Skip to main content
Glama
Cubiczan

@cubiczan/chp-mcp

@cubiczan/chp-mcp

icohangar-ops/cubiczan-chp-mcp MCP server

One-command MCP install for CHP Profile B spend / capital gates and tool-approval receipts (an allowlist is not authorization), plus a structured deny ledger and receipt-gated finance tools.

MCP Registry npm Conformance

Wraps @cubiczan/chp so Cursor, Claude Code, or any MCP client can call evaluate_spend_gate without vendoring protocol code. Engine digests match the normative golden vectors (Profile B 30/30).

How the pieces fit

MCP client (Cursor / Claude / …)
        │  tools/call
        ▼
┌───────────────────────────┐
│  MCP server (transport)   │  ← you are here (@cubiczan/chp-mcp)
│  evaluate_spend_gate      │
│  approve_spend            │
│  evaluate_tool_approval   │  allowlist ≠ authorization
│  issue_approval_receipt   │
│  authorize_tool_call      │
│  request_authorization    │  finance-tool receipt / HITL / deny
│  place_equity_order       │  scoped + receipt-gated (synthetic)
│  wire_treasury_transfer   │
│  rebalance_portfolio      │
│  inspect_audit_ledger     │  CHP-signed deny / authorize / execute
│  chp_content_hash         │
└─────────────┬─────────────┘
              │ depends on
              ▼
┌───────────────────────────┐
│  Published CHP packages   │
│  npm:  @cubiczan/chp                 (Profile B)
│  PyPI: consensus-hardening-protocol  (Profile A)
└───────────────────────────┘

For AGENTS.md + skills + Profile A decision_gate / decision_adversary, use agent-conductor instead.

Related MCP server: protect-mcp

Install

npm install -g @cubiczan/chp-mcp
# or one-shot
npx -y @cubiczan/chp-mcp

Cursor / Claude Desktop

{
  "mcpServers": {
    "chp": {
      "command": "npx",
      "args": ["-y", "@cubiczan/chp-mcp"]
    }
  }
}

Claude Code

claude mcp add chp -- npx -y @cubiczan/chp-mcp

Tools

Tool

Maps to

Purpose

evaluate_spend_gate

evaluateGate

LOCKED / HITL_REQUIRED / BLOCKED + claims + content hash. BLOCKED is also a ledgered policy_deny.

approve_spend

approveHuman

Human lock when HITL_REQUIRED (cannot override hard fails). Optional tool + bound_args mint a signed receipt.

evaluate_tool_approval

evaluateToolApproval

Allowlist is a pre-filter; host-bound fields merge into args_hash; a receipt is still required

issue_approval_receipt

issueApprovalReceipt

Human allow/deny → HMAC-signed receipt + decision log

authorize_tool_call

authorizeToolCall

Consume a receipt; deny on drift, host-bound override, expiry, replay, or a bad MAC

request_authorization

runtime

Mint a receipt bound to a scoped reference tool, or return HITL / structured deny

place_equity_order

reference

Synthetic equity order — scope trading:equities:place, receipt required

wire_treasury_transfer

reference

Synthetic treasury wire — scope treasury:wire, always HITL

rebalance_portfolio

reference

Synthetic rebalance — scope portfolio:rebalance

inspect_audit_ledger

ledger

Trailing CHP-chained deny / authorize / execute entries

chp_content_hash

contentHash

Float-aware canonical SHA-256

chp_version

Server + protocol versions + deny reason codes + receipt schema

Example — evaluate a spend

// tools/call evaluate_spend_gate
{
  "action": { "action": "LONG", "asset": "ETH", "notional": 300, "confidence": 0.9 },
  "policy": {
    "max_notional": 500,
    "daily_cap": 2500,
    "hitl_threshold": 250,
    "min_confidence": 0.55,
    "allowed_actions": ["LONG", "SHORT"]
  }
}

Cookbook — Claude / Cursor tool approval

Managed MCP allowlists (Cursor mcpServers, Claude Desktop, Claude Code) only answer “is this tool name installed?”. They do not bind tenant, arguments, risk, or a human decision. This server treats that gap as a hard deny unless a signed approval receipt still matches the call that is about to run.

Receipts are HMAC-SHA256 over CHP canonical JSON (the same payload discipline as Profile B contentHash / audit-ledger sig). The MAC covers:

Field

Role

actor

Human who allowed or denied

tool

Concrete tool name (no *)

resource

Tenant / resource binding (no *)

args_hash

contentHash(host ∪ model arguments, { floatAware: true })

policy_version

Policy the human saw

risk

Policy risk for that tool

issued_at / expiry

Lifetime

decision

allow or deny

nonce

Single-use; replay denies

signature

HMAC-SHA256 hex

Set CHP_RECEIPT_KEY (or AUDIT_LEDGER_KEY) in the MCP server env. Without it the process falls back to a documented insecure default — fine for the local cookbook, not for production.

Example policy: examples/tool-approval-policy.json. stripe.create_charge is on the allowlist and still cannot run without a receipt bound to acct_live_acme and the exact charge args. Host-injected tenant/index bindings use examples/host-injected-policy.json (see the host-injected args cookbook below).

{
  "mcpServers": {
    "chp": {
      "command": "npx",
      "args": ["-y", "@cubiczan/chp-mcp"],
      "env": { "CHP_RECEIPT_KEY": "replace-me" }
    }
  }
}

1. Allowlist alone — denied

Claude/Cursor has stripe.create_charge enabled. That is not a grant.

// tools/call evaluate_tool_approval
{
  "call": {
    "tool": "stripe.create_charge",
    "resource": "acct_live_acme",
    "arguments": { "amount": 2500, "currency": "usd", "customer": "cus_123" }
  },
  "policy": { "$ref": "examples/tool-approval-policy.json" }
}

Result: RECEIPT_REQUIRED, deny_code: "allowlist_is_not_authorization".

Calling authorize_tool_call with the same payload and no receipt returns DENIED / allowlist_is_not_authorization.

2. Human allow — then authorize

// tools/call issue_approval_receipt
{
  "actor": "cfo@acme.example",
  "decision": "allow",
  "reason": "invoice INV-104 matches amount",
  "ttl_seconds": 120,
  "call": { /* same as above */ },
  "policy": { /* same as above */ }
}

The response includes receipt (take the whole object) and decision_log (actor, decision, args hash, nonce). Pass that receipt into authorize_tool_call with the same call. Result: AUTHORIZED.

3. Human deny

Issue with "decision": "deny". The decision is logged. Authorizing with that receipt returns DENIED / human_denied. A deny receipt cannot be flipped to allow by editing decision — the MAC breaks.

4. Changed arguments after approval — denied

Approve { "amount": 2500, ... }, then authorize with { "amount": 2500000, ... }. Result: DENIED / changed_arguments. Key order does not matter; the hash is CHP canonical. The original receipt remains valid for the args that were approved (until expiry or a successful consume).

5. Expired receipt — denied

Issue with ttl_seconds: 30. After the expiry instant, authorize_tool_call returns DENIED / expired_receipt. The nonce is consumed so a clock rewind cannot resurrect it.

6. Replayed receipt — denied

A successful AUTHORIZED consume burns the nonce. Presenting the same receipt again returns DENIED / replayed_receipt.

7. Ambiguity — denied

These never produce a usable allow receipt:

  • resource: "*", any, all, or an empty string

  • missing arguments

  • policy without a concrete version

  • actor / tool wildcards

  • extra keys on a receipt (strict parse)

Fail-closed: deny_on_ambiguity cannot be turned off.

Cookbook — host-injected args + gateway _meta

Semantic Kernel and other hosts need to pass index, key, and tenant without letting the model choose them (SO-style routing). Putting those fields on the tool schema so the LLM can “decide” is the bug. An MCP allowlist does not fix it: the tool name can stay allowlisted while the model swaps index_name to another tenant.

The host (or a gateway in front of this server) injects bound fields. This package hashes host ∪ model arguments into the receipt and denies when the model overrides a host-bound field. The allowlist is still only a pre-filter.

Contract — _meta.cubiczan (no hard dependency)

@cubiczan/governed-mcp-gateway already injects identity on every tools/call and SSE frame:

{
  "_meta": {
    "cubiczan": {
      "principal": {
        "id": "agt_search",
        "kind": "agent",
        "orgId": "org_acme",
        "displayName": "Search Runner"
      }
    }
  }
}

This server does not import that package. It reads the same envelope. Hosts MAY add host_bound next to principal. A trusted gateway should overwrite _meta.cubiczan so the model cannot self-attest.

{
  "_meta": {
    "cubiczan": {
      "principal": { "id": "agt_search", "kind": "agent", "orgId": "org_acme" },
      "host_bound": { "tenant_id": "acme", "index_name": "prod-docs" }
    }
  }
}

Library callers can also pass host_bound on the proposed call (explicit keys overlay _meta). Policy examples/host-injected-policy.json declares host_bound_fields so index_name and tenant_id must be host-injected and concrete. If tenant_id is declared and omitted, _meta.cubiczan.principal.orgId may fill it.

model args ──┐
             ├─ override check ─→ deny host_bound_override
host_bound ──┘         │
                       ▼
              merged args → args_hash → receipt MAC
                       │
allowlist ──── pre-filter only (never a grant)

1. Host injects index + tenant — allowlist still denied

The model chose query / top_k. The host chose the index.

// tools/call evaluate_tool_approval
{
  "call": {
    "tool": "search.azure_ai",
    "resource": "tenant:acme",
    "arguments": { "query": "Q3 revenue", "top_k": 5 },
    "_meta": {
      "cubiczan": {
        "principal": { "id": "agt_search", "kind": "agent", "orgId": "org_acme" },
        "host_bound": { "tenant_id": "acme", "index_name": "prod-docs" }
      }
    }
  },
  "policy": { "$ref": "examples/host-injected-policy.json" }
}

Result: RECEIPT_REQUIRED, deny_code: "allowlist_is_not_authorization". args_hash is contentHash of { query, top_k, tenant_id, index_name } — not the model object alone.

2. Model changes a host-bound field — denied

Same host _meta, but the model adds "index_name": "other-index".

"arguments": { "query": "Q3 revenue", "top_k": 5, "index_name": "other-index" }

evaluate_tool_approval, issue_approval_receipt (decision: "allow"), and authorize_tool_call all return DENIED / host_bound_override. Matching the host value is not an override.

3. Human allow — then authorize the merged args

Issue a receipt for the host-injected call. Authorize with the same arguments and _meta. Result: AUTHORIZED. Change query after approve → changed_arguments. Change index_name in model args → host_bound_override. Omit declared host fields → ambiguous.

4. Semantic Kernel / host wiring

Do the routing in the host, not the model: disable auto-invoke, then inject index/tenant (or put a gateway in front that writes _meta.cubiczan.host_bound) before evaluate_tool_approval / authorize_tool_call. Secrets such as API keys belong in the host or the gateway vault — not in the tool schema the LLM sees.

Cookbook — deny telemetry and receipts

MCP denials are usually a bare error string. That string is gone when the client disconnects. This server treats a refuse as a structured event that must hit a CHP-signed ledger before the caller sees it.

Finance tools (place_equity_order, wire_treasury_transfer, rebalance_portfolio) are synthetic — no live venue or bank rail — and use a separate kind: "authorization" receipt bound to tool, scope, and args hash. That is not the same object as a chp.tool_approval_receipt.

Reason codes

Code

When

policy_deny

Hard CHP rule failed (max_notional, daily cap, …)

expired

Receipt expires_at is in the past

replay

Receipt already consumed by a successful execute

args_changed

Tool, scope, or args hash no longer matches the receipt

missing_receipt

No receipt, or the content hash does not verify

ambiguous_policy

Unknown tool, scope mismatch, or incomplete policy

Signing is the existing Profile B primitives: contentHash on the receipt / ledger payload, chainHash between ledger rows. Set CHP_AUDIT_LEDGER to a JSONL path (default ./data/chp-audit.jsonl), or :memory: for tests.

1. Request a bound receipt

Under the HITL threshold the gate auto-locks and mints a receipt. At or above it, pass approver (or call approve_spend with tool + bound_args).

// tools/call request_authorization
{
  "tool": "place_equity_order",
  "args": {
    "symbol": "AAPL",
    "side": "BUY",
    "quantity": 10,
    "notional": 300,
    "confidence": 0.9
  },
  "approver": "cfo@example.com"
}

Treasury wires use hitl_threshold: 0. A request without approver returns HITL_REQUIRED and no receipt — that is the approval gate, not a weather-API demo.

2. Execute only with that receipt

receipt is optional on the wire so a missing token is a logged missing_receipt deny, not a schema 400 that never hits the ledger.

// tools/call place_equity_order
{
  "symbol": "AAPL",
  "side": "BUY",
  "quantity": 10,
  "notional": 300,
  "confidence": 0.9,
  "receipt": { "kind": "authorization", "receipt_id": "…", "content_hash": "…" }
}

Change notional or quantity after approve → args_changed, and the ledger has the deny. Call again with the same receipt → replay. Call with no receipt → missing_receipt. All three are durable.

3. Inspect the chain

// tools/call inspect_audit_ledger
{ "limit": 20 }

Each row carries content_hash and sig = chainHash(prev_sig, { seq, ts, event, content_hash }). chain.ok is false if anyone rewrote history.

Tests

npm test

This Cubiczan mirror may omit GitHub Actions; run the suite locally. npm test builds, then runs node --test dist/*.test.js (approval receipts + host-injected bindings) and node --import tsx --test test/**/*.test.ts (deny ledger). Invariants covered: an unlogged deny is impossible (ledger failure throws instead of returning a deny object); changed args after approve deny; a receipt is required for every gated reference tool; allowlist is not authorization; host-bound tenant/index cannot be overridden by the model; receipt args_hash covers host ∪ model args.

Package / repo

Role

@cubiczan/chp

Profile B library (this server’s dependency)

consensus-hardening-protocol

Profile A + normative spec

@cubiczan/agent-conductor

Full MCP: contracts, skills, Profile A gates

@cubiczan/governed-mcp-gateway

HTTP MCP control plane

@cubiczan/codesentinel-mcp

Codebase health MCP

cubiczan-resilience / @cubiczan/resilience

Shared retry / timeout / audit primitives

Licence

MIT.

Available Tools

12 tools
approve_spendA

Human-in-the-loop approval for a proposal that returned HITL_REQUIRED. Cannot approve BLOCKED / hard-rule failures (spec §6.3 / §6.5). When tool + bound_args are supplied, mints a signed authorization receipt.

ParametersJSON Schema
NameRequiredDescriptionDefault
toolNoReference tool to bind the receipt to (e.g. place_equity_order)
scopeNo
actionYes
policyYes
approverYesHuman approver identity (email or handle)
bound_argsNoCanonical args the receipt will authorize
ttl_secondsNoReceipt lifetime (default 300)
committed_todayNo

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses a constraint (cannot approve BLOCKED) and a conditional side effect (mints a signed authorization receipt when tool and bound_args are supplied). This goes beyond a generic 'approve' statement, though it omits details like irreversibility or required permissions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two tight sentences, front-loading the core purpose and then adding a key constraint and side effect. Every sentence earns its place, and it references spec sections for deeper detail without bloating the text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a complex tool with 8 parameters, nested objects, and no output schema. The description does not explain the structure or intent of the action and policy objects, nor what happens when tool and bound_args are absent, nor the return value. The agent would struggle to construct valid calls without additional knowledge from spec sections or examples.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 50%, so the description should compensate for undocumented parameters like scope, action, policy, and committed_today. It only references tool and bound_args when explaining the receipt minting, adding no meaning to the other four parameters. This leaves the agent without guidance on how to populate critical nested objects.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: human-in-the-loop approval for proposals that returned HITL_REQUIRED. It specifies the verb 'approve' and the resource (proposal), and distinguishes itself by noting it cannot approve BLOCKED/hard-rule failures. This sets it apart from sibling tools like request_authorization or issue_approval_receipt.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit conditions: use for HITL_REQUIRED proposals and avoid for BLOCKED/hard-rule failures. It does not name alternative tools for other scenarios, but the context is clear enough for an agent to know when to invoke this tool versus others.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

authorize_tool_callA

Authorize a tool call against a previously issued receipt. Changed arguments (including host-bound tenant/index), expired or replayed receipts, MAC failure, host-bound override, and binding mismatch all deny. Presenting only an allowlist match denies with allowlist_is_not_authorization.

ParametersJSON Schema
NameRequiredDescriptionDefault
callYesCall about to execute — args are re-hashed
policyYes
receiptNoSigned receipt; omit to demonstrate that allowlisting is not enough
signing_keyNo

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations supplied, the description carries the transparency burden and does enumerate important denial cases: changed arguments, expiry/replay, MAC failure, host-bound override, and binding mismatch. It does not describe success return values or error channels, but the security-relevant behavior is well exposed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences convey the operation, preconditions, and key failure modes without filler. Every sentence adds information needed to call or avoid misuse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has nested call/policy/receipt objects and no output schema, and the description focuses on deny conditions rather than success output or parameter construction. It leaves some gaps around how to build policy and how signing_key is used, though the core authorization check is clear.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The prose adds meaning for receipt, arguments, and host_bound by explaining which conditions cause denial. It does not clarify policy construction or the role of signing_key, and with only 50% schema coverage the description only partially compensates.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a clear verb and object: authorize a tool call against a previously issued receipt. It immediately separates this from issuing or evaluating receipts and highlights the core precondition.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states the required precondition (previously issued receipt) and warns that allowlist matches alone are denied, which tells callers when not to use it. It does not explicitly name sibling flows such as request_authorization or issue_approval_receipt, so it stops short of full alternative routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

chp_content_hashA

SHA-256 over float-aware canonical JSON (CHP §3.1) — matches Python consensus-hardening-protocol digests for the same object.

ParametersJSON Schema
NameRequiredDescriptionDefault
valueNoJSON-serializable value to hash

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses the algorithm (SHA-256), the canonicalization method, and the consistency with Python digests. It doesn't mention edge cases or determinism, but for a pure hash function, this is reasonable. A minor gap is the lack of explicit side-effect-free declaration.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured sentence that front-loads the core operation (SHA-256 over float-aware canonical JSON) and adds the interoperability detail. Every word earns its place, with no fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has one parameter, no output schema, and no annotations. The description fails to specify the return format (e.g., hex string, base64, binary) or error behavior for invalid inputs. An agent cannot be sure how to interpret the result, which is a significant gap for a hash function. Given the simplicity, this should have been included.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema provides 100% coverage for the single parameter 'value' with the description 'JSON-serializable value to hash'. The tool description adds no additional semantic meaning beyond that, so the baseline of 3 applies. It doesn't clarify format, size limits, or serialization specifics beyond what's in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool computes a SHA-256 hash over float-aware canonical JSON, referencing CHP §3.1 and matching Python consensus-hardening-protocol digests. This specifies the verb (compute hash), resource (canonical JSON), and the exact algorithm, distinguishing it from unrelated sibling tools like chp_version.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for cross-language consistency (matching Python digests) within the CHP protocol. While it doesn't explicitly list when not to use it, there are no similar sibling tools, so the context is sufficient. It could be more explicit about typical use cases, but the purpose is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

chp_versionA

Report MCP server and CHP Profile B protocol versions.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description implies a read-only operation via 'Report', but does not explicitly state that no data is modified or that it is safe to call. Since no annotations are provided, the description carries the full burden of transparency and could be more explicit about side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence with no unnecessary words or repetition. It is well-structured and easy to understand.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simplicity of the tool (no parameters, no output schema), the description is complete and sufficient. It fully describes the tool's purpose without leaving any critical gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are no parameters in the input schema, so the description adds no parameter-level information. The baseline score of 3 is appropriate as there is nothing to describe.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool reports MCP server and CHP Profile B protocol versions, with a specific verb and resource. No ambiguity or missing information.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not provide any guidance on when to use this tool, such as checking version compatibility before other operations. It simply states what it does without context or alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

evaluate_spend_gateB

Run CHP Profile B capital/spend gate on a proposed action. Returns LOCKED, HITL_REQUIRED, or BLOCKED with claims and a content hash. Hard policy violations cannot be overridden by a human. BLOCKED is also written as a structured policy_deny to the CHP-signed audit ledger.

ParametersJSON Schema
NameRequiredDescriptionDefault
actionYesProposed trade / spend / mandate action
policyYesGate policy (limits, HITL threshold, confidence floor)
committed_todayNoNotional already committed today toward daily_cap (default 0)

TDQS

B3.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Explicitly describes return values (LOCKED, HITL_REQUIRED, BLOCKED), the side effect of writing a policy_deny to the audit ledger on BLOCKED, and the non-overridable nature of hard violations. This gives a clear picture of the tool's behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three concise sentences that front-load the primary purpose and then efficiently cover outcomes and side effects. No redundant or vague wording.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description adequately explains the expected return statuses, the content hash, and the audit ledger side effect. It does not detail the structure of 'claims', but that is not essential for invoking the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema provides descriptions for all three parameters (action, policy, committed_today) with meaningful context. The tool description itself does not add additional parameter-specific meaning, but schema coverage is 100%, so the baseline applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Run'), resource ('CHP Profile B capital/spend gate'), and scope ('proposed action'). It does not name sibling tools, but the specificity of the gate and its profile makes its purpose clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines1/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides no guidance on when to use this tool versus alternatives like 'approve_spend' or 'request_authorization'. It only describes what the tool does, not when it should be chosen.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

evaluate_tool_approvalA

Evaluate a proposed MCP tool call. A managed allowlist is not a grant — allowlisted tools still return RECEIPT_REQUIRED. Host-injected fields (host_bound / _meta.cubiczan.host_bound) are merged into args_hash; the model cannot override them. Wildcards, missing resource, or unparseable arguments deny on ambiguity.

ParametersJSON Schema
NameRequiredDescriptionDefault
callYesProposed tool, tenant/resource, and arguments
policyYesTool-approval policy (allowlist is a pre-filter, not authorization)

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It explicitly reveals that allowlisting is not a grant, that host-injected fields are merged into the hash and cannot be overridden, and that ambiguity (wildcards, missing resource, unparseable arguments) results in denial. These are security-critical behaviors that an agent must know before invoking.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tightly packed sentences with zero fluff. The first sentence states the purpose, the second clarifies a key nuance (allowlist vs grant), and the third specifies the ambiguity-denial rule. Information density is high and every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with nested objects and a nuanced policy, the description covers the critical decision logic well (allowlist behavior, host-bound merging, ambiguity handling). However, it does not enumerate the full set of possible outcomes beyond RECEIPT_REQUIRED and 'deny on ambiguity' — it never states what an approval result looks like, nor what happens for non-allowlisted tools. This leaves a minor gap in the agent's understanding of return values, which is notable given there is no output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although the schema fully describes the 'call' and 'policy' objects, the description adds substantial meaning beyond the schema: it explains how host_bound and _meta.cubiczan.host_bound are merged, that arguments are hashed with host-injected fields, and that wildcards/missing resources/unparseable args trigger denial. This semantic layer is essential for correct invocation and is not present in the raw schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear, specific action: 'Evaluate a proposed MCP tool call.' It further clarifies the tool's role by contrasting a managed allowlist with a grant, and by detailing the ambiguity-denial behavior. This distinctively separates it from sibling tools like authorize_tool_call (which likely grants) and evaluate_spend_gate (which likely focuses on spend policy).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies this is the pre-approval evaluation step by noting that allowlisted tools still return RECEIPT_REQUIRED and that ambiguity denies. However, it does not explicitly name alternative tools or provide when-to-use/when-not-to-use guidance. It leaves some inference to the agent about choosing this over sibling evaluation tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

inspect_audit_ledgerA

Read the CHP-signed deny / authorize / execute ledger and verify the chain. Also lists the synthetic scoped reference tools.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMax trailing entries (default 50)

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses the non-destructive nature ('Read') and the verification behavior ('verify the chain') that checks signatures. It does not mention auth needs or rate limits, but the read-only and verification aspects are transparent given no annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences with no redundant information. Every word adds value, clearly stating the action, resource, and purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is complete enough to invoke the tool: it names the resource, the action, and the parameter. It does not specify return format, but since there is no output schema and the operation is a simple read, this is acceptable. The mention of 'synthetic scoped reference tools' is slightly ambiguous but not critical.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The only parameter 'limit' is fully described with its meaning ('Max trailing entries') and default value (50). Schema coverage is 100% and the description adds clarity beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states the verb 'Read' and the resource 'CHP-signed deny / authorize / execute ledger' with the action 'verify the chain'. It also mentions a secondary purpose of listing synthetic scoped reference tools, but the primary purpose is unambiguous and distinct from sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides some context about reading and verifying the ledger but does not explicitly state when to use this tool versus alternatives. It mentions listing synthetic scoped reference tools, which hints at a use case, but lacks explicit conditions or selection criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

issue_approval_receiptA

Record a human allow/deny and return a signed approval receipt. The MAC covers actor, tool, resource, args hash (host ∪ model), policy version, risk, expiry, decision, and nonce (HMAC-SHA256 over CHP canonical JSON). Signing key from CHP_RECEIPT_KEY / AUDIT_LEDGER_KEY, or the documented insecure default.

ParametersJSON Schema
NameRequiredDescriptionDefault
callYes
actorYesHuman approver identity (email or handle)
policyYes
reasonNoWhy the human allowed or denied
decisionYesHuman decision — logged on every issue
signing_keyNoOverride HMAC key (tests / local only)
ttl_secondsNoReceipt lifetime; must not exceed policy.max_ttl_seconds

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description mentions side effects like recording the decision and generating a MAC, but it does not explain the return format, verification process, or whether the tool is idempotent. It leaves out details about how host_bound and _meta affect behavior, and lacks an explicit statement about read/write nature.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is verbose and highly technical, repeating details from the schema (MAC coverage, signing key source) without adding clarity. It is not concise and may overwhelm an agent with jargon, making it less effective than a shorter, more focused summary.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description assumes prior knowledge of the CHP system (e.g., CHP canonical JSON, cubiczan.principal, host_bound) and does not explain these concepts. For a standalone agent, this is incomplete; it lacks definitions and fails to specify how to obtain required host-injected fields or interpret the receipt output.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema provides descriptions for many parameters (e.g., actor, decision, ttl_seconds), but some fields like 'call' at the top level lack descriptions, and the tool description does not add meaning beyond what the schema already gives. The description repeats some schema details but does not clarify ambiguous parameters like 'signing_key' or 'host_bound'.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool records a human allow/deny decision and returns a signed receipt. It specifies the exact action and outcome, leaving no ambiguity about the tool's primary function.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool is used after a human decision, but it does not explicitly contrast with sibling tools like approve_spend or request_authorization. The intended context is inferable, though not spelled out.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

place_equity_orderB

Synthetic equity order (scope trading:equities:place). No live venue. Requires a signed authorization receipt bound to these args. Receipt is optional on the wire so a missing receipt becomes a logged missing_receipt deny.

ParametersJSON Schema
NameRequiredDescriptionDefault
sideYes
symbolYes
receiptNo
notionalYes
quantityYes
rationaleNo
confidenceNo
limit_priceNo

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses that the order is synthetic (no live execution) and that a missing receipt results in a logged 'missing_receipt deny'. However, it omits success behavior, response format, side effects, or any other operational details. It adds meaningful behavioral context but is not comprehensive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences with no fluff. It front-loads the core purpose and scope, then adds critical behavioral notes. Every sentence earns its place, making it highly concise and well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (8 parameters, nested receipt object, authorization workflow, no output schema), the description is incomplete. It lacks return value expectations, does not explain how to obtain the authorization receipt, and does not describe parameter constraints or the meaning of 'bound to these args' in terms of args_hash. It provides essential context but leaves many operational gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It adds semantic meaning for the 'receipt' parameter by noting it must be 'bound to these args' and that it is 'optional on the wire'. Other parameters (symbol, side, quantity, notional) are self-explanatory by name, and the description does not elaborate further, leaving some semantics unexplained (e.g., limit_price, confidence). It provides partial compensation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states the tool places a 'Synthetic equity order' with an explicit scope ('trading:equities:place') and clarifies it is not a live venue. This clearly identifies the action and resource, though it does not explicitly differentiate from sibling tools like rebalance_portfolio or wire_treasury_transfer beyond the equity-order focus.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool requires a signed authorization receipt but does not explicitly state when to use it versus alternatives, nor does it direct the agent to obtain the receipt from a specific sibling (e.g., request_authorization or issue_approval_receipt). It provides context (synthetic, no live venue) but no explicit when/when-not guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

rebalance_portfolioB

Synthetic portfolio rebalance (scope portfolio:rebalance). No live desk. Requires a signed authorization receipt; HITL at/above $1,000 notional.

ParametersJSON Schema
NameRequiredDescriptionDefault
receiptNo
notionalYes
confidenceNo
portfolio_idYes
target_weightsNo

TDQS

B3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses that the operation is synthetic, that there is no live desk, and that an authorization receipt is required. It does not describe what happens on success or failure, whether portfolio state is persisted, or how invalid or expired receipts are handled.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise: two sentences with no fluff or repetition. Every phrase carries meaningful operational information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the nested schema, no annotations, and no output schema, the description is far from complete. It omits essential parameter meanings, expected output, error behavior, and the process for validating the authorization receipt.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has five parameters plus a nested receipt object, but the description only mentions notional and the receipt requirement generically. portfolio_id, target_weights, confidence, and the receipt's internal fields are completely undocumented, and schema coverage is 0%.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the action as a portfolio rebalance, states the synthetic scope, and names the key resource. It does not explicitly differentiate from sibling tools like place_equity_order, but the verb and resource are unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides important preconditions: requires a signed authorization receipt and HITL above $1,000 notional, and notes that no live desk is involved. However, it does not explicitly state when to choose this tool over alternatives or describe the expected workflow for obtaining the required receipt.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

request_authorizationC

Request a signed authorization receipt for a scoped reference tool (place_equity_order, wire_treasury_transfer, rebalance_portfolio). Auto-lock mints a receipt; HITL_REQUIRED waits for approver; hard fails return a structured deny that is already on the audit ledger.

ParametersJSON Schema
NameRequiredDescriptionDefault
argsYesTool args that will be bound into the receipt
toolYesGated reference tool name
scopeNo
policyNo
approverNoRequired when the gate returns HITL_REQUIRED
ttl_secondsNo
committed_todayNo

TDQS

C2.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses key behavioral outcomes: auto-lock mints a receipt, HITL_REQUIRED waits for an approver, hard fails return a structured deny, and the result is recorded on the audit ledger. This gives a clear picture of side effects and failure modes, especially since no annotations are present.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is relatively concise but uses specialized jargon ('auto-lock', 'HITL_REQUIRED', 'hard fails') that may be unclear without additional context. The structure is acceptable but could be more streamlined to avoid ambiguity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description does not explain how the signed receipt is used, what constitutes a 'scoped reference tool', or what the expected output format is. With no output schema and only partial parameter documentation, an agent would struggle to invoke this tool correctly in a real scenario.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has 7 parameters but only 3 have descriptions (tool, args, approver), and the description does not explain any of them. Parameters like scope, policy, ttl_seconds, and committed_today are entirely undocumented both in schema and description. The description adds no semantic value for parameters, failing to compensate for the 43% schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Request a signed authorization receipt') and the target ('scoped reference tool') with concrete examples like place_equity_order, wire_treasury_transfer, and rebalance_portfolio. It is specific enough for an agent to understand the tool's primary function, though it could be slightly more explicit about the 'signed receipt' concept.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions outcome branches (auto-lock, HITL_REQUIRED, hard fail) but does not explicitly state when to use this tool versus siblings like evaluate_spend_gate or approve_spend. No guidance is provided on when this tool is the appropriate choice, leaving the agent to infer context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

wire_treasury_transferB

Synthetic treasury wire (scope treasury:wire). Default policy always requires a human-issued receipt. No live bank rail. Missing receipt is a logged deny, not a bare MCP error string.

ParametersJSON Schema
NameRequiredDescriptionDefault
memoNo
amountYes
receiptNo
currencyNo
confidenceNo
to_accountYes
from_accountYes

TDQS

B3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses key behaviors: it is synthetic (no live bank rail), requires a receipt by default, and missing receipt leads to a logged deny. This is useful transparency, though it does not mention whether the operation is read-only or write, or what effects it has on system state.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is brief and to the point, using three short sentences. It is well-structured and does not include unnecessary details or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

While the description gives some operational context (policy, synthetic nature), it omits essential details about parameters, output, and when to use this tool relative to siblings. Given the complexity (7 parameters, nested objects), the description is insufficient for an agent to use it correctly without additional information.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

None of the seven parameters (from_account, to_account, amount, currency, confidence, memo, receipt) are explained. The description only mentions the receipt policy but does not describe the receipt object's fields or the meaning of any other parameter. With 0% schema coverage, the description fails to compensate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description identifies the tool as a 'synthetic treasury wire' with a scope, but the verb is implicit and the term 'synthetic' may confuse rather than clarify. It does not explicitly state the action (e.g., 'transfer funds') or the intended use case.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides some context (requires a human-issued receipt, no live rail, missing receipt results in a logged deny) but does not explicitly say when to use this tool versus alternatives. The guidance is inferred rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 12 tool updatesv0.2.0
    • First observedapprove_spend
    • First observedauthorize_tool_call
    • First observedchp_content_hash
    • First observedchp_version
    • First observedevaluate_spend_gate
    • First observedevaluate_tool_approval
    • First observedinspect_audit_ledger
    • First observedissue_approval_receipt
    • First observedplace_equity_order
    • First observedrebalance_portfolio
    • First observedrequest_authorization
    • First observedwire_treasury_transfer

TDQS

B3.4/5.0

Scored across 12 tools

Disambiguation2/5

The authorization lifecycle is split across several tools with fuzzy boundaries: evaluate_spend_gate and evaluate_tool_approval both evaluate proposed actions, while approve_spend, issue_approval_receipt, and request_authorization can all produce signed receipts. Detailed descriptions help, but an agent selecting by name alone will struggle to identify the correct phase.

Naming Consistency4/5

Most tools follow a clear lowercase verb_noun pattern such as evaluate_spend_gate, place_equity_order, inspect_audit_ledger, and authorize_tool_call. The only deviations are the two chp_* utility tools, chp_content_hash and chp_version, which are consistently prefixed but not verb-led.

Tool Count4/5

Twelve tools is within the ideal range for a policy/authorization MCP and the count is not bloated. However, there is some redundancy in the approval and receipt-issuance tools, so a couple of tools could be consolidated without losing functionality.

Completeness4/5

The core flow is covered end-to-end: evaluate policy, request/approve authorization, issue and verify receipts, execute scoped reference tools, and inspect the audit ledger. Missing pieces are mostly non-critical, such as explicit receipt revocation or allowlist management, but agents can work around these.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    C
    maintenance
    Policy enforcement gateway for MCP tool calls, evaluating every tool invocation against declarative YAML policies (allow/deny/escalate-to-human), generating cryptographic hash-chained audit receipts, and including built-in content safety scanning.
    2
    MIT
  • A
    license
    B
    quality
    C
    maintenance
    Security gateway that wraps any MCP server with per-tool policies, approval gates, and optional Ed25519-signed decision receipts. Shadow mode logs every tool call without blocking; enforce mode applies block, rate-limit, and minimum-tier rules. Receipts are independently verifiable offline with no accounts needed.
    5
    587
    10
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Self-hosted MCP gateway that applies deterministic, compiled policy to tool discovery, invocation, and outbound data flow, with no model in the enforcement path. Every decision emits a hash-chained receipt sealed with Ed25519 and verifiable using public keys only.
    Apache 2.0
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enforces deterministic security policies as an inline firewall for MCP server tool calls, with AST-based validation, cryptographic audit logging, and CLI-based evaluation and verification.
    MIT