Skip to main content
Glama

brydge-mcp

Check whether your agent's work actually happened.

This is BRYDGE as an MCP server. Before an agent acts, BRYDGE decides whether it may. Afterwards, BRYDGE reads the destination system's own records, such as your payment processor or ticket system, using its own credential. It then reports whether the work happened as permitted. What the agent says happened is kept beside that finding and never decides it.

Tools

Tool

What it does

brydge_supervise

Asks before acting. ALLOWED returns an authorization id for the agent to write into the record the action creates. ESCALATED means a person decides, and the agent must not act.

brydge_report_outcome

Reports what the agent believes happened.

brydge_verify

Reads the destination's records now and says whether the work happened.

brydge_get_finding

Returns what BRYDGE has found so far, without reading the records again. Free.

brydge_get_headroom

Says how many actions the agent may take in any 24 hours before a person is asked.

The server also gives the model its instructions: ask first, cite the authorization, report, then verify before saying the work is done.

Related MCP server: Dvarapala

Set up BRYDGE first

Do these once, in BRYDGE:

  1. Issue an API key on the Connect page.

  2. Declare what the action is worth. BRYDGE charges a share of that value, and it will not check an action nobody has priced.

  3. Register a destination for the action: where BRYDGE reads the records, and the read-only credential it uses. BRYDGE has a preset for Stripe refunds.

  4. Issue a mandate to the agent for the action. Without one, every call goes to a person.

A mandate says what the agent may do; headroom says how much of it, in any 24 hours. A new agent starts with room for one action a day, and every report BRYDGE checks and finds true raises that.

Add it to your MCP client

Most clients take this configuration (Claude Desktop, Cursor, Windsurf and others):

{
  "mcpServers": {
    "brydge": {
      "command": "npx",
      "args": ["-y", "brydge-mcp"],
      "env": {
        "BRYDGE_API_KEY": "brydge_sk_...",
        "BRYDGE_ACTOR": "agent:refund-ops"
      }
    }
  }
}

On Windows, npx is a .cmd file, and only clients that start commands through a shell or through the MCP SDK can launch it by name. If your client reports spawn npx ENOENT, start it through the command shell instead:

{
  "mcpServers": {
    "brydge": {
      "command": "cmd",
      "args": ["/c", "npx", "-y", "brydge-mcp"],
      "env": {
        "BRYDGE_API_KEY": "brydge_sk_...",
        "BRYDGE_ACTOR": "agent:refund-ops"
      }
    }
  }
}

In Claude Code:

claude mcp add brydge -e BRYDGE_API_KEY=brydge_sk_... -e BRYDGE_ACTOR=agent:refund-ops -- npx -y brydge-mcp

Setting

BRYDGE_API_KEY

Your BRYDGE API key. Required.

BRYDGE_ACTOR

The name BRYDGE knows this agent by, such as agent:refund-ops. Mandates are issued to this name. Required.

BRYDGE_URL

Where BRYDGE runs. Leave it unset for BRYDGE's hosted service.

The agent's name comes from this configuration, never from the model, so an agent cannot borrow another agent's permissions. Run one server per agent.

How an agent uses it

  1. Ask first. Before a refund, payment or other change, the agent calls brydge_supervise with the action, the target and the facts, such as {"amount": 4200}.

  2. Cite the authorization. If the answer is ALLOWED, the agent carries the action out and writes the authorization id where the destination keeps it. For a Stripe refund, that is metadata.brydge_authorization. BRYDGE finds the work by this id, and by nothing else.

  3. Report. The agent calls brydge_report_outcome with what it believes happened.

  4. Verify. Before saying the work is done, the agent calls brydge_verify.

brydge_supervise takes an idempotency_key, a name for one intended action such as refund:ch_123. Retrying with the same key gets the same answer. A key reused for a different action never gets another action's answer, because the server also hashes in what is being asked.

What a check can find

state

Meaning

VERIFIED

The records show the work, as it was permitted.

FAILED

The records show it was attempted and did not succeed.

MISMATCH

The records show something other than what was permitted. reason says what: AMOUNT, TARGET, ACTOR, ACTION, DUPLICATE_EXECUTION, UNAUTHORISED_EXECUTION or CORRELATION.

UNKNOWN

BRYDGE could not tell. NO_MATCH means the records hold nothing for this authorization; the other reasons mean BRYDGE could not read the records. Unknown is not the same as failed.

PENDING

The destination says the work is still in progress.

brydge_verify reads the records when it is called. A check that finds something new is billed; asking again when nothing has changed is free. BRYDGE also checks every action by itself once the destination's reporting window has passed (60 minutes unless you set another), and brydge_get_finding reads that for free.

Protocol

The server speaks MCP over stdio. It serves clients on the 2026-07-28 revision and on the 2025 revisions from the same process, built on the official TypeScript SDK. When BRYDGE cannot be asked (a bad key, an action with no declared value, a rate limit, or BRYDGE being unreachable), the tool returns an error the model can read, and nothing is carried out.

Limits

  • BRYDGE treats a target as one piece of work. A second record for the same target that carries a different authorization, such as a second partial refund of one charge, is reported as a MISMATCH.

  • The server does not wait for a person. An escalated action ends with the model being told a person decides, and a later request is decided afresh.

Development

npm install
npm test          # a real MCP client against the server in both protocol eras, and the built command over stdio
npm run test:int  # against a running BRYDGE; see tests/integration
npm run build

License

MIT

Available Tools

5 tools
brydge_get_findingWhat BRYDGE has found so farA
Read-onlyIdempotent

What BRYDGE has already found about an action, without reading the records again. Free. BRYDGE checks each action by itself once the destination's reporting window has passed; until then this says PENDING.

ParametersJSON Schema
NameRequiredDescriptionDefault
authorizationYesThe authorization id brydge_supervise returned for the action.

Output Schema

ParametersJSON Schema
NameRequiredDescription
stateYes
reasonYes
becauseYes
claimedYes
replayedYes
checkedAtYes
agentAgreedYes
externalRefYes
authorizationYes

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnly/idempotent/non-destructive annotations, the description adds meaningful behavioral details: it is free, it does not re-read records, BRYDGE checks each action by itself, and it reports PENDING until the reporting window passes. This gives the agent a solid model of what happens when the tool is called.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short, information-dense sentences with no filler. The primary purpose is front-loaded, and the behavioral caveat about PENDING is placed logically at the end.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter, read-only tool with an output schema, the description covers what is needed: what it returns, when it is available, cost, and side-effect behavior. Nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, and the schema already specifies that authorization is the id returned by brydge_supervise. The tool description does not add new parameter-level semantics, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states that the tool returns what BRYDGE has already found about an action without re-reading records, and the title reinforces the retrieval purpose. It does not explicitly name or distinguish sibling tools, so it misses the top score.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear contextual timing: use this tool after the destination's reporting window has passed, and expect PENDING before that. It implies the tool is the cheap, direct way to retrieve an existing finding, but it does not explicitly state when to prefer a sibling alternative.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

brydge_get_headroomHow much you may do without a personA
Read-onlyIdempotent

How many actions of this kind you may take in any 24 hours before a person is asked, how many are left, and what raises or lowers that. Every report BRYDGE checks and finds true raises it.

ParametersJSON Schema
NameRequiredDescriptionDefault
actionYesThe kind of work, as it is set up in BRYDGE, such as refund.

Output Schema

ParametersJSON Schema
NameRequiredDescription
saysYes
usedYes
actionYes
earnedYes
lowersYes
raisesYes
actionsYes
remainingYes

TDQS

A3.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds meaningful behavioral context beyond that: the 24-hour period, the human-approval threshold, and the fact that verified reports raise the headroom. This helps the agent understand side effects and limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is appropriately short for a simple query tool, front-loading the core meaning in the first sentence. Both sentences contribute value, though the phrasing is slightly dense and could be clearer.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only tool with one documented parameter and an output schema, the description covers the essential information: what is counted, the time window, remaining capacity, and influencing factors. Missing error-case details are not critical at this complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter `action` is already fully documented at 100% schema coverage with an example. The description reinforces that the headroom applies to 'actions of this kind' but adds no new format, syntax, or value constraints beyond what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states what the tool does: it reports how many actions of a given kind may be performed in a 24-hour window, how many remain, and what affects that limit. It is a specific query about headroom, though it does not explicitly differentiate itself from sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given about when to use this tool versus siblings like brydge_supervise, brydge_report_outcome, or brydge_get_finding. The quota framing implies it should be checked before acting, but that is left to inference rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

brydge_report_outcomeReport what happenedA

Tell BRYDGE what you believe happened after you carried out an allowed action. BRYDGE keeps your report beside what it finds in the destination's records; the report never changes the finding.

ParametersJSON Schema
NameRequiredDescriptionDefault
saidNoWhat the destination said, in its own words.
outcomeYesSUCCEEDED: it was carried out and did what it was meant to. FAILED: the destination refused it or errored. REVERSED: it happened and was undone. CORRECTED: it happened and had to be fixed afterwards.
authorizationYesThe authorization id brydge_supervise returned for the action.

Output Schema

ParametersJSON Schema
NameRequiredDescription
recordedYes
authorizationYes

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds meaningful behavioral context beyond the annotations: the report is stored alongside the destination's records and never changes the finding. This clarifies that the tool records a subjective account rather than altering the authoritative result, which is useful beyond the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences with no filler. The first sentence delivers the core action and timing, and the second adds an important behavioral guarantee. Information is front-loaded and every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a reporting tool with full parameter schema coverage, an output schema, and annotations, the description provides the essential behavioral context. It explains the report's purpose, when it is used, and that it does not affect the official finding, which is sufficient for an agent to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the parameter descriptions already explain outcome values, authorization, and the optional said field. The tool description adds no new parameter-level meaning, so the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear action and object: tell BRYDGE what you believe happened after an allowed action. It also clarifies the report's non-authoritative role, which helps distinguish it from sibling tools, though it never names them explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly indicates when to use the tool: after carrying out an allowed action. It does not explicitly state when not to use it or name alternatives like brydge_verify, but the context is specific enough for an agent to infer the intended moment of use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

brydge_superviseAsk BRYDGE before actingA
Idempotent

Ask BRYDGE whether you may take an action, before you take it. ALLOWED returns an authorization id: carry the action out and write that id into the record it creates, where the destination keeps it (for a Stripe refund: metadata.brydge_authorization). ESCALATED means a person decides: do not carry it out.

ParametersJSON Schema
NameRequiredDescriptionDefault
factsNoWhat BRYDGE's rules judge the action by, such as {"amount": 4200}. BRYDGE compares a fact named amount with the amount in the destination's record, so give it in the same units.
actionYesThe kind of work, as it is set up in BRYDGE, such as refund.
targetYesWhat the work acts on: the charge, order or ticket id.
idempotency_keyYesA name for this one intended action, such as refund:ch_123. Send the same value if you retry the same action; never reuse it for a different one.

Output Schema

ParametersJSON Schema
NameRequiredDescription
becauseYes
decisionYes
replayedYes
unobservedYes
authorizationYes

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already signal non-read-only, non-destructive, and idempotent behavior. The description adds valuable context: the ALLOWED response includes an authorization id to be written into the record, and ESCALATED means a human must decide. This goes beyond what annotations provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences with no filler. The purpose is front-loaded, and the response-handling instructions are concise and actionable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the output schema exists and idempotency is declared, the description covers the essential use case: when to call, what the response means, and how to proceed. It omits edge cases like denial handling beyond ESCALATED, but this is minor.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema provides 100% coverage with detailed descriptions for all four parameters, so the tool description doesn't need to add parameter info. It adds none, which is acceptable given the schema's richness; baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Ask'), a resource ('BRYDGE'), and the exact purpose ('whether you may take an action'). It clearly distinguishes this from sibling tools like brydge_verify or brydge_report_outcome by framing it as a pre-action permission gate.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly says to use it 'before you take it' and explains how to handle ALLOWED vs ESCALATED outcomes. However, it does not explicitly name alternatives or state when NOT to use it, though the purpose is distinct enough that an agent can infer.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

brydge_verifyCheck the work actually happenedA
Idempotent

Check whether an action actually happened. BRYDGE reads the destination system's own records now, with its own credential, and compares them with what it permitted. Only VERIFIED means it happened as permitted; FAILED, MISMATCH, UNKNOWN (BRYDGE could not tell) and PENDING (still in progress) are not. Use it before you tell anyone the work is done. A check that finds something new is billed; asking again when nothing has changed is free.

ParametersJSON Schema
NameRequiredDescriptionDefault
authorizationYesThe authorization id brydge_supervise returned for the action.

Output Schema

ParametersJSON Schema
NameRequiredDescription
stateYes
reasonYes
becauseYes
claimedYes
replayedYes
checkedAtYes
agentAgreedYes
externalRefYes
authorizationYes

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds significant behavioral context beyond annotations: it explains that BRYDGE reads the destination system's own records with its own credential, and outlines possible statuses (VERIFIED, FAILED, MISMATCH, UNKNOWN, PENDING). It also discloses billing behavior, which is not in annotations. This is richer than the typical description and aligns with the idempotentHint (free re-checks when nothing changed).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise yet dense, with the core purpose front-loaded. Each sentence adds value: the method, status definitions, usage timing, and billing nuance. There is no redundancy or filler, making it efficient and well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the single parameter, an existing output schema, and annotations, the description covers all essential aspects: what the tool does, how it verifies, what statuses mean, when to use it, and cost implications. No critical information is missing for an agent to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already provides a clear description for the single parameter ('The authorization id brydge_supervise returned for the action'), and coverage is 100%. The tool description adds no extra meaning about the parameter itself, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Check whether an action actually happened.' It specifies the method (reads destination system's records and compares) and distinguishes verification statuses. It implies a distinct role from siblings like brydge_supervise, which likely initiates actions, making the purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit usage guidance: 'Use it before you tell anyone the work is done.' It also provides cost implications ('A check that finds something new is billed; asking again when nothing has changed is free'), which helps decide when to call. It doesn't explicitly name alternatives, but the context and sibling list imply the right conditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 5 tool updatesv0.1.0
    • First observedbrydge_get_finding
    • First observedbrydge_get_headroom
    • First observedbrydge_report_outcome
    • First observedbrydge_supervise
    • First observedbrydge_verify

TDQS

A4.2/5.0

Scored across 5 tools

Disambiguation5/5

Each tool has a clearly distinct purpose: supervise (request permission), report_outcome (report results), verify (check actual state), get_finding (retrieve stored findings), and get_headroom (check quota). No two tools overlap in function; an agent can easily select the right one based on the action needed.

Naming Consistency5/5

All tools follow a consistent 'brydge_' prefix with a verb or verb_noun pattern (e.g., supervise, report_outcome, verify, get_finding, get_headroom). The naming is uniform, predictable, and clearly indicates the action each tool performs.

Tool Count5/5

With only 5 tools, the server is well-scoped to its domain of permission, reporting, verification, and quota management. Each tool earns its place and together they cover the core workflow without unnecessary bloat.

Completeness5/5

The tool surface covers the full lifecycle: request permission (supervise), report outcome (report_outcome), verify actual state (verify), retrieve past findings (get_finding), and check limits (get_headroom). No obvious gaps exist for the stated purpose.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    C
    maintenance
    Provides permission gates and tamper-evident audit logging for AI agent tool executions, with declarative policies, consent ladders, and hash-chained verification.
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables MCP-compatible AI agents to safely act on business backends by enforcing per-agent permissions, autonomy thresholds, human approval with review-and-edit, and full audit trails.
    MIT
  • A
    license
    B
    quality
    C
    maintenance
    Enables AI agents to act on live business objects under enforceable per-call identity, per-tool grants, and mandatory human approval for irreversible actions, with connectors isolated from core logic.
    8
    MIT