agent-collab-platform
Uses a hosted Cloudflare Blind Relay for cross-machine collaboration and supports deploying a custom relay to Cloudflare Workers with Durable Objects.
Supports local Ollama (and vLLM) OpenAI-compatible endpoints without requiring an API key.
Supports OpenAI-compatible API endpoints and Codex CLI execution, with host-owned BYOK requests and provider token accounting.
Agent Collaboration Protocol & Runtime (ACP)
English | 日本語 (README.ja.md)
Status:
v1.0.0 (M0–M3.1 Reference Implementation)— Cross-Owner Agent Collaboration Platform
Target: An open-source protocol and reference implementation that lets autonomous agents owned by different people split, delegate, run, verify, and accept work without trusting each other's runtimes or credentials.
Author: @takapon01234
30-Second Quickstart (One-Line Demo & MCP Config)
Run the full 4-scenario zero-trust collaboration & red-team tamper defense demo in one command (offline, zero API keys needed):
git clone https://github.com/acidnyan/agent-collab-platform.git && cd agent-collab-platform && pnpm install --frozen-lockfile && pnpm build && pnpm acp demoOr add acp mcp-server directly to Claude Desktop, Cursor, Codex, or Grok Bot (mcpServers config):
{
"mcpServers": {
"acp": {
"command": "node",
"args": [
"/path/to/agent-collab-platform/cli/dist/index.js",
"mcp-server",
"--key",
"/tmp/alice.private.json",
"--relay",
"https://acp-relay.agent-collab.workers.dev"
]
}
}
}Related MCP server: aip-identity
One-screen summary
This project is not a centralized hosting SaaS and not an agent directory. Each owner runs their own Gateway. Over an untrusted Blind Relay they exchange a signed TaskContract and attenuating CapabilityTokens, then collaborate.
flowchart LR
subgraph OwnerA["Owner A Zone (Requester)"]
OA[Owner A / HITL] --> GA[Gateway Runtime A]
GA --> AA[Agent A]
GA --> LA[(Local Audit Log A)]
end
subgraph Untrusted["Untrusted Transport"]
R[Blind Relay / Local Loopback]
end
subgraph OwnerB["Owner B Zone (Worker)"]
OB[Owner B / HITL] --> GB[Gateway Runtime B]
GB --> SB[Sandbox Runner]
SB --> AB[Agent B]
GB --> LB[(Local Audit Log B)]
end
GA <-->|"Signed Envelope (JCS + Ed25519)\n+ E2E Encrypted Payload"| R
R <-->|"Signed Envelope (JCS + Ed25519)\n+ E2E Encrypted Payload"| GBSecurity proofs
SECURITY_PROOF.md maps each threat class to the control and the adversarial test. Rerun the red-team suite in one command:
pnpm test:security-proofThe suite covers command injection, host-secret exfiltration, cross-session bleed, resource exhaustion, SSRF, and signature or isolation forgery.
30-second agent quick install
Paste this to Claude Code, Codex, Grok Bot, or Cursor. The playbook is AGENTS.md. The portable skill is SKILL.md.
Set up Agent Collaboration Platform from this repository.
Read AGENTS.md and SKILL.md before acting.
Requires Node.js 22 and pnpm 10. From the repository root run:
pnpm install --frozen-lockfile && pnpm build
For cross-machine work, connect immediately with:
--relay https://acp-relay.agent-collab.workers.dev
Use `pnpm acp relay start --port 8787 --host 127.0.0.1` only for same-machine or offline work.
Never print, log, or commit *.private.json, API keys, or .env.
Ask me before using --auto-accept or --auto-approve.3-minute quickstart (M2/M3)
For AI agents: follow AGENTS.md for the Worker/Requester playbook, setup commands, and owner approval rules. SKILL.md is the portable agent-collab-platform skill with role triggers, discovery, and offline audit verification.
Requires Node.js 22 and pnpm 10. From the repository root:
pnpm install --frozen-lockfile
pnpm buildPublic relay (cross-machine default)
Cross-machine collaboration uses the hosted Cloudflare Blind Relay at https://acp-relay.agent-collab.workers.dev. Both owners connect immediately with --relay https://acp-relay.agent-collab.workers.dev. No Wrangler account, deploy, or inbound port is required; each owner connects outbound.
--relay https://acp-relay.agent-collab.workers.devThe public relay is untrusted transport. Session payloads are encrypted to the recipient did:key, so the relay stores ciphertext while routing metadata stays visible. To run your own relay, copy packages/relay/wrangler.toml.example to packages/relay/wrangler.toml and deploy it with your Wrangler account. The example binds a Durable Object for persistent queues and registry state.
Terminal 1 — local offline relay
Same-machine and offline sessions use a loopback relay:
pnpm acp relay start --port 8787 --host 127.0.0.1Then pass --relay http://127.0.0.1:8787 in the terminals below. Loopback is reachable only on this machine. For cross-machine runs, replace that URL with https://acp-relay.agent-collab.workers.dev.
Terminal 2 — Bob, the worker
pnpm acp keygen /tmp/bob.private.json
pnpm acp worker start --key /tmp/bob.private.json \
--relay http://127.0.0.1:8787 --adapter sandbox \
--name "Bob Worker" --auto-accept --once --audit /tmp/bob-audit.jsonlCopy the printed acp-invite:... line. This local example echoes the JSON input through a restricted subprocess. --auto-accept permits contract acceptance; external side effects and budget increases still require explicit approval. Remove it for an interactive [y/N] gate. Keys and audit output paths must be fresh.
Terminal 3 — Alice, the requester
pnpm acp keygen /tmp/alice.private.json
# Paste Bob's complete token when prompted
read -r BOB_INVITE
pnpm acp delegate --key /tmp/alice.private.json --to "$BOB_INVITE" \
--title "JSON report" --description "Return the supplied JSON report" \
--input '{"summary":"Hello from Alice","findings":[]}' \
--output-schema '{"type":"object","required":["summary","findings"]}' \
--auto-approve --audit /tmp/alice-audit.jsonl --out /tmp/report.json
pnpm acp audit-verify /tmp/alice-audit.jsonl
pnpm acp discover --relay http://127.0.0.1:8787Expected: SETTLED, a JSON deliverable, and audit status VALID on both owners. Alice verifies signatures, digests and budget, JSON Schema and registered isolated checks, then obtains a signed final approval. --auto-approve explicitly opts into policy approval of final verification; omit it for human review. acp://invite?token=... is also accepted. Alternatively, use --to <Bob DID> --relay <URL>. Bob can verify his own /tmp/bob-audit.jsonl locally.
Choose an adapter
Adapter | CLI / programmatic entry | Behavior |
Command |
| stdin JSON + |
Claude Code |
|
|
Codex CLI |
|
|
OpenAI compatible |
| Host-owned BYOK HTTP requests; exact provider token accounting |
MCP |
| Official SDK client, stdio or in-memory transport; CapGuard + quota + approval proxy |
Restricted JS |
| Node permission-restricted subprocess, or hardened OCI when requested in the manifest |
Claude/Codex binaries must already be installed. Their adapters accept binaryPath, extraArgs, and command/runner overrides. When a provider key is configured in the host (ANTHROPIC_API_KEY or OPENAI_API_KEY), a task-scoped loopback broker injects it upstream; the CLI receives only a temporary local broker credential. Host credentials, private keys and inherited NODE_OPTIONS are not copied into child environments. The OpenAI adapter supports local Ollama/vLLM endpoints without a key and Anthropic's Messages API via apiStyle: 'anthropic' programmatically.
Command and CLI adapters run owner-configured executables with fresh working folders; this is process hygiene, not OS-level filesystem/network confinement. Use the restricted sandbox for untrusted JavaScript. OCI uses an already-present node:22-bookworm-slim image, prefers Podman, disables networking, drops Linux capabilities and applies memory/PID limits. An unavailable runtime falls back to the restricted subprocess and records the effective isolation level in the signed attestation. A container execution failure is surfaced rather than rerun. When execution attestation is required, verification rejects an OCI downgrade unless the signed manifest explicitly sets sandboxPolicy.allowSubprocessFallback: true.
Session payloads use ephemeral X25519, HKDF-SHA256, and AES-256-GCM, with the header bound into the ciphertext. Use HTTPS for transit. The relay has no owner keys and cannot authorize work or read task inputs, capability tokens, or results. It can still observe routing metadata or deny delivery. See security details and SECURITY_PROOF.md.
MCP, live progress, revocation, and quorum
pnpm acp mcp-server --key /tmp/alice.private.json --relay https://acp-relay.agent-collab.workers.devacp mcp-server is a dependency-free JSON-RPC 2.0 MCP server on stdio. It accepts newline-delimited JSON and Content-Length frames. Hosts such as Claude Code, Cursor, Codex, and Grok Bot can call:
Tool | Result |
| Verified deliverable, |
|
|
| Cryptographic verification report for an |
| Signed |
| Signed |
AcpMcpServer in @acp/runtime is the same server for tests and embedded hosts. The server key signs requester approvals for the tools it runs.
A worker reports PROGRESS (percent, step, message, and intermediate token or tool metrics) through the same encrypted, countersigned session log. delegate(request, { onProgress }) receives each decrypted update before DELIVER. Reported metrics are charged against QuotaMeter.
RevocationRegistry checks Ed25519 RevocationNotices (RFC 8785 JCS). The worker rejects a revoked invite before ACCEPT. CapabilityGuard rejects a revoked capability with TOKEN_REVOKED before the tool runs. A notice signed by anyone other than issuerDid is invalid.
AbortSignal on delegate sends a signed encrypted CANCEL while the task is ACCEPTED or IN_PROGRESS. The worker aborts the task and stops the sandbox with SIGTERM, then SIGKILL, and seals a CANCELLED audit log.
delegateMulti({ mode: 'race' }) keeps the first deliverable that passes verification and cancels the other workers. mode: 'quorum' resolves when quorumSize workers (default floor(n/2)+1) return the same JCS SHA-256 output digest, then cancels the rest. If that agreement is impossible, the call rejects with QUORUM_NOT_REACHED and still exposes the verified receipts.
HTTP receives, SSE streams and WebSocket receives/subscriptions require a fresh recipient-signed RelayAuth token. WorkerNode, RequesterClient and the CLI sign automatically. For direct transport use, pass the recipient key as new HttpRelayClient(url, key), new SseRelayClient(url, fetch, key) or new WebSocketRelayClient(wsUrl, key). HTTP/SSE also accept an async token generator as their third argument; WebSocket accepts it as its second argument. Raw HTTP callers can send createRelayAuthToken(key, { action }) through Authorization: Bearer <token>, x-acp-relay-auth or the auth query parameter. Use receive, stream or subscribe to match the operation. Tokens expire after five minutes of clock skew and each nonce can be used once while retained in the bounded replay cache. Direct InMemoryRelay.receive(did) remains available by default; construct with { requireAuth: true } to require a token there too.
Invite endpoints always block metadata and unspecified addresses. parseAndVerifyInviteToken(uri, Date.now(), { allowPrivateRelay: false }) and RequesterClient's allowPrivateRelay: false option also reject private and loopback endpoints. Local relays remain enabled by default.
A fully automated separate-process command-adapter demo is also available:
node examples/network-collab/run.mjsFive design principles
Zero shared credentials. The requester never hands the worker an API key or raw credential. Needed authority is a time-, count-, scope-, and depth-limited
CapabilityToken(UCAN/Biscuit style). The requester Gateway verifies it by proxy.Contract-first execution. Input/output JSON Schema, acceptance criteria, verification method, deadline, and token budget live in a
TaskManifest. Execution does not start without both signatures (TaskContract).Explicit HITL gates. External send, contract acceptance, budget overrun, redelegation, and final acceptance each have a policy-driven approval gate. The owner's signed
ApprovalReceiptis appended to the audit log.BYOK and signed usage receipts. LLM cost is borne by the executing side (BYOK) inside the contracted quota. The worker runtime meters usage and signs a
UsageReceipt. Payment stays out of the core and can be plugged in later.Untrusted input and a bilateral audit. Data from another owner is
untrustedand runs in a sandbox. Every state transition is an append-only hash chain signed with Ed25519, and both sides keep a copy.
Documents
File | Contents |
Red-team threat map and | |
System shape, trust boundaries, task state machine, five safety mechanisms, protocol comparison, threat model | |
Monorepo layout, stack choices, MVP scope, milestones M0–M3, task split | |
Protocol overview, message envelope, canonicalization and signatures | |
| |
Schema-valid sample | |
Survey of A2A, ACP, ANP, AGNTCY, DelegateOS, Cotal, Busbar, and scratch vs fork vs overlay | |
Autonomous Worker/Requester playbook | |
Portable agent skill |
Local M0–M1 implementation
Node.js 22 LTS and pnpm 10 are required. WP-1 through WP-6 are implemented as @acp/core, @acp/ledger, @acp/sandbox, @acp/runtime, @acp/relay, @acp/cli and @acp/two-owner-demo.
pnpm install
pnpm build
pnpm validate:schemas
pnpm test
pnpm test:security-proof
pnpm --filter @acp/two-owner-demo start
pnpm acp demo --audit-dir /tmp/acp-demo-audit
pnpm acp audit-verify /tmp/acp-demo-audit/alice.jsonlAll four demo scenarios assert their expected outcomes and return a nonzero exit code on failure. The demo is offline, uses ephemeral keys and synthetic provider usage, and never needs API credentials. The original sample manifest remains a schema fixture; its illustrative signature is not a real cryptographic signature.
CLI examples (use a fresh output path; key generation never overwrites a key):
pnpm acp keygen /tmp/alice.private.json
pnpm acp validate spec/examples/sample-task-manifest.json
pnpm acp validate capability-token spec/examples/sample-capability-token.json
pnpm acp approve /tmp/alice.private.json contract_acceptance task_example001 /tmp/target.json /tmp/approval.json
pnpm acp validate approval-receipt /tmp/approval.json
pnpm acp audit-verify /tmp/acp-demo-audit/alice.jsonl /tmp/trust-anchor.jsonThe approval target file contains the exact JSON action being approved. The trust anchor file has { "taskId": "...", "actors": ["did:key:...", "did:key:..."], "head": "sha256:..." }; obtain the latest expected head independently of the bundle under verification. The built CLI is also available as node cli/dist/index.js <command> and its workspace binary is acp.
Read the demo walkthrough, wire rules, conformance suite, M1 security model, and security proofs. M1 uses signed relay envelopes and the restricted JavaScript subprocess driver. M2/M3 adds optional hardened OCI execution and end-to-end payload encryption. The root code is Apache-2.0; adapted DelegateOS portions retain MIT attribution in NOTICE.
Author & Community
Author: @takapon01234 on X (Twitter)
Repository: acidnyan/agent-collab-platform
Public Blind Relay:
https://acp-relay.agent-collab.workers.dev
Available Tools
5 toolsacp_create_inviteC
Sign an acp-invite token for this server owner.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | ||
| agentDid | No | ||
| relayUrl | Yes | ||
| expiresInSeconds | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden and discloses almost nothing beyond 'sign'. It doesn't say whether the token is stored or returned, what the default expiry is, what identity/authentication is needed, or whether the operation is idempotent — all critical for a token-minting mutation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence with no padding, but it is under-specified rather than concise given the tool's four-parameter surface. The core action is front-loaded, which is a plus.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no annotations, no output schema, and completely undocumented parameters, the description is far too thin. An agent cannot tell what a successful call yields (token string? invite URL?) or how the invite relates to owner identity and expiry.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% across four parameters (name, agentDid, relayUrl, expiresInSeconds) and the description explains none of them. It doesn't even clarify that relayUrl is mandatory or what expiresInSeconds defaults to, leaving every argument to be guessed from its name.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description has a concrete verb ('Sign') and resource ('acp-invite token') scoped to 'this server owner', so the operation is identifiable. However, it doesn't distinguish this from siblings like acp_revoke_token or acp_delegate_task, and the name/description framing ('create_invite' vs 'sign a token') leaves mild ambiguity about whether it creates, persists, or merely signs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No indication of when an agent should call this versus acp_revoke_token or the delegate tools, and no prerequisites such as required identity, permissions, or whether an invite must later be revoked. The only contextual hint is 'for this server owner', which does not guide tool selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
acp_delegate_multiB
Delegate one task to several workers. race returns the first verified deliverable. quorum returns the matching verified digest.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | ||
| input | No | ||
| title | Yes | ||
| budget | No | ||
| workers | Yes | ||
| relayUrl | No | ||
| quorumSize | No | ||
| description | No | ||
| outputSchema | No | ||
| minimumIsolationLevel | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It discloses the outcome distinction between race and quorum, but says nothing about permissions, side effects, budget consumption, isolation requirements, failure behavior, or how relayUrl and outputSchema affect execution.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three short, front-loaded sentences with no filler. The purpose comes first and the mode behavior follows immediately, so every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex tool with 10 parameters, nested objects, no annotations, and no output schema, the description is far too thin. It gives a useful high-level purpose and mode outcomes, but an agent still lacks the parameter and operational context needed to invoke it reliably.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 10 parameters, including nested objects and an enum. The description only partly clarifies the mode values and leaves workers, input, budget, relayUrl, quorumSize, outputSchema, minimumIsolationLevel, and the rest undocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb and resource: 'Delegate one task to several workers.' It also clarifies the two mode outcomes, which helps distinguish the tool from a single-worker delegate sibling. It stops short of explicitly naming the sibling or contrasting its scope, so it is clear but not fully differentiated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'one task to several workers' implies when this tool applies, and the race/quorum result semantics add some guidance. However, it does not say when to choose race versus quorum, when to use acp_delegate_task instead, or what exclusions or prerequisites exist.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
acp_delegate_taskC
Delegate one task to an ACP worker and return the verified deliverable plus an audit summary.
| Name | Required | Description | Default |
|---|---|---|---|
| input | No | ||
| title | Yes | ||
| budget | No | ||
| relayUrl | No | ||
| workerDid | No | ||
| description | No | ||
| inviteToken | No | ||
| outputSchema | No | ||
| minimumIsolationLevel | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It mentions verified output and an audit summary, but omits side effects, budget handling, auth or invite requirements, isolation behavior, and whether execution is synchronous or asynchronous.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no filler or redundancy. It is appropriately terse, though its brevity contributes to the broader under-specification problem.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With nine parameters, nested objects, no annotations, and no output schema, the description is far too thin for the tool's complexity. It gives a high-level outcome but leaves an agent unable to call the tool correctly without guessing about most inputs.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 0% description coverage across nine parameters, and the tool description explains none of them. Critical inputs such as budget, relayUrl, workerDid, inviteToken, outputSchema, and minimumIsolationLevel are left entirely undefined.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description has a specific verb and resource: delegate one task to an ACP worker. It also states the return value (verified deliverable plus audit summary). The word 'one' implicitly contrasts with acp_delegate_multi, but that sibling is not named explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit when-to-use, when-not-to-use, prerequisite, or alternative guidance. The single-task phrasing weakly implies that acp_delegate_multi is for multiple tasks, but the agent must infer this rather than being told.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
acp_revoke_tokenC
Sign a RevocationNotice and record it in this server registry.
| Name | Required | Description | Default |
|---|---|---|---|
| reason | Yes | ||
| targetId | Yes | ||
| targetType | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It implies a mutation ('record it') and cryptographic signing ('sign'), but says nothing about required keys or permissions, whether revocation is reversible, what happens to existing records, or what the response contains. This is a significant gap for a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single efficient sentence with no filler. It is front-loaded and appropriately sized, though its brevity comes at the cost of the missing information noted in other dimensions.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a three-required-parameter mutation with no annotations, no output schema, and 0% parameter documentation, the description is far too thin. An agent would not know what is being revoked, what the enum targets mean, or what signing entails.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across three required parameters. The description does not explain 'reason', 'targetId', or the critical enum distinction between 'invite' and 'capability' in 'targetType', so it does not compensate for the missing schema documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action (sign a RevocationNotice and record it in this server registry), which is more informative than the tool name alone. However it never clarifies that revocation is for invites or capabilities, so the enum-selected target is a surprise relative to the 'revoke_token' name. It does not distinguish itself from siblings like acp_create_invite or acp_verify_audit_bundle.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus sibling tools (e.g. acp_create_invite or acp_verify_audit_bundle). No prerequisites, no when-not-to-use, and no mention of an alternative are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
acp_verify_audit_bundleC
Verify a bilateral AuditBundle and return the verification report.
| Name | Required | Description | Default |
|---|---|---|---|
| anchor | No | ||
| bundle | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the whole burden, and it only states that a report is returned. It does not say whether the call is read-only, whether an invalid bundle raises an error or returns a negative report, whether a trust anchor is required, or any auth/rate constraints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One efficient, front-loaded sentence with no filler. Brevity is appropriate, though it edges into under-specification given the complexity of the inputs.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with nested object inputs, zero schema coverage, no output schema, and no annotations, one sentence is not enough. The meaning of 'bilateral', the role of 'anchor', and the shape/interpretation of the verification report are all left to inference.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% and both parameters are nested objects with no field descriptions. The description only implies the 'bundle' parameter; the optional 'anchor' parameter — likely a trust anchor that materially changes verification behavior — is never mentioned, so the agent has no basis for deciding whether to supply it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Verify a bilateral AuditBundle') plus the return ('verification report'), which clearly separates it from the sibling tools (revoke/delegate/invite). The 'bilateral' qualifier is unexplained, so the agent knows the operation class but not exactly what is being validated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to call this versus alternatives, no prerequisites (e.g. must the bundle come from a counterparty?), and no indication of what to do on failure. The siblings are unrelated enough that disambiguation is low-risk, but no usage context is supplied at all.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
5 tool updates
v0.1.0- First observed
acp_create_invite - First observed
acp_delegate_multi - First observed
acp_delegate_task - First observed
acp_revoke_token - First observed
acp_verify_audit_bundle
TDQS
Scored across 5 tools
Each tool targets a distinct action: delegation (single vs multi), audit verification, and token lifecycle (create invite vs revoke). The only pair that could be confused is acp_delegate_task vs acp_delegate_multi, but the descriptions clearly differentiate single-worker vs race/quorum semantics.
All five tools use a consistent acp_ prefix followed by a verb_noun pattern (revoke_token, delegate_task, delegate_multi, verify_audit_bundle, create_invite). The convention is uniform and predictable throughout.
Five tools is a lean but reasonable scope for a delegation/audit platform, and each tool has a clear purpose. However, the surface feels slightly under-provisioned given the platform's apparent breadth (no status, listing, or worker-discovery tools).
Delegation is covered with single and multi variants, and audit verification plus token creation/revocation exist. But there is no way to query task status/results later, list or inspect the token/invite registry, discover or register workers, or cancel a delegation — notable lifecycle gaps for an agent workflow.
Maintenance
Related MCP Connectors
MCP server teaching AI agents to implement TideCloak: auth, E2EE, IGA, security analysis
MCP-native Trust Infrastructure for AI Agents. Persistent encrypted memory with Trust Quotient.
Agent-native MCP for governed commerce, x402 payments, paid capabilities, and verifiable receipts.
End-to-end encrypted messaging and work coordination for autonomous AI agents.
Related MCP Servers
- AlicenseCqualityAmaintenanceCryptographic identity and trust protocol for AI agents. 38 MCP tools across 8 protocol layers: Ed25519 identity, delegation chains, values compliance, signed communication, policy engine, task coordination, cross-layer integration, and agentic commerce. 264 tests passing.154585 npm4Apache 2.0
- AlicenseAqualityDmaintenanceMCP server for AI agent identity — verify agents with Ed25519 signatures, check trust scores, sign and verify content, exchange encrypted messages. Built on the Agent Identity Protocol (AIP).8MIT
- AlicenseNot gradedqualityDmaintenanceMCP Server for AI agent identity and authorization. Create, verify, and manage agent identities with trust scores and scoped authorization tokens.39 PyPIMIT
- AlicenseNot gradedqualityDmaintenanceMCP server for AInternet — DNS, identity and messaging for AI agents, enabling .aint domain resolution, Ed25519-based identity verification, and inter-agent messaging.MIT