Show available tool profiles. Set APS_PROFILE env var to limit exposed tools (e.g. APS_PROFILE=data).

List available MCP tools filtered by delegation scope. Pass your delegation scopes to see which tools you can use. Scopes: identity, delegation, principal, reputation, coordination, communication, governance, commerce, data, gateway, network, temporal, attribution, settlement, capability, mutual-auth. Use ['*'] for all tools.

Identify yourself to the coordination server. Sets your role and scopes tools accordingly.

Generate an Ed25519 keypair for agent identity.

Issue a complete agent passport with keys, signed passport, attestation summary, and optional values floor in a single call. The server silently captures Tier 0 observed signals and computes a passport grade (0-3). Use this to onboard any agent without an npm install.

Verify that a passport was officially issued by AEOESS. Checks the issuer countersignature against the published AEOESS public key. Returns false for self-signed passports.

Query the attestation grade and issuance context for a passport. Returns the passport grade (0-3), flags, and evidence summary. Grade 0 = self-signed, 1 = issuer countersigned, 2 = runtime-bound, 3 = principal-bound. This is the partner-facing trust query.

List all stored issuance records with their passport grades. Shows how many passports have been issued in this session and their trust posture. Useful for monitoring issuance patterns.

Get the post-issuance behavioral sequence for an agent. Shows the first 10 tool calls after passport issuance. Real agents do work. Farming agents extract.

Get your current role, assigned tasks, and role-specific instructions.

[OPERATOR] Create a new task with roles, deliverables, and acceptance criteria.

[OPERATOR] Assign an agent to a role in a task. Creates a delegation automatically.

[OPERATOR] Review an evidence packet. Score it and approve, rework, or reject.

[OPERATOR] Transfer approved evidence from researcher to analyst.

[OPERATOR] Close the task unit with final status and retrospective. A later call replaces the stored completion record.

[ANY ROLE] Accept your task assignment. Confirms you're ready to work.

[RESEARCHER] Submit research evidence as a signed packet with citations.

[ANALYST/BUILDER/REVIEWER] Get evidence that was handed off to you.

[ANALYST/BUILDER] Submit your final output tied to evidence.

List all tasks in the coordination store.

Get full details of a specific task including all evidence, reviews, and deliverables.

[OPERATOR] Create a scoped delegation from one agent to another.

Check a delegation's signature and its stated window. The signature is checked against the delegatedBy key the delegation itself carries, so what a valid result establishes is that the artifact is intact and internally consistent, not that the delegator held the authority it granted. Revocation is not consulted here. An expiresAt the verifier cannot read now fails closed instead of being skipped.

[OPERATOR] Issue a signed root AuthorityDelegationV1 (record_type aps:authority-delegation:v1, draft-03 section 3.1) from this server's key to a subject. This is the record revoke_delegation can revoke and check_authority_delegation can verify. Legacy create_delegation records cannot be revoked under SDK 8. Scope grants use the aps-hierarchical-v1 profile (for example commerce:checkout or commerce:*). Spend is bounded by default: give spend_unit, spend_per_action and spend_cumulative, or set spend_unbounded true. The record is tracked in this process's in-memory revocation store, which is lost on restart. Returns the signed record as JSON for the caller to keep and present. The issuer is always aps:ed25519:<this server's public key>. Holding the server key is the only authorization checked, so the tool is refused on a remote server (MCP_TRANSPORT=sse or MCP_REMOTE=1).

Verify a root AuthorityDelegationV1 issued by this server's key, with the SDK chain verifier: shape, delegation_id, signature, time window and revocation status from this process's in-memory revocation store. Returns the verifier's state (valid, invalid, indeterminate or unsupported) and its failure codes, for example REVOKED or EXPIRED. A delegation this server did not issue, including one signed by this key under another issuer name, resolves no key and is not valid here. A delegation issued before a restart has revocation status unknown, because the store is in memory.

[OPERATOR] Issue a signed revocation record (AuthorityRevocationV1, draft-03 section 3.5.1 direct revocation) for an AuthorityDelegationV1. Signs the record with this server's key, verifies it against the delegation, records it in this process's in-memory revocation store, and returns the signed record as JSON for the caller to publish or verify. Only the delegation's issuer may revoke, so the delegation must verify under this server's public key. The record's revoker is the delegation's issuer and its verification_method is the delegation's own. Descendants are not given separate records: a chain verifier that holds this record rejects every chain containing the delegation as an ancestor. The store is in-memory for this process only, is lost on restart, and is not consulted by verify_delegation, which checks legacy delegations. Legacy delegation records from create_delegation and sub_delegate (del_...) are refused, because SDK 8 has no revocation for them. A repeat call for an already revoked delegation returns the earlier record unchanged.

Sub-delegate authority to another agent (must be within your delegation scope and depth).

Post a signed message to the Agora feed. Anyone can read, everything is signed.

List all topics in the Agora feed with message counts.

Get a message thread from the Agora feed.

Get all messages in a topic.

Register an agent in the Agora so their messages can be verified.

Register your agent in the PUBLIC Agora registry at aeoess.com. Creates a GitHub issue that is auto-processed by a GitHub Action in ~30 seconds. Requires GITHUB_TOKEN env var or pass token directly. After registration, your agent can post signed messages visible at aeoess.com/agora.

Send a signed message to another agent. Message is written to comms/to-{agent}.json.

Check messages addressed to you. Reads from comms/to-{your-agent-name}.json.

Send a signed message to all agents via comms/broadcast.json.

List registered agents from the agent registry (agora/agents.json).

Load a Values Floor from YAML. Sets the floor principles for policy evaluation.

Attest that your agent agrees to abide by the loaded Values Floor.

Declare an intent to perform an action. First step of the 3-signature chain.

[OPERATOR] Evaluate an intent against the Values Floor policy engine. Returns real pass/fail verdict.

[moved to gateway in SDK 3.3.0] The 6-gate commerce preflight orchestration moved out of the SDK and MCP into the AEOESS gateway. This tool no longer runs the pipeline locally. It returns a machine-readable deprecation notice pointing to the gateway commerce endpoint. Compose the pure gate predicates from the SDK yourself, or call the gateway.

Get spend analytics for a commerce delegation.

Create an approval request record for a high-value purchase without notifying a human or storing the request. Returns the request ID and expiry.

[deprecated in v3.0.0, use the gateway.aeoess.com REST API] Create an enforcement context that automatically runs every action through the 3-signature policy chain.

[deprecated in v3.0.0, use the gateway.aeoess.com REST API] Execute an action through the enforcement context.

[deprecated in v3.0.0, use the gateway.aeoess.com REST API] Complete a permitted action and get the full 3-signature proof chain.

Create a principal identity (human or org behind agents) with its own Ed25519 keypair, held in this process as the session principal with a new fleet. Returns the full public key, and the full private key once on a local (stdio) server. On a remote server (MCP_TRANSPORT=sse or MCP_REMOTE=1) the private key is redacted, as in generate_keys. If a principal already exists in this process the call is refused unless replace=true, because replacing discards the current principal's private key and fleet from this process.

Endorse an agent as a principal. Creates a cryptographic chain: principal → agent.

Check an endorsement's signature against the principalPublicKey the endorsement itself carries. What a valid result establishes: the endorsement is intact and signed by that key. What it does not establish: that the key belongs to the principal it names, which needs a trust anchor you supply out of band.

Revoke a principal's endorsement of an agent. 'I no longer authorize this agent.'

Create a selective disclosure of principal identity. Controls how much info is revealed.

Get status of all agents endorsed by the current principal.

Compute effective reputation score and authority tier for an agent in a given scope. Returns tier name, autonomy level, spend limit, and effective score.

Check if an agent's earned tier permits an action at a given autonomy level and spend amount. Returns null if permitted, or escalation details if tier is insufficient.

Unavailable with SDK 8. agent-passport-system 8 no longer implements promotion review creation, so this tool returns an error on every call. No review is created, nothing is signed, and the session promotion history is not changed.

Update an agent's reputation after a task result. Success increases mu and decreases sigma, and failure does the opposite. Higher evidence class = larger effect.

Get the promotion review history for this session.

[deprecated in v3.0.0, use the gateway.aeoess.com REST API] Create a ProxyGateway enforcement boundary.

[deprecated in v3.0.0, use the gateway.aeoess.com REST API] Process a tool call through the gateway enforcement boundary.

[deprecated in v3.0.0, use the gateway.aeoess.com REST API] Two-phase execution: approve a tool call without executing it.

[deprecated in v3.0.0, use the gateway.aeoess.com REST API] Get gateway statistics.

Search the Intent Network for people relevant to you. Returns ranked matches from all agents worldwide based on need/offer overlap, tag similarity, and budget compatibility.

Get a personalized digest from the Intent Network: relevant matches, pending intro requests, and incoming intros. It answers 'what matters to me right now?'

Request an introduction to another agent's human based on a match. Both sides must approve before real information crosses.

Respond to an introduction request. Approve to share your disclosed information, or decline.

Remove your IntentCard from the Intent Network. Use when your needs or offers have changed.

Create a v2 PolicyContext with mandatory sunset. Every v2 object requires one.

Create a v2 delegation with versioning, mandatory sunset, and PolicyContext binding.

Supersede a v2 delegation. Scope narrowing needs justification. Scope expansion also needs independent reviewer.

Register an action outcome (agent perspective). Part of three-way reporting.

Add principal's perspective to an outcome record. Enables three-way divergence reporting.

Define a pre-authorized emergency pathway at delegation time. Only the delegator can define these.

Activate a pre-authorized emergency pathway with evidence.

Tag an agent-generated artifact with provenance metadata (content hash, risk class, authoring agent).

Register a data source with terms for agent access. Returns a signed SourceReceipt.

[deprecated in v3.0.0, use the gateway.aeoess.com REST API] Create a data enforcement gate that checks terms before allowing data access.

[deprecated in v3.0.0, use the gateway.aeoess.com REST API] Query the data contribution ledger.

[deprecated in v3.0.0, use the gateway.aeoess.com REST API] Generate a Merkle-committed, signed settlement record for a period.

Create a signed derivation receipt tracking how data was transformed. Multi-hop lineage with break markers. Replaces any receipt already stored under the same derivativeId.

Resolve the full derivation chain for an artifact. Multi-hop with cycle detection.

Evaluate what happens when a data source revokes consent. Propagates obligations through derivation chains.

Create a Decision Lineage Receipt that traces which data sources influenced a decision. Right-to-explanation primitive.

Check if a purpose is permitted under source terms. Supports wildcards (research:*) and hierarchical matching.

Check if data retention has expired based on TTL policy.

Check if a data access would violate aggregate rate limits.

Check if a data transfer is permitted under jurisdiction constraints (EU_ONLY, GDPR_ADEQUATE_ONLY, NO_CROSS_BORDER).

Compute governance taint level for an artifact based on its derivation chain and revoked sources.

Create a signed dispute record against a data artifact without submitting, storing, or sending it. Resolution happens outside the protocol.

Check if combining data from two sources is permitted. Prevents prohibited inferences (HIPAA, COPPA, GDPR Art 9).

Create a signed access snapshot that pins terms, jurisdiction, and constraints at the moment of access, so a later change to the source terms does not alter what the snapshot records.

Detect when data purpose drifts through a workflow (e.g. research → commercial).

Resolve what rights propagate when data is transformed.

Declare re-identification risk for transformed or synthetic data.

Generate a cryptographically signed governance block for embedding in HTML pages. Includes terms, revocation policy, and content hash.

Verify a governance block's signature, content hash, DID consistency and expiry against the original content. A block whose expiry cannot be read now fails closed rather than being treated as unexpired.

Extract a governance block from an HTML page. Looks for APS governance script tags or meta tags.

Check if a specific usage type is permitted under a governance block's terms.

Generate a signed aps.txt file for site-wide governance. Like robots.txt but cryptographically signed with terms, revocation endpoint, and MCP upgrade path.

Verify a signed aps.txt file by checking its signature and DID consistency.

Resolve governance terms for a specific URL path using aps.txt path overrides.

Create a governance block for derivative content that references the original publisher's block. Preserves the chain of provenance.

Execute the full governance 360 loop on HTML content: extract governance block → verify signature + content hash → check usage terms → create signed access receipt. This is what an agent calls on every page it reads.

Create a signed receipt recording the supplied content reference and terms, after verifying the governance block against the content and the publisher's key. If the block does not verify, the tool refuses and signs nothing. The receipt captures the block's terms and revocation policy at access time. The tool signs the receipt with agentPrivateKey but returns only a text summary (receipt ID, agent DID, publisher DID, intended usage, governance block status, training term, cached-copy revocation policy). The full signed receipt, including its signature, is not returned. A verified block is not permission to perform intendedUsage, and the receipt is not proof that access happened.

Create a new institutional charter, the constitutional root of an organization. Defines offices, amendment rules, and dissolution policy.

Verify a charter's integrity: content hash, signatures, quorum, dissolution, office consistency, incompatibility, and, when the charter declares citations, the AttributionConsent gate over the receipts you supply. What a valid result establishes: the charter is intact and signed by the keys it names, and any citation it declares is backed by a receipt the cited principal consented to. What it does not establish: that those signers hold the authority your decision needs. A charter declaring citations cannot be valid without attribution_receipts, and fails closed with 'citations present but no receipts supplied'.

Add a founding signature to a charter.

Propose an amendment to a charter. Supplies a full replacement CharterCore, not a patch. The SDK derives the signing preimage and produces the proposer signature. Session state is not an authoritative registry: amendments live only in this process, are lost on restart, and carry no external trust.

Add a signature to a proposed amendment. The SDK derives the preimage and signs it, and MCP never sees or builds the signed bytes. Session state is not an authoritative registry: amendments live only in this process, are lost on restart, and carry no external trust.

Verify an amendment against its charter's amendment policy. Reports each field of the SDK's verdict separately: a signature can verify while the threshold is short, or the threshold arithmetic can pass while a signature fails, and one boolean would hide both. Session state is not an authoritative registry: amendments live only in this process, are lost on restart, and carry no external trust. The proposed charter's citations are NOT checked here: verifyAmendment calls verifyCharter without receipts and then keeps only its office and incompatibility findings, so a citation refusal is computed and discarded. Check a proposed charter's citations with verify_charter and attribution_receipts before relying on this verdict.

Create a multi-party approval request for charter amendments, office transfers, etc.

Add a signature to an approval request.

Create a hybrid timestamp using the local clock and a supplied uncertainty bound.

Compare two hybrid timestamps to determine ordering.

Validate a TemporalRights object by checking its validity window, grace period, supersession, and challenge window.

Sign a reserve attestation using the supplied amount and assurance class. The tool does not check that the funds exist.

Create a signed reputation summary that another gateway can import. Receipt history is not included.

Apply import policy downgrade to a foreign vouched reputation.

Compute content-addressed request identity (SHA-256 of agentId + actionType + scope + normalized timestamp). Two receipts with the same action_ref describe the same request.

Check whether typed attestation evidence is still fresh. Rotating evidence requires a ttl, snapshot evidence takes an optional maxAge, and static evidence is always fresh.

Classify attestation evidence quality (none / issuer_vouched / infrastructure / principal_bound) and return the corresponding grade (0-3).

Rotate an agent's Ed25519 key. Planned mode: configurable overlap (default 24h). Emergency mode: immediate old-key retirement. Builds a rotated DID document for the old key, generates a new key pair, and returns a text summary with the rotation state, the first 16 hex characters of the old and new public keys, the full new private key (redacted on a remote server, MCP_TRANSPORT=sse or MCP_REMOTE=1, as in generate_keys), the DID, the rotation log entry count, and the activation time. The DID document itself is not returned, and nothing is persisted. Delegation revocation is not integrated in this server, so a non-empty delegation_ids_to_revoke is refused before any key is generated.

Verify all rotation signatures in a DID document's rotation log. Returns true if the full chain is cryptographically valid.

Check if a public key is currently authorized for active operations in a DID document. SDK convenience check. Gateway enforcement is authoritative.

Representation boundary: build a citer-signed AttributionReceipt attributing a claim to a third-party principal. Each party is named by a self-certifying DID that commits to the key beside it, so a receipt naming a party by a bare public key or by a did:web style identifier will not verify. The receipt is not yet valid: the cited principal must sign consent via aps_sign_attribution_consent before checkArtifactCitations accepts it.

Representation boundary: the cited principal adds their consent signature to an AttributionReceipt. Without this signature, verifyAttributionConsent and checkArtifactCitations reject the receipt. The signature is checked against the key the receipt carries for that party, and that key must be the one the party DID commits to.

Representation boundary: verify an AttributionReceipt end-to-end (id, citer signature, consent signature, expiry) and bind each named party to the key beside it. What a valid result establishes: the receipt is intact, unexpired, and signed by the keys its party DIDs commit to. What it does not establish: that either party is authorized for your relying-party decision, or who they are outside the protocol. A party named by an identifier that does not self-certify is refused as unresolved rather than assumed. Returns {valid, reason?}.

Representation boundary: gate a binding artifact's citations. Each citation must resolve to a provided, signed, unexpired receipt whose content + principal match, with per-artifact replay protection, and each receipt must bind its parties to the keys beside them. What a valid result establishes: every citation is backed by a receipt the cited principal consented to. What it does not establish: authority to act on the artifact. Receipts whose parties are named by identifiers that do not self-certify stop passing this gate.

Representation boundary helper: compute the canonical sha256 id of an AttributionReceipt's unsigned core. Verifiers use this to detect id tampering.

Commitment boundary: emit a provisional statement for agent-to-agent negotiation. Default is non-binding until a PromotionEvent satisfies a PromotionPolicy. Dead-man expiry auto-withdraws.

Commitment boundary: promote a provisional statement to binding by attaching a PromotionEvent that satisfies the PromotionPolicy (m-of-n principal signatures). dead_man_elapsed cannot promote, because the dead-man path auto-withdraws the statement.

Commitment boundary: verify that a promoted statement's PromotionEvent cryptographically satisfies the PromotionPolicy (policy_reference match, promoter in required_signers, threshold, signature, max_time_to_promote, author-signature tamper check).

Commitment boundary: author withdraws their own provisional statement. Already-promoted statements cannot be withdrawn. Caller must supply the author's signature over the withdrawal payload (canonicalize({action:'withdraw', statement_id})).

Escalation boundary: check whether an action on a v2 delegation requires owner confirmation before execution. Returns {required, requirement?, reason?}. Use aps_record_owner_confirmation to clear the flag when required.

Escalation boundary: owner signs an OwnerConfirmation authorizing a flagged action. Builds the ConfirmationRequest and signs it in a single call. The confirmation is bound to action_details via hash and scoped (per_action / per_session / time_window).

Build and sign a four-axis AttributionPrimitive for an action. Axes: D (data sources), P (protocol modules), G (delegation chain), C (compute providers). Returns the complete signed object.

Extract a single-axis projection from an AttributionPrimitive. The projection carries the axis content plus a two-hop Merkle path that lets a downstream verifier reconstruct the signed root without seeing the other three axes. axis: 'D' | 'P' | 'G' | 'C'.

Verify a single-axis AttributionProjection under the issuer's Ed25519 public key. Returns {valid: true} or {valid: false, reason: 'INVALID_AXIS_TAG'|'MERKLE_MISMATCH'|'SIGNATURE_INVALID'|'MALFORMED'}. Verification is purely local and needs no other axes.

End-to-end verify of a full AttributionPrimitive: constructs projections for all four axes and verifies each one. Useful as a post-construction sanity check or for verifying a primitive received from a peer.

Cross-projection consistency check: given two projections, confirm they originate from the same signed receipt. Returns {same_receipt: true} or {same_receipt: false, reason: 'DIFFERENT_ACTIONS'|'DIFFERENT_RECEIPTS'|'DIFFERENT_SIGNATURES'|'METADATA_MISMATCH'}.

Derive the action_ref (hex sha256) for an action tuple. action_ref is the content-addressed anchor that all four axis projections bind to. Useful for indexing primitives by action without constructing the full primitive.

Compute the D-axis fractional weight vector from a list of AccessReceipt records with role, timestamp, and content length. Returns canonical DataAxisEntry[] with 6-digit decimal contribution_weight strings that sum to ~1.0 and feed directly into aps_construct_attribution_primitive. Empty input returns an empty array, and all-zero raw weights return an error. Weights = role × recency_decay × length_weight, then normalized. Parameter names match the SDK: sources, action_timestamp, optional profile.

Compute the C-axis fractional weight vector from a list of inference billing records (prompt_tokens, completion_tokens). Returns canonical ComputeAxisEntry[] with 6-digit decimal compute_share strings that sum to ~1.0 and feed directly into aps_construct_attribution_primitive. Weights = prompt_tokens + completion_tokens × COMPLETION_MULTIPLIER (default 3.0), then normalized. Parameter names match the SDK: providers, optional profile.

Aggregate a batch of Attribution Primitives over a half-open settlement period [t0, t1) into a signed SettlementRecord. Each axis (D, P, G, C) produces a per-contributor total with a balanced-Merkle commitment. Residual buckets pool sub-threshold contributors. Output is a fully signed record ready for third-party verification.

Verify a signed SettlementRecord under S1-S5 (signature, Merkle roots, conservation, residual shape, optional input-receipts cross-check). S3 conservation is the strongest invariant: a gateway cannot inflate or suppress any contributor's share without breaking it. Returns {valid: true} or {valid: false, reason, detail}. Pass inputReceipts to also recompute input_receipts_hash.

Build a contributor-query response: given a signed SettlementRecord and a contributor DID, return per-axis (total_weight, contribution_count, merkle_path, axis_root) plus the full signed record so a third party can verify the contributor's share end-to-end without trusting the gateway beyond its public key. Returns null if the contributor has no share in the period.

Build and sign a mutual-auth certificate identifying an agent or information system. Returns the signed MutualAuthCertificate object ready to carry into a handshake. The issuer's Ed25519 private key (hex) signs over the canonical (JCS) form.

Verify a MutualAuthAttest against policy and trust anchors. Runs all 10 verification checks: signature, version negotiation, nonce match, timestamp freshness, certificate validity, issuer anchor check, binding constraints, downgrade detection, attestation grade policy, capability policy. Returns ok:true on success or a failure reason on rejection.

Derive the shared mutual-auth session record from both sides' Attests. Both parties MUST compute identical session_id given identical inputs (canonical JCS + sha256 of chosen_version, both cert ids, both nonces). Returns a MutualAuthSession with session_id + both certificates + expiry bounds, or failure reason.

Verify a TrustAnchorBundle signature and freshness. Caller supplies the list of trusted publisher public keys (root configuration). Returns ok:true on success or failure reason (untrusted_publisher, signature_invalid, bundle_expired, not_yet_valid).

v0.1 capability-token sink challenge (M1). Sink issues a signed canonical action statement. Returns the SinkChallenge and its challenge_hash. Used to bind the gateway's later policy evaluation to a specific action the sink authored. Search keywords: capability token, sink challenge, M1.

v0.1 capability-token authority evaluation request (M2). Subject signs a request carrying the sink's M1, the delegation chain, and a revealed authority-token preimage. The gateway consumes this to decide permit/deny. Search keywords: capability token, authority evaluation, M2.

v0.1 capability-token gateway receipt (M3). Gateway signs a permit or deny over the sink's exact challenge_hash. Echoes the M2 delegation_chain_root so the sink can verify the gateway saw the same chain the subject committed to. Search keywords: capability token, challenge receipt, gateway receipt, M3.

v0.1 capability-token sink effect receipt (M4). The sink verifies the gateway's M3, consumes the token preimage (rejecting a replayed nullifier), and signs an EffectReceipt binding the consumed token to the action result the caller supplies. This tool does not execute the action. The (M1, M3, M4) tuple is the full attestation record. Search keywords: capability token, effect receipt, M4, sink attestation.