipt. Changed arguments (including host-bound tenant/index), expired or replayed receipts, MAC failure, host-bound override, and binding mismatch all deny. Presenting only an allowlist match denies with allowlist_is_not_authorization.
| Name | Required | Description | Default |
|---|---|---|---|
| call | Yes | Call about to execute — args are re-hashed | |
| policy | Yes | ||
| receipt | No | Signed receipt; omit to demonstrate that allowlisting is not enough | |
| signing_key | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations supplied, the description carries the transparency burden and does enumerate important denial cases: changed arguments, expiry/replay, MAC failure, host-bound override, and binding mismatch. It does not describe success return values or error channels, but the security-relevant behavior is well exposed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences convey the operation, preconditions, and key failure modes without filler. Every sentence adds information needed to call or avoid misuse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has nested call/policy/receipt objects and no output schema, and the description focuses on deny conditions rather than success output or parameter construction. It leaves some gaps around how to build policy and how signing_key is used, though the core authorization check is clear.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The prose adds meaning for receipt, arguments, and host_bound by explaining which conditions cause denial. It does not clarify policy construction or the role of signing_key, and with only 50% schema coverage the description only partially compensates.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a clear verb and object: authorize a tool call against a previously issued receipt. It immediately separates this from issuing or evaluating receipts and highlights the core precondition.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It states the required precondition (previously issued receipt) and warns that allowlist matches alone are denied, which tells callers when not to use it. It does not explicitly name sibling flows such as request_authorization or issue_approval_receipt, so it stops short of full alternative routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
chp_content_hashA
SHA-256 over float-aware canonical JSON (CHP §3.1) — matches Python consensus-hardening-protocol digests for the same object.
| Name | Required | Description | Default |
|---|---|---|---|
| value | No | JSON-serializable value to hash |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses the algorithm (SHA-256), the canonicalization method, and the consistency with Python digests. It doesn't mention edge cases or determinism, but for a pure hash function, this is reasonable. A minor gap is the lack of explicit side-effect-free declaration.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that front-loads the core operation (SHA-256 over float-aware canonical JSON) and adds the interoperability detail. Every word earns its place, with no fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has one parameter, no output schema, and no annotations. The description fails to specify the return format (e.g., hex string, base64, binary) or error behavior for invalid inputs. An agent cannot be sure how to interpret the result, which is a significant gap for a hash function. Given the simplicity, this should have been included.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema provides 100% coverage for the single parameter 'value' with the description 'JSON-serializable value to hash'. The tool description adds no additional semantic meaning beyond that, so the baseline of 3 applies. It doesn't clarify format, size limits, or serialization specifics beyond what's in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool computes a SHA-256 hash over float-aware canonical JSON, referencing CHP §3.1 and matching Python consensus-hardening-protocol digests. This specifies the verb (compute hash), resource (canonical JSON), and the exact algorithm, distinguishing it from unrelated sibling tools like chp_version.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for cross-language consistency (matching Python digests) within the CHP protocol. While it doesn't explicitly list when not to use it, there are no similar sibling tools, so the context is sufficient. It could be more explicit about typical use cases, but the purpose is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
chp_versionA
Report MCP server and CHP Profile B protocol versions.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description implies a read-only operation via 'Report', but does not explicitly state that no data is modified or that it is safe to call. Since no annotations are provided, the description carries the full burden of transparency and could be more explicit about side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence with no unnecessary words or repetition. It is well-structured and easy to understand.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of the tool (no parameters, no output schema), the description is complete and sufficient. It fully describes the tool's purpose without leaving any critical gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are no parameters in the input schema, so the description adds no parameter-level information. The baseline score of 3 is appropriate as there is nothing to describe.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool reports MCP server and CHP Profile B protocol versions, with a specific verb and resource. No ambiguity or missing information.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not provide any guidance on when to use this tool, such as checking version compatibility before other operations. It simply states what it does without context or alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
evaluate_spend_gateB
Run CHP Profile B capital/spend gate on a proposed action. Returns LOCKED, HITL_REQUIRED, or BLOCKED with claims and a content hash. Hard policy violations cannot be overridden by a human. BLOCKED is also written as a structured policy_deny to the CHP-signed audit ledger.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Proposed trade / spend / mandate action | |
| policy | Yes | Gate policy (limits, HITL threshold, confidence floor) | |
| committed_today | No | Notional already committed today toward daily_cap (default 0) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Explicitly describes return values (LOCKED, HITL_REQUIRED, BLOCKED), the side effect of writing a policy_deny to the audit ledger on BLOCKED, and the non-overridable nature of hard violations. This gives a clear picture of the tool's behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three concise sentences that front-load the primary purpose and then efficiently cover outcomes and side effects. No redundant or vague wording.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description adequately explains the expected return statuses, the content hash, and the audit ledger side effect. It does not detail the structure of 'claims', but that is not essential for invoking the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema provides descriptions for all three parameters (action, policy, committed_today) with meaningful context. The tool description itself does not add additional parameter-specific meaning, but schema coverage is 100%, so the baseline applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Run'), resource ('CHP Profile B capital/spend gate'), and scope ('proposed action'). It does not name sibling tools, but the specificity of the gate and its profile makes its purpose clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides no guidance on when to use this tool versus alternatives like 'approve_spend' or 'request_authorization'. It only describes what the tool does, not when it should be chosen.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
evaluate_tool_approvalA
Evaluate a proposed MCP tool call. A managed allowlist is not a grant — allowlisted tools still return RECEIPT_REQUIRED. Host-injected fields (host_bound / _meta.cubiczan.host_bound) are merged into args_hash; the model cannot override them. Wildcards, missing resource, or unparseable arguments deny on ambiguity.
| Name | Required | Description | Default |
|---|---|---|---|
| call | Yes | Proposed tool, tenant/resource, and arguments | |
| policy | Yes | Tool-approval policy (allowlist is a pre-filter, not authorization) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It explicitly reveals that allowlisting is not a grant, that host-injected fields are merged into the hash and cannot be overridden, and that ambiguity (wildcards, missing resource, unparseable arguments) results in denial. These are security-critical behaviors that an agent must know before invoking.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tightly packed sentences with zero fluff. The first sentence states the purpose, the second clarifies a key nuance (allowlist vs grant), and the third specifies the ambiguity-denial rule. Information density is high and every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with nested objects and a nuanced policy, the description covers the critical decision logic well (allowlist behavior, host-bound merging, ambiguity handling). However, it does not enumerate the full set of possible outcomes beyond RECEIPT_REQUIRED and 'deny on ambiguity' — it never states what an approval result looks like, nor what happens for non-allowlisted tools. This leaves a minor gap in the agent's understanding of return values, which is notable given there is no output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Although the schema fully describes the 'call' and 'policy' objects, the description adds substantial meaning beyond the schema: it explains how host_bound and _meta.cubiczan.host_bound are merged, that arguments are hashed with host-injected fields, and that wildcards/missing resources/unparseable args trigger denial. This semantic layer is essential for correct invocation and is not present in the raw schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear, specific action: 'Evaluate a proposed MCP tool call.' It further clarifies the tool's role by contrasting a managed allowlist with a grant, and by detailing the ambiguity-denial behavior. This distinctively separates it from sibling tools like authorize_tool_call (which likely grants) and evaluate_spend_gate (which likely focuses on spend policy).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies this is the pre-approval evaluation step by noting that allowlisted tools still return RECEIPT_REQUIRED and that ambiguity denies. However, it does not explicitly name alternative tools or provide when-to-use/when-not-to-use guidance. It leaves some inference to the agent about choosing this over sibling evaluation tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
inspect_audit_ledgerA
Read the CHP-signed deny / authorize / execute ledger and verify the chain. Also lists the synthetic scoped reference tools.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max trailing entries (default 50) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses the non-destructive nature ('Read') and the verification behavior ('verify the chain') that checks signatures. It does not mention auth needs or rate limits, but the read-only and verification aspects are transparent given no annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences with no redundant information. Every word adds value, clearly stating the action, resource, and purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is complete enough to invoke the tool: it names the resource, the action, and the parameter. It does not specify return format, but since there is no output schema and the operation is a simple read, this is acceptable. The mention of 'synthetic scoped reference tools' is slightly ambiguous but not critical.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter 'limit' is fully described with its meaning ('Max trailing entries') and default value (50). Schema coverage is 100% and the description adds clarity beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the verb 'Read' and the resource 'CHP-signed deny / authorize / execute ledger' with the action 'verify the chain'. It also mentions a secondary purpose of listing synthetic scoped reference tools, but the primary purpose is unambiguous and distinct from sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides some context about reading and verifying the ledger but does not explicitly state when to use this tool versus alternatives. It mentions listing synthetic scoped reference tools, which hints at a use case, but lacks explicit conditions or selection criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
issue_approval_receiptA
Record a human allow/deny and return a signed approval receipt. The MAC covers actor, tool, resource, args hash (host ∪ model), policy version, risk, expiry, decision, and nonce (HMAC-SHA256 over CHP canonical JSON). Signing key from CHP_RECEIPT_KEY / AUDIT_LEDGER_KEY, or the documented insecure default.
| Name | Required | Description | Default |
|---|---|---|---|
| call | Yes | ||
| actor | Yes | Human approver identity (email or handle) | |
| policy | Yes | ||
| reason | No | Why the human allowed or denied | |
| decision | Yes | Human decision — logged on every issue | |
| signing_key | No | Override HMAC key (tests / local only) | |
| ttl_seconds | No | Receipt lifetime; must not exceed policy.max_ttl_seconds |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description mentions side effects like recording the decision and generating a MAC, but it does not explain the return format, verification process, or whether the tool is idempotent. It leaves out details about how host_bound and _meta affect behavior, and lacks an explicit statement about read/write nature.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is verbose and highly technical, repeating details from the schema (MAC coverage, signing key source) without adding clarity. It is not concise and may overwhelm an agent with jargon, making it less effective than a shorter, more focused summary.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description assumes prior knowledge of the CHP system (e.g., CHP canonical JSON, cubiczan.principal, host_bound) and does not explain these concepts. For a standalone agent, this is incomplete; it lacks definitions and fails to specify how to obtain required host-injected fields or interpret the receipt output.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema provides descriptions for many parameters (e.g., actor, decision, ttl_seconds), but some fields like 'call' at the top level lack descriptions, and the tool description does not add meaning beyond what the schema already gives. The description repeats some schema details but does not clarify ambiguous parameters like 'signing_key' or 'host_bound'.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool records a human allow/deny decision and returns a signed receipt. It specifies the exact action and outcome, leaving no ambiguity about the tool's primary function.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is used after a human decision, but it does not explicitly contrast with sibling tools like approve_spend or request_authorization. The intended context is inferable, though not spelled out.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
place_equity_orderB
Synthetic equity order (scope trading:equities:place). No live venue. Requires a signed authorization receipt bound to these args. Receipt is optional on the wire so a missing receipt becomes a logged missing_receipt deny.
| Name | Required | Description | Default |
|---|---|---|---|
| side | Yes | ||
| symbol | Yes | ||
| receipt | No | ||
| notional | Yes | ||
| quantity | Yes | ||
| rationale | No | ||
| confidence | No | ||
| limit_price | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses that the order is synthetic (no live execution) and that a missing receipt results in a logged 'missing_receipt deny'. However, it omits success behavior, response format, side effects, or any other operational details. It adds meaningful behavioral context but is not comprehensive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no fluff. It front-loads the core purpose and scope, then adds critical behavioral notes. Every sentence earns its place, making it highly concise and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (8 parameters, nested receipt object, authorization workflow, no output schema), the description is incomplete. It lacks return value expectations, does not explain how to obtain the authorization receipt, and does not describe parameter constraints or the meaning of 'bound to these args' in terms of args_hash. It provides essential context but leaves many operational gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It adds semantic meaning for the 'receipt' parameter by noting it must be 'bound to these args' and that it is 'optional on the wire'. Other parameters (symbol, side, quantity, notional) are self-explanatory by name, and the description does not elaborate further, leaving some semantics unexplained (e.g., limit_price, confidence). It provides partial compensation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the tool places a 'Synthetic equity order' with an explicit scope ('trading:equities:place') and clarifies it is not a live venue. This clearly identifies the action and resource, though it does not explicitly differentiate from sibling tools like rebalance_portfolio or wire_treasury_transfer beyond the equity-order focus.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool requires a signed authorization receipt but does not explicitly state when to use it versus alternatives, nor does it direct the agent to obtain the receipt from a specific sibling (e.g., request_authorization or issue_approval_receipt). It provides context (synthetic, no live venue) but no explicit when/when-not guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
rebalance_portfolioB
Synthetic portfolio rebalance (scope portfolio:rebalance). No live desk. Requires a signed authorization receipt; HITL at/above $1,000 notional.
| Name | Required | Description | Default |
|---|---|---|---|
| receipt | No | ||
| notional | Yes | ||
| confidence | No | ||
| portfolio_id | Yes | ||
| target_weights | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses that the operation is synthetic, that there is no live desk, and that an authorization receipt is required. It does not describe what happens on success or failure, whether portfolio state is persisted, or how invalid or expired receipts are handled.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: two sentences with no fluff or repetition. Every phrase carries meaningful operational information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the nested schema, no annotations, and no output schema, the description is far from complete. It omits essential parameter meanings, expected output, error behavior, and the process for validating the authorization receipt.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has five parameters plus a nested receipt object, but the description only mentions notional and the receipt requirement generically. portfolio_id, target_weights, confidence, and the receipt's internal fields are completely undocumented, and schema coverage is 0%.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the action as a portfolio rebalance, states the synthetic scope, and names the key resource. It does not explicitly differentiate from sibling tools like place_equity_order, but the verb and resource are unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides important preconditions: requires a signed authorization receipt and HITL above $1,000 notional, and notes that no live desk is involved. However, it does not explicitly state when to choose this tool over alternatives or describe the expected workflow for obtaining the required receipt.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
request_authorizationC
Request a signed authorization receipt for a scoped reference tool (place_equity_order, wire_treasury_transfer, rebalance_portfolio). Auto-lock mints a receipt; HITL_REQUIRED waits for approver; hard fails return a structured deny that is already on the audit ledger.
| Name | Required | Description | Default |
|---|---|---|---|
| args | Yes | Tool args that will be bound into the receipt | |
| tool | Yes | Gated reference tool name | |
| scope | No | ||
| policy | No | ||
| approver | No | Required when the gate returns HITL_REQUIRED | |
| ttl_seconds | No | ||
| committed_today | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses key behavioral outcomes: auto-lock mints a receipt, HITL_REQUIRED waits for an approver, hard fails return a structured deny, and the result is recorded on the audit ledger. This gives a clear picture of side effects and failure modes, especially since no annotations are present.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is relatively concise but uses specialized jargon ('auto-lock', 'HITL_REQUIRED', 'hard fails') that may be unclear without additional context. The structure is acceptable but could be more streamlined to avoid ambiguity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description does not explain how the signed receipt is used, what constitutes a 'scoped reference tool', or what the expected output format is. With no output schema and only partial parameter documentation, an agent would struggle to invoke this tool correctly in a real scenario.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 7 parameters but only 3 have descriptions (tool, args, approver), and the description does not explain any of them. Parameters like scope, policy, ttl_seconds, and committed_today are entirely undocumented both in schema and description. The description adds no semantic value for parameters, failing to compensate for the 43% schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Request a signed authorization receipt') and the target ('scoped reference tool') with concrete examples like place_equity_order, wire_treasury_transfer, and rebalance_portfolio. It is specific enough for an agent to understand the tool's primary function, though it could be slightly more explicit about the 'signed receipt' concept.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions outcome branches (auto-lock, HITL_REQUIRED, hard fail) but does not explicitly state when to use this tool versus siblings like evaluate_spend_gate or approve_spend. No guidance is provided on when this tool is the appropriate choice, leaving the agent to infer context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
wire_treasury_transferB
Synthetic treasury wire (scope treasury:wire). Default policy always requires a human-issued receipt. No live bank rail. Missing receipt is a logged deny, not a bare MCP error string.
| Name | Required | Description | Default |
|---|---|---|---|
| memo | No | ||
| amount | Yes | ||
| receipt | No | ||
| currency | No | ||
| confidence | No | ||
| to_account | Yes | ||
| from_account | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses key behaviors: it is synthetic (no live bank rail), requires a receipt by default, and missing receipt leads to a logged deny. This is useful transparency, though it does not mention whether the operation is read-only or write, or what effects it has on system state.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is brief and to the point, using three short sentences. It is well-structured and does not include unnecessary details or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
While the description gives some operational context (policy, synthetic nature), it omits essential details about parameters, output, and when to use this tool relative to siblings. Given the complexity (7 parameters, nested objects), the description is insufficient for an agent to use it correctly without additional information.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
None of the seven parameters (from_account, to_account, amount, currency, confidence, memo, receipt) are explained. The description only mentions the receipt policy but does not describe the receipt object's fields or the meaning of any other parameter. With 0% schema coverage, the description fails to compensate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description identifies the tool as a 'synthetic treasury wire' with a scope, but the verb is implicit and the term 'synthetic' may confuse rather than clarify. It does not explicitly state the action (e.g., 'transfer funds') or the intended use case.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides some context (requires a human-issued receipt, no live rail, missing receipt results in a logged deny) but does not explicitly say when to use this tool versus alternatives. The guidance is inferred rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
12 tool updates
v0.2.0- First observed
approve_spend - First observed
authorize_tool_call - First observed
chp_content_hash - First observed
chp_version - First observed
evaluate_spend_gate - First observed
evaluate_tool_approval - First observed
inspect_audit_ledger - First observed
issue_approval_receipt - First observed
place_equity_order - First observed
rebalance_portfolio - First observed
request_authorization - First observed
wire_treasury_transfer
TDQS
Scored across 12 tools
The authorization lifecycle is split across several tools with fuzzy boundaries: evaluate_spend_gate and evaluate_tool_approval both evaluate proposed actions, while approve_spend, issue_approval_receipt, and request_authorization can all produce signed receipts. Detailed descriptions help, but an agent selecting by name alone will struggle to identify the correct phase.
Most tools follow a clear lowercase verb_noun pattern such as evaluate_spend_gate, place_equity_order, inspect_audit_ledger, and authorize_tool_call. The only deviations are the two chp_* utility tools, chp_content_hash and chp_version, which are consistently prefixed but not verb-led.
Twelve tools is within the ideal range for a policy/authorization MCP and the count is not bloated. However, there is some redundancy in the approval and receipt-issuance tools, so a couple of tools could be consolidated without losing functionality.
The core flow is covered end-to-end: evaluate policy, request/approve authorization, issue and verify receipts, execute scoped reference tools, and inspect the audit ledger. Missing pieces are mostly non-critical, such as explicit receipt revocation or allowlist management, but agents can work around these.
Maintenance
Related MCP Connectors
Pre-flight MCP security. Blocks compromised deps + tool drift. HMAC-signed. Dredd judges.
Remote MCP for MCP tool deprecation receipt, structured receipts, audit logs, and reviewer-ready evi
Remote MCP for Android CLI agent build gate, structured receipts, audit logs, and reviewer-ready evi
Trust checks for MCP servers: trust scores, tool-drift detection, signed diligence receipts. Free.
Related MCP Servers
AlicenseNot gradedqualityCmaintenancePolicy enforcement gateway for MCP tool calls, evaluating every tool invocation against declarative YAML policies (allow/deny/escalate-to-human), generating cryptographic hash-chained audit receipts, and including built-in content safety scanning.2MIT- AlicenseBqualityCmaintenanceSecurity gateway that wraps any MCP server with per-tool policies, approval gates, and optional Ed25519-signed decision receipts. Shadow mode logs every tool call without blocking; enforce mode applies block, rate-limit, and minimum-tier rules. Receipts are independently verifiable offline with no accounts needed.558710MIT
- AlicenseNot gradedqualityBmaintenanceSelf-hosted MCP gateway that applies deterministic, compiled policy to tool discovery, invocation, and outbound data flow, with no model in the enforcement path. Every decision emits a hash-chained receipt sealed with Ed25519 and verifiable using public keys only.Apache 2.0
- AlicenseNot gradedqualityCmaintenanceEnforces deterministic security policies as an inline firewall for MCP server tool calls, with AST-based validation, cryptographic audit logging, and CLI-based evaluation and verification.MIT