Skip to main content
Glama
agent-passport-system

agent-passport-system-mcp

by agent-passport-system
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript

Record Owner Confirmation

aps_record_owner_confirmation
Read-onlyIdempotent

Sign an OwnerConfirmation in one call to authorize a flagged action; the approval is hash-bound to action details and scoped per action, session, or time window.

Instructions

Escalation boundary: owner signs an OwnerConfirmation authorizing a flagged action. Builds the ConfirmationRequest and signs it in a single call. The confirmation is bound to action_details via hash and scoped (per_action / per_session / time_window).

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
delegationYesV2Delegation with escalation_requirements for this action class
session_idNoSession id (required for per_session scope)
action_classYesAction class being confirmed
action_detailsYesStructured action details — hashed and bound to the confirmation
owner_private_keyYesHex private key of the delegation's owner (delegator)

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed3 schema fields changedv4.0.0
    • changedInput schema / $schema
      Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"
    • removedInput schema / additionalProperties
      Removed value: -false
    • changedInput schema / required
      Previous value: -[
-  "action_class",
-  "owner_private_key"
-]New value: +[
+  "delegation",
+  "action_class",
+  "action_details",
+  "owner_private_key"
+]
  2. Addedv2.8.0

TDQS

B3.1/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description says the tool builds and signs a confirmation and the tool name records one, i.e. it produces a new signed artifact, yet annotations declare readOnlyHint=true and destructiveHint=false. The only genuine behavioral disclosure (hash binding, scope modes) does not resolve this mismatch.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three dense sentences and no filler; the escalation framing is front-loaded. Slightly jargon-heavy about scope without defining the three modes, but nothing is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a no-output-schema tool with annotations that are at least questionable, the description covers what is produced but omits prerequisites (delegation must carry escalation_requirements) and what the caller gets back. Adequate but with clear gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds real meaning beyond the schema: it explains that the confirmation is bound to action_details via hash and that scope determines which inputs matter (e.g. session_id for per_session). That is semantics the schema only gestures at.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and artifact: the owner signs an OwnerConfirmation authorizing a flagged action, built and signed in one call. That is far more specific than siblings like request_human_approval or aps_check_escalation_required, though the description never names those siblings to disambiguate the escalation workflow.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Escalation boundary' implies this is used once an action has been flagged as requiring escalation, but it never states the precondition explicitly or points to aps_check_escalation_required as the tool that determines whether escalation is needed. Usage is inferable rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools