Skip to main content
Glama
dhuzard

Research Deposition MCP

by dhuzard

Research Deposition MCP

CI License: MIT Status: early development

A safety-first Model Context Protocol (MCP) server for preparing scholarly deposits from agentic research workflows. Zenodo is the first repository adapter; the core model is intentionally repository-independent.

Project status: v0.2 in progress / early development. Use Zenodo Sandbox for testing. Package identity and signed human approval are implemented; full remote-draft/file attestation remains planned in #10.

Why this exists

Repository APIs make programmatic deposition possible, but a raw API wrapper is not enough for trustworthy agentic publishing. Research Deposition MCP separates three responsibilities:

  1. Agent/LLM — interpret researcher intent and assemble candidate metadata.

  2. Deterministic deposition layer — validate, canonicalize, hash, transform, upload, and report inconsistencies.

  3. Human/operator — authorize publication of a specific immutable package using a signing key kept outside the MCP/agent environment.

The design principle is simple: agents may help prepare a deposit, but they should not silently invent scientific metadata or obtain implicit authority to publish it.

Related MCP server: ArtifactGuard

Current scope

Implemented:

  • repository-independent research-deposit model;

  • deterministic schema validation with warnings;

  • deterministic file selection with explicit include/exclude rules;

  • repository-independent file manifest with POSIX/NFC-normalized source/deposit paths, byte size, and SHA-256;

  • canonical byte-stable file-manifest serialization;

  • canonical scientific metadata serialization;

  • versioned publication package combining metadata + manifest;

  • SHA-256 package digest with domain separation;

  • strict rejection of symlinks/path traversal for manifest construction;

  • Zenodo adapter and Zenodo Sandbox default;

  • draft creation, retrieval, metadata update, and local file upload;

  • publication review that emits the exact approval request;

  • Ed25519 operator-signed, short-lived approval receipts;

  • pre-publication package digest recomputation;

  • approval binding to package digest, repository adapter, endpoint, draft ID, and policy version;

  • publication disabled by default at process level.

Still planned include wiring the append-only audit event log (#9) into the MCP tool handlers, full Zenodo remote-package verification and Sandbox E2E coverage (#10), RO-Crate/CITATION.cff/ISA/ORW importers, identifier validation, and additional repository adapters. See ROADMAP.md and BACKLOG.md.

MCP tools

Tool

Purpose

Publishes?

deposition_status

Report backend, approval verifier, and safety configuration without exposing secrets

No

validate_deposition

Validate repository-independent metadata

No

build_file_manifest

Deterministically select and SHA-256 files without uploading them

No

build_publication_package

Canonicalize metadata + manifest and compute the package digest

No

create_draft

Validate metadata and create an unpublished Zenodo draft

No

get_draft

Retrieve a draft

No

update_draft

Validate and replace draft metadata

No

upload_file

Upload a local file to a draft

No

publication_review

Recompute the package, retrieve the draft, and return the approval request

No

publish_draft

Recompute package, verify signed approval, then publish if process policy permits

Yes

See docs/file-manifest.md, docs/package-identity.md, and docs/approval.md.

Safety defaults

ZENODO_BASE_URL=https://sandbox.zenodo.org
ZENODO_ALLOW_PUBLISH=false
DEPOSITION_PUBLICATION_POLICY_VERSION=1
DEPOSITION_APPROVAL_MAX_AGE_SECONDS=900

A valid approval receipt does not enable publication by itself. Final publication requires both:

  1. deliberate process configuration (ZENODO_ALLOW_PUBLISH=true); and

  2. a valid operator-signed receipt matching the freshly recomputed package and exact target.

The private approval key is intentionally not used by the MCP server. See docs/safety-model.md.

Requirements

  • Node.js 20+

  • npm

  • a Zenodo Sandbox personal access token for writable tests

Install

git clone https://github.com/dhuzard/Research-Deposition-MCP.git
cd Research-Deposition-MCP
npm install
npm test

Create a Zenodo Sandbox token and start the MCP server:

export ZENODO_API_KEY="..."
npm start

Do not commit tokens or put them into MCP configuration files that will be version-controlled.

Local CLI

research-deposition is a local, read-only operator CLI. It validates a package config and its selected files and computes the deterministic package digest; it never talks to a repository and never writes anything.

research-deposition status [--json]
research-deposition package check <config.json> [--json]
research-deposition package digest <config.json> [--json]

A package config is JSON with schemaVersion: "1", repository-independent metadata, and an explicit files list of { "sourcePath": "...", "depositName": "..." } entries. sourcePath is resolved relative to the directory containing the config file (the implicit root) and is treated as a literal file path, not a glob. --json emits exactly one JSON document to stdout, including on validation failure; without it, output is human-readable. Exit codes: 0 for a valid (or warning-only) result, 1 for an invalid config/metadata/file or a runtime safety rejection, 2 for usage errors. Tokens are never accepted as CLI flags and are never logged; status only reports whether one is configured via ZENODO_API_KEY.

MCP client example

{
  "mcpServers": {
    "research-deposition": {
      "command": "node",
      "args": ["/absolute/path/Research-Deposition-MCP/build/src/index.js"],
      "env": {
        "ZENODO_API_KEY": "YOUR_SANDBOX_TOKEN",
        "ZENODO_BASE_URL": "https://sandbox.zenodo.org",
        "DEPOSITION_APPROVAL_PUBLIC_KEY_FILE": "/safe/path/operator-public.pem"
      }
    }
  }
}

Only the public approval key belongs in the MCP process.

Repository-independent metadata

{
  "title": "Home-cage behavioral dataset",
  "description": "Behavioral and experimental metadata for ...",
  "resourceType": "dataset",
  "creators": [
    {
      "name": "Huzard, Damien",
      "orcid": "0000-0000-0000-0000",
      "affiliation": "..."
    }
  ],
  "keywords": ["FAIR", "home-cage monitoring"],
  "license": "cc-by-4.0",
  "version": "1.0.0",
  "relatedIdentifiers": []
}

The common model deliberately avoids Zenodo field names. Repository-specific transformations live in adapters.

File manifest

{
  "rootDir": "/path/to/project",
  "include": ["data/**", "README.md"],
  "exclude": ["data/intermediate/**"],
  "destinations": {
    "README.md": "documentation/README.md"
  }
}

build_file_manifest returns a canonical manifest containing only repository-independent relative paths and content identity. Absolute local paths are not serialized. Symlinks and .. traversal are rejected.

Publication package and digest

build_publication_package combines canonical metadata with the canonical file manifest. The resulting digest has the form:

sha256:<64 lowercase hex characters>

The digest is over a versioned canonical JSON representation with explicit domain separation. Creator order is significant. Keywords and related identifiers are canonicalized as unordered sets. Unknown operational metadata fields and machine-local root paths do not affect the digest.

The full contract and golden test fixture are documented in docs/package-identity.md.

Human approval workflow

Generate an operator key pair outside the agent workspace:

npm run build
research-deposition-approve keygen \
  --private-key ~/.config/research-deposition/operator-private.pem \
  --public-key ~/.config/research-deposition/operator-public.pem

Configure the MCP process with only the public key:

export DEPOSITION_APPROVAL_PUBLIC_KEY_FILE="$HOME/.config/research-deposition/operator-public.pem"

Call publication_review with the draft ID, metadata, root directory, and file-selection rules. It returns an approvalRequest containing the package digest and exact publication target.

Save that request as JSON and sign it interactively:

research-deposition-approve sign \
  --request approval-request.json \
  --private-key ~/.config/research-deposition/operator-private.pem \
  --receipt approval-receipt.json

The signing command requires a TTY and an exact human-entered confirmation phrase. There is intentionally no non-interactive bypass flag.

publish_draft then requires the receipt plus the metadata/file-selection inputs. It re-reads the selected files and recomputes the package digest immediately before verifying the receipt and publishing.

Any change to metadata, selected file content, selected filenames, repository endpoint, draft ID, or configured policy version invalidates the authorization.

See docs/approval.md for the complete protocol and its current limitations.

Audit event log

src/audit.ts defines a repository-independent, append-only audit event schema (v1) with a domain-separated SHA-256 hash chain, plus an AuditFileSink NDJSON persistence layer (src/audit-sinks.ts) that validates any existing log and refuses to resume a tampered one. It records operation-level activity — validation, manifest/digest generation, draft and file operations, approval lifecycle, publication — without repository tokens, the approval private key, or arbitrary payloads.

The chain is tamper-evident, not tamper-proof; see docs/audit.md for its guarantees and limits (in particular, detecting tail truncation requires an externally held checkpoint hash). This module is not yet wired into the MCP tool handlers.

Architecture

Agentic client
     │ MCP
     ▼
Research Deposition MCP
 ├─ deterministic validation / policy
 ├─ common research-deposit model
 ├─ deterministic file-manifest layer
 ├─ canonical publication-package identity
 ├─ operator public-key receipt verification
 └─ repository adapters
       ├─ Zenodo
       ├─ InvenioRDM (planned)
       └─ Dataverse (planned)

Human/operator side
 └─ private Ed25519 key + interactive approval CLI

Metadata-source adapters will eventually map structures such as ISA, RO-Crate, CITATION.cff, and Open Research Workspace (ORW) metadata into the common model without coupling those standards to Zenodo.

More detail: docs/architecture.md.

Environment variables

Variable

Default

Description

ZENODO_API_KEY

unset

Zenodo/Sandbox bearer token. Required for deposition operations.

ZENODO_BASE_URL

https://sandbox.zenodo.org

Repository endpoint and part of the approval target.

ZENODO_ALLOW_PUBLISH

false

Process-level final-publication enablement.

ZENODO_MAX_UPLOAD_BYTES

52428800

Per-file local safety ceiling used by this server.

DEPOSITION_APPROVAL_PUBLIC_KEY_FILE

unset

Operator public Ed25519 key used to verify receipts. Final publication fails closed when unset.

DEPOSITION_PUBLICATION_POLICY_VERSION

1

Policy identifier included in approval requests/receipts. Changing it invalidates older receipts.

DEPOSITION_APPROVAL_MAX_AGE_SECONDS

900

Server-side maximum accepted receipt age.

Current integrity boundary

The signed receipt authorizes the declared local publication package and exact repository target. The server recomputes that local package immediately before publication.

Full proof that the current remote Zenodo draft contains exactly the same file set is not yet implemented; that is part of #10. Direct upload_file operations therefore remain a known gap before this should be treated as production-grade remote package attestation.

Development

npm install
npm run build
npm test

Source code lives under src/; repository-specific code belongs under src/adapters/. Tests use Node's built-in test runner.

Before adding any new write capability, read AGENTS.md, CONTRIBUTING.md, and docs/safety-model.md.

Contributing

Issues and pull requests are welcome. For substantial features, open an issue first so the data model, safety boundary, and repository semantics can be discussed before implementation. See CONTRIBUTING.md.

For security-sensitive problems, do not open a public issue; follow SECURITY.md.

License

MIT — see LICENSE.

Available Tools

10 tools
build_file_manifestA

Build a deterministic repository-independent SHA-256 manifest from explicit include/exclude rules. Never uploads or publishes files.

ParametersJSON Schema
NameRequiredDescriptionDefault
excludeNo
includeYes
rootDirYes
destinationsNo

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full disclosure burden. It does that meaningfully by stating deterministic output, SHA-256 hashing, and the critical fact that nothing is uploaded or published. It omits some edge-case behavior, but the core behavioral profile is clear and safety-relevant.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no filler. The core action and output are front-loaded, and the side-effect disclaimer is cleanly separated. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has four parameters including a nested object, no annotations, and no output schema, yet the description does not explain return values, destinations, rootDir behavior, or how include/exclude rules are interpreted. An agent would need to infer too much to invoke it correctly on the first attempt.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for the schema's silence. It mentions include/exclude rules but gives no semantics for rootDir, no pattern syntax for include/exclude entries, and no explanation of the destinations object. Four parameters remain effectively undocumented from the agent's perspective.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb ('Build') and resource ('deterministic repository-independent SHA-256 manifest'), and its side-effect disclaimer ('Never uploads or publishes files') clearly differentiates it from siblings like upload_file and publish_draft. The agent can tell what this tool is for without inspecting the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The 'Never uploads or publishes files' clause gives useful routing context and implies this is a local, side-effect-free preparation step. However, it does not explicitly state when to prefer this tool over build_publication_package or other alternatives, nor does it describe preconditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

build_publication_packageB

Build canonical metadata + file manifest and compute the package SHA-256 identity. Never writes to a repository.

ParametersJSON Schema
NameRequiredDescriptionDefault
excludeNo
includeYes
rootDirYes
metadataYes
destinationsNo

TDQS

B3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It usefully states 'Never writes to a repository,' which is a strong side-effect guarantee, but it does not disclose what the tool returns, whether it reads from the filesystem, or how it handles errors or missing files.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two brief sentences with no filler. The core action and the key side-effect constraint are front-loaded, making the description easy to scan and process.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has five parameters, no output schema, no annotations, and multiple siblings, yet the description provides minimal workflow context. It does not explain the return value, how to structure metadata, or how destinations are used, leaving substantial gaps for an agent deciding to invoke it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must explain the parameters, but it only vaguely gestures at 'metadata' and 'file manifest.' It does not explain rootDir, include, exclude, or destinations, leaving an agent to guess their roles despite five parameters and nested objects.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific action ('Build') and a concrete deliverable ('canonical metadata + file manifest') plus a distinguishing output ('package SHA-256 identity'). It is clear enough to differentiate from sibling tools like build_file_manifest, though it does not explicitly call out that distinction.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no guidance about when to use this tool versus siblings such as build_file_manifest, create_draft, or validate_deposition. 'Never writes to a repository' is a behavioral constraint, not a usage guideline, and there is no mention of prerequisites or workflow context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

create_draftB

Validate metadata and create an unpublished repository draft. Default backend is Zenodo Sandbox.

ParametersJSON Schema
NameRequiredDescriptionDefault
metadataYes

TDQS

B3.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description is responsible for behavioral disclosure. It does add useful detail: metadata validation happens, the result is an unpublished draft rather than a published record, and the default environment is Zenodo Sandbox. However, it does not disclose permissions, error behavior, or what the operation returns.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with no filler. The primary action is front-loaded, and the default backend is stated as a separate, useful second sentence. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a simple one-parameter tool, but with no output schema or annotations, the description leaves gaps: it does not mention the return value, how the draft is referenced later, or how it fits into the workflow with upload_file and publish_draft. It is minimally viable but not complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema shows a required 'metadata' property with no description, and schema description coverage is 0%. The description names metadata and says it is validated, but does not explain the expected structure, required fields, or format, so it fails to compensate for the empty schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the action ('create') and resource ('unpublished repository draft'), and mentions an additional validation step. This differentiates it from siblings like get_draft, update_draft, and publish_draft by verb and state, though it does not explicitly name an alternative tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit guidance on when to use this tool versus validate_deposition, update_draft, or publish_draft. The default-backend note gives environment context but does not explain prerequisites, sequencing, or when not to use the tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

deposition_statusA

Report deposition backend and safety configuration. Does not expose secrets.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It adds one useful trait: 'Does not expose secrets', which is a safety note. However, it does not mention whether the operation is read-only, any performance implications, or what the report contains beyond the generic phrase. The note is a positive, but coverage is minimal.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that front-loads the primary action and resource. It avoids redundancy and every word adds value, including the secret-safety caveat. It is appropriately sized for the tool's simplicity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's low complexity (no parameters, no output schema), the description covers the essential purpose and a key safety behavior. It could potentially elaborate on what 'safety configuration' includes or how the report is used in a workflow, but for a status query it is largely sufficient. The lack of output schema means the description should hint at the return value, which it does implicitly by stating what it reports.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the schema already provides complete coverage (100%). The description does not need to add parameter details since none exist. The baseline for 0 parameters is 4, and no deduction is warranted because there is nothing to describe.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear verb 'Report' and a specific resource 'deposition backend and safety configuration'. It distinguishes itself from sibling tools like validate_deposition, build_file_manifest, etc., which focus on actions, whereas this one is a status query. The purpose is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus alternatives. It does not mention scenarios where it should be called, such as before validation or publication, nor does it state when not to use it. The description simply describes the function without contextualizing its role among siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_draftC

Retrieve an existing unpublished deposition draft.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. 'Retrieve' implies a read-only operation, but the description does not state whether the result is the full draft, what happens for missing IDs, or whether any side effects or permissions are involved. This is minimal coverage for a tool with no annotation safety hints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-formed sentence with no redundant words. It front-loads the core action and object, making it easy for an agent to scan and understand quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter retrieval tool, the description is minimally viable: the agent knows the action, the resource, and the existence condition. However, with no output schema and no annotations, it leaves room for ambiguity about the return payload and does not help an agent choose this tool over related read-oriented siblings.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has a single required 'id' parameter with zero description coverage, and the tool description does not explicitly explain what 'id' refers to beyond the inferred draft ID. The only added semantic is that the draft must be 'existing,' which is too thin to compensate for the missing parameter documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses the specific verb 'Retrieve' and names the resource, an existing unpublished deposition draft. This clearly distinguishes it from create_draft, update_draft, and publish_draft, though it does not explicitly contrast it with deposition_status or other read-adjacent siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given about when to use this tool versus siblings like validate_deposition, publication_review, or deposition_status. The phrase 'existing unpublished' hints at when the draft is retrievable, but there is no explicit when-to-use or when-not-to-use instruction.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

publication_reviewA

Rebuild the exact package identity, retrieve the draft, and return the approval request a human operator may sign out-of-band. Does not publish.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes
excludeNo
includeYes
rootDirYes
metadataYes
destinationsNo

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden, and it does disclose the key non-publishing behavior plus the out-of-band approval flow. However, it does not state whether the tool is fully read-only, what side effects 'rebuild' might have, or any permission requirements.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no filler; the primary action is front-loaded and the critical 'Does not publish' constraint is its own sentence. Every part earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 6 parameters, nested objects, no output schema, and no annotations, this description is too sparse. It does not describe the approval request return format, the meaning of metadata/destinations, or any prerequisites, leaving significant gaps for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, yet the description only hints that id relates to the draft and that metadata/rootDir/include contribute to 'package identity'. It does not explain exclude, destinations, or metadata semantics, so the agent cannot reliably map parameters to their roles.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names concrete actions ('rebuild the exact package identity', 'retrieve the draft', 'return the approval request') and explicitly states what it does not do ('Does not publish'). This clearly separates it from sibling publish_draft and makes its role obvious.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context: this is for obtaining an out-of-band human approval request before publishing. The phrase 'Does not publish' acts as a when-not, though it does not explicitly name an alternative such as publish_draft.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

publish_draftC

Publish only when process-level publication is enabled and a valid short-lived operator-signed receipt matches a freshly recomputed package, repository endpoint, draft, and policy.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes
excludeNo
includeYes
receiptYes
rootDirYes
metadataYes
destinationsNo

TDQS

C2.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses that publication is gated by process-level enablement and a valid receipt matching recomputed data, which is behavioral, but it does not describe the effect of the action, return value, error behavior, or side effects. Significant gaps remain.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that front-loads the critical condition. It is efficient and not verbose, though it is dense and may reduce readability. Still, it earns its place with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 7 parameters, including nested objects (metadata, destinations), and no output schema, the description is grossly inadequate. It only states preconditions and leaves agents to guess parameter meanings, return values, and error handling. This is far below the minimum needed for a complex mutation tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description does not explain any of the 7 parameters. It mentions 'receipt' and 'draft' conceptually but does not map them to the schema properties (id, receipt, metadata, rootDir, include, etc.). The description fails to compensate for the lack of schema documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states the verb 'Publish' and implies the resource (draft) via the tool name. It adds a specific conditional context that distinguishes it from sibling tools like create_draft or update_draft, but it does not explicitly name the resource in the description itself.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives a clear precondition ('Publish only when...') which implies when it should be used, but it does not mention alternatives, exclusions, or when not to use it. The condition is useful but lacks explicit routing to sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

update_draftB

Validate and replace metadata on an existing unpublished draft.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes
metadataYes

TDQS

B3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It says the operation validates and replaces metadata, but it does not explain whether replacement is partial or full, what happens if validation fails, whether the operation is reversible, or what the response will contain. This is a significant gap for a mutation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single focused sentence that front-loads the primary action and resource scope. Every word carries meaning, and there is no repetition or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no annotations, no output schema, and 0% parameter description coverage, the description is too sparse. An agent would not know the expected metadata shape, validation behavior, error conditions, or what the tool returns after success.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate by explaining the parameters. It gives some context by indicating that 'metadata' is replaced and 'id' refers to an existing draft, but it does not define the metadata object structure, validation rules, or any id semantics beyond a required string. The meaning added over the bare schema is thin.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Validate and replace metadata') and the target resource ('an existing unpublished draft'). It distinguishes itself from creation (create_draft), retrieval (get_draft), and publication (publish_draft), though it does not explicitly name a sibling or draw out the difference from validate_deposition.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'existing unpublished draft' implies it should be used for already-created, not-yet-published drafts, giving some contextual guidance. However, there is no explicit statement of when to choose this tool over validate_deposition or publish_draft, and no excluded use cases are listed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

upload_fileB

Upload a local file to an existing draft. Never publishes the draft.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes
filePathYes
remoteNameNo

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It does disclose a key behavioral trait: the operation never publishes the draft, which is valuable. However, it doesn't mention whether the upload is additive, whether it replaces existing files, whether it requires authentication, or what happens if the draft is already published. The single behavioral guarantee is helpful but incomplete for a mutation-like operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with no filler. The key action and the critical non-behavior (never publishes) are front-loaded. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no annotations, no output schema, and 0% parameter coverage, the description is too thin. An agent needs to know what 'id' refers to, whether the file is added or replaces existing content, and what the result of the upload is. The sibling tools suggest a draft workflow, but the description doesn't connect to that workflow explicitly. The 'never publishes' note is good, but overall the description leaves too much to inference.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for the three parameters. It does not explain what 'id' refers to (presumably the draft ID), what 'filePath' means (local path vs. remote path), or what 'remoteName' does. The description only mentions 'local file' and 'existing draft,' which partially maps to filePath and id, but remoteName is entirely unexplained. This is a significant gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Upload a local file') and the target resource ('an existing draft'), and distinguishes it from publishing by explicitly saying 'Never publishes the draft.' This is a specific verb+resource pairing that an agent can act on. It doesn't explicitly name a sibling alternative, but the contrast with publish_draft is implicit and clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool is for adding files to a draft, and the explicit 'Never publishes the draft' provides a useful exclusion. However, it doesn't state when to use this tool versus alternatives like build_file_manifest or update_draft, nor does it mention prerequisites like the draft needing to exist or the file path being accessible. Usage context is implied but not fully specified.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

validate_depositionA

Deterministically validate repository-independent research deposition metadata. Never publishes anything.

ParametersJSON Schema
NameRequiredDescriptionDefault
metadataYes

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It discloses two meaningful traits: the validation is 'deterministic' and it 'never publishes anything.' These provide clear side-effect expectations, though it does not explicitly state whether the tool is fully read-only or what the response looks like.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with no filler. The core purpose is front-loaded and the crucial safety qualifier ('Never publishes anything') is clearly separated. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no annotations, no output schema, and an undocumented parameter, the description is incomplete. It does not explain how to construct the metadata argument or what kind of result is returned (boolean, error list, etc.). The description covers intent and side effects but leaves the agent guessing about invocation and response.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has 0% description coverage and the single required parameter is just named 'metadata' with no type or structure. The description adds context that it is 'research deposition metadata' and 'repository-independent,' but it does not specify the expected structure, required fields, or format. This does not sufficiently compensate for the schema gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('validate') and a well-defined resource ('repository-independent research deposition metadata'), and the phrase 'Never publishes anything' distinguishes it from sibling tools like publish_draft and create_draft. An agent can clearly tell what this tool does and what it is not.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies safe pre-publication usage by stating 'Never publishes anything,' but it does not explicitly say when to call this tool (e.g., before publish_draft) or how it relates to alternatives like publication_review. No positive usage instruction is given, only a negative exclusion.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 10 tool updatesv0.1.0
    • First observedbuild_file_manifest
    • First observedbuild_publication_package
    • First observedcreate_draft
    • First observeddeposition_status
    • First observedget_draft
    • First observedpublication_review
    • First observedpublish_draft
    • First observedupdate_draft
    • First observedupload_file
    • First observedvalidate_deposition

TDQS

A3.6/5.0

Scored across 10 tools

Disambiguation5/5

Each tool has a clearly distinct responsibility in the deposition lifecycle—status, validation, manifest building, package building, draft creation, retrieval, update, file upload, review, and publication. Even the two validation-related tools (validate_deposition and create_draft) are separated by action, and descriptions clarify their boundaries.

Naming Consistency4/5

Most tools follow a consistent verb_noun pattern (validate_deposition, build_file_manifest, create_draft, upload_file, publish_draft), but a few use noun-first names (deposition_status, publication_review) that break the pattern slightly. This is a minor deviation and does not impede understanding.

Tool Count5/5

With 10 tools covering the complete deposition workflow, the count is well within the ideal 3-15 range. Each tool serves a necessary, non-redundant role in the pipeline, and none feel extraneous.

Completeness5/5

The tool set covers the full deposition lifecycle: validation, manifest/package building, draft creation/retrieval/update, file upload, review, and publication. There are no obvious gaps for the stated purpose—only minor absent operations like listing or deleting drafts, which are not critical to the core workflow.

Maintenance

ActivityMaintained
ResponsivenessUnresponsive

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    B
    maintenance
    Enables AI agents to create cryptographically verifiable receipts of their delegated work, with capabilities for multi-party approval and offline verification.
    11
    50 npm
    Apache 2.0
  • F
    license
    Not graded
    quality
    B
    maintenance
    Enables AI agents to validate deliverables (JSON, ZIP, PDF, DOCX) against signed contracts, generating verifiable receipts with Ed25519 signatures.
    -
  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables agents to search, retrieve, and list open-licensed documents with verifiable provenance, attaching sha256, DOI, and OpenTimestamps proof to every response.
    1,674 npm
    Creative Commons Zero v1.0 Universal
  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables AI agents to index and search local skill libraries, persist and resume task checkpoints, and run validated workflow plans with controlled approval and write permissions.
    MIT