Skip to main content
Glama

Cedulon

Maintained by VERAX Teknoloji. Start with the VERAX body: verax-ai/verax. Related projects: Conarium · Tugra.

Audit layer for agent-to-agent spend: signed trade manifest, fail-closed policy, signed spend receipt (SCITT-anchorable).

Cedulon is not a payment rail. It sits above x402 and AP2.

The packages are on npm and the MCP server is in the MCP Registry, but nothing here touches money: no real wallets and no network rails, only mock fixtures. cedulon_spend settles on a mock rail and says so in its own description.

Core packages carry zero runtime dependencies; the MCP server package depends only on the official MCP SDK.

Requirements

  • Node.js 22 or newer (20+ for the libraries; scripts use Node type stripping)

  • npm 10 or newer

Related MCP server: Trust Gate MCP

Install and run (clean clone)

npm install
npx tsc --noEmit
npm run test:all
npm run demo

npm run tamper is expected to exit non-zero (tampered bytes fail verify).

npm run demo:unguarded shows the unprotected hole: 100/100 allows.

npm run audit must exit 0 (audit: balanced).

npm run demo:bypass must exit non-zero: audit: 1 settlement without receipt → FAIL.

npm run demo:bypasses prints four FAIL lines (missing receipt, wrong amount, null-ref, garbage chain head) and exits 0 only when every bypass is caught; a missed bypass makes it exit non-zero.

npm run demo:live reconciles a real Base Sepolia USDC window instead of a fixture. Read-only: it needs an RPC URL in CEDULON_RPC_URL and no wallet, key, or transaction. Against an account whose receipts you do not hold, every settlement the chain reports comes back as a gap.

A third party can reproduce this without trusting us: docs/RUN_AS_VERIFIER.md.

Five-minute path, including the MCP host config: docs/QUICKSTART.md.

MCP server

Cedulon can run as a local stdio MCP server. The host talks JSON-RPC on stdin/stdout. The five tools are thin wrappers over the existing packages; they do not reimplement policy, receipts, or audit.

Tool

Arguments

Result

cedulon_spend

amount (string), currency, payee, nonce, optional tool

Allow → signed receipt JSON. Deny → { ok: false, reason } (for example limit-amount).

cedulon_audit

optional extract (a signed rail extract you were presented with: body, signature, publicKeyPem), the trust roots (trust, issuerTrust, witnessTrust, payeeTrust, manifest, manifestTrust), optional extraSettlements[] (ref, amount, currency, timestampMs; refused beside extract)

{ ok, summary, findings, warnings, guarantee, counts }, plus scope when the audit ran over a presented extract; counts is the class every receipt and row landed in. Balanced books print audit: balanced.

cedulon_verify_receipt

receipt object, or coseHex + publicKeyPem, optional countersignature fields

{ ok, receipt, countersignature }

cedulon_export_ledger

none

Receipts + checkpoint + extract in the demo:export JSON shape

cedulon_status

none

{ version, policy, receiptCount, chainHead }

Claude Desktop / Claude Code / Cursor. Nothing to clone and nothing to build:

{
  "mcpServers": {
    "cedulon": {
      "command": "npx",
      "args": ["-y", "@cedulon/mcp-server"]
    }
  }
}

In Claude Code that config is one command:

claude mcp add cedulon -- npx -y @cedulon/mcp-server

Policy limits come from the environment: CEDULON_MAX_AMOUNT, CEDULON_MAX_CUMULATIVE, CEDULON_MAX_PAYMENTS, CEDULON_WINDOW_MS, CEDULON_ALLOWED_PAYEES, CEDULON_ALLOWED_CURRENCIES, CEDULON_ALLOWED_TOOLS, CEDULON_PAYER. Set CEDULON_STATE_PATH to keep the receipt chain across restarts; without it the ledger lives in memory.

Working inside this repository instead, against the sources:

npm run mcp

The server is listed in the MCP Registry as io.github.dogrucanemek-alt/cedulon; server.json is the entry it is published from.

npm run mcpb builds an .mcpb bundle — a zip holding the server and its dependencies, which a desktop host installs in one click, with the policy caps exposed as settings. It installs the released npm package rather than packing the working tree, so the bundle holds what npm would have given you, and the version must already be released. The result lands in build/ and is a release artifact, not source. Released bundles are attached to the matching GitHub release, with the bundle's SHA-256 in the release notes; v0.13.0 carries cedulon-0.13.0.mcpb, and v0.12.0 the one before it.

smithery.yaml is the older ecosystem format and is not submitted; Smithery's current instructions take an HTTPS endpoint or an .mcpb bundle.

There is also a Dockerfile, for hosts and directories that build the repository rather than install the package:

docker build -t cedulon .
docker run -i --rm cedulon

The protocol is the container's stdin/stdout, so it needs -i. It needs no credentials: the server settles on a mock rail and holds no wallet.

Layout

packages/core           policy engine + Decision Token (workspace dep on @cedulon/cose)
packages/cose           deterministic CBOR + COSE_Sign1 (Ed25519)
packages/manifest       signed trade manifest
packages/receipts       spend receipt (COSE default, JSON legacy)
packages/checkpoint     epoch checkpoints + in-process transparency log
packages/audit          rail-extract completeness checker
packages/mcp-guard      MCP tools/call wrapper (mock)
packages/mcp-server     stdio MCP server (official SDK)
packages/x402-adapter   HTTP 402 adapter + mock rail extract
packages/base-extract   read-only Base Sepolia USDC → RailExtract
examples/demo           runaway, dispute, bypass, audit CLI
spec/                   draft-dogru-cedulon-10 (latest here; in preparation,
                        not posted), -09 (posted 6 September 2026), -08,
                        -07, -06, -05, -04, -03, -02, -01, -00;
                        draft-dogru-cedulon-decision-profile-03 (posted
                        6 September 2026), -02, -01, -00: decisions against effects
                        on the same reconciler; and the direction seeds
                        draft-dogru-cedulon-reattestation-00 and
                        draft-dogru-cedulon-streaming-00
THREAT_MODEL.md
docs/RUN_AS_VERIFIER.md

Brand names come from packages/core/src/brand.ts only.

How to cite

Citation metadata is in CITATION.cff. The archived -00 release is published as https://doi.org/10.5281/zenodo.22099792. The posted decision profile, draft-dogru-cedulon-decision-profile-03, is deposited on its own as https://doi.org/10.5281/zenodo.22337734 (all versions; the posted -03 text is https://doi.org/10.5281/zenodo.22550761)

Privacy Policy

https://cedulon.com/privacy.html

The MCP server runs on your machine and makes no network requests. It collects nothing, because there is no endpoint of ours to collect it. packages/mcp-server/README.md states what it holds while it runs and what it writes if you ask it to.

License

Apache-2.0

Available Tools

5 tools
cedulon_auditA
Read-only

Reconcile the in-process receipt chain and checkpoint against the rail extract: this server's own ledger, or a signed extract you present. Returns audit: balanced or findings, names the account, rail and window it was computed over (scope) when an extract declared one, and counts the class every receipt and row landed in (counts).

ParametersJSON Schema
NameRequiredDescriptionDefault
trustNoRail key you hold out of band: { publicKeyPem, accountId?, railId?, windowStartMs?, windowEndMs? }
extractNoA signed rail extract you were presented with: { body: { accountId, railId, windowStartMs, windowEndMs, settlements: [{ ref, amount, currency, timestampMs }], clockSkewMs? }, signature, publicKeyPem }. Present, it is the settlement side of the audit: this server's in-process settlement rows are not consulted, rows added through extraSettlements are refused beside it (an empty list adds nothing and is accepted), and the result carries scope. The receipt side is still this server's own receipt chain and checkpoints, so an extract for an account or rail this server did not settle on reports this server's receipts as unmatched; that is the correct reading of that pairing, not a defect. A body the library would refuse to sign (malformed window, amount outside the grammar, negative clock skew), an empty account, rail or signature, or a key that is not a PEM is refused as extract: ... before anything is reconciled. Absent, the audit runs over this server's own ledger and declares no scope.
manifestNoA Trade Manifest you were presented with. Omit for a no-manifest deployment. Present without manifestTrust is unauthenticated-manifest.
payeeTrustNoPayee keys you hold out of band, keyed by payee: { "payee-1": publicKeyPem }
issuerTrustNoIssuer key(s) you hold out of band: { publicKeyPem: string | string[] }. Without it the audit checks this server's records against this server's own key.
witnessTrustNoTransparency log key you hold out of band: { publicKeyPem: string | string[] }
manifestTrustNoManifest publisher key(s) you hold out of band: { publicKeyPem: string | string[] }
extraSettlementsNoOptional extra extract rows, used to inject a bypass settlement in tests

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Even with readOnlyHint=true, the description discloses a great deal beyond the annotation: it states what is compared, what result is returned, that in-process settlement rows are not consulted when an extract is present, that malformed/empty inputs are refused, and that mismatched extracts still produce a defined outcome. This is exactly the behavioral context an agent needs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core action and output, and the two sentences are dense with no filler. The use of semicolons packs a lot, but every clause earns its place given the tool's complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with eight parameters and no output schema, the description states purpose, mode selection, and return contract (balanced/findings, scope, counts) well. It does not enumerate the trust/manifest parameters, but the 100%-covered input schema compensates, so nothing critical is left to guesswork for invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline applies and the parameter descriptions already carry rich semantics. The tool-level description contributes conceptual framing (own ledger vs extract, output counts) but adds no new parameter-level syntax or format beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Reconcile the in-process receipt chain and checkpoint against the rail extract' and immediately distinguishes the two modes (own ledger vs signed extract). It also names the result shape ('balanced or findings', scope, counts), so an agent can tell this audit tool apart from sibling operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives clear context for when to run against the server's own ledger versus a signed extract and what happens when the extract's account/rail doesn't match server activity. It does not explicitly name sibling tools or state 'don't use this when X', but the extract/absent distinction provides actionable routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cedulon_export_ledgerA
Read-only

Export receipts, checkpoint, and rail extract in the same JSON shape as npm run demo:export, with the findings, guarantee and counts of the audit over this server's own ledger.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide readOnlyHint=true and openWorldHint=false, so the read-only nature is covered. The description adds useful behavioral context beyond annotations by specifying the output shape ('same JSON shape as npm run demo:export') and the included audit content (findings, guarantee, counts). It does not mention auth or rate limits, but the read-only annotation lowers the burden.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that efficiently packs the core resource, the output shape, and the scope. Every phrase contributes meaningful information, and there is no filler. It is slightly dense, but it remains appropriately sized for a zero-parameter export tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no inputs and annotations covering the safety profile, the description provides a solid output contract and scope. The main gap is that 'npm run demo:export' is an external reference and the relationship to cedulon_audit is not explicitly clarified, but for a read-only zero-parameter export this is substantially complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and the schema coverage is 100%, so there are no parameter details that need explanation. The zero-parameter baseline is 4, and the description correctly adds no parameter guidance since none is needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Export') and names the exact resources: receipts, checkpoint, rail extract, and the audit's findings, guarantee, and counts. It also defines the output shape by referencing 'npm run demo:export', which makes the tool's function concrete and distinct from siblings like cedulon_status or cedulon_audit. The only slight assumption is familiarity with the demo:export script, but the core purpose is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the use case: call this when you need the server's own ledger audit data in the demo:export JSON shape. However, it does not explicitly mention sibling tools or state when not to use this one, so an agent must infer routing from the tool name and context rather than from explicit guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cedulon_spendA

Policy-gated spend on the mock rail. Allow returns a signed COSE receipt JSON. Deny returns the fail-closed reason.

ParametersJSON Schema
NameRequiredDescriptionDefault
toolNoCalling tool name recorded on the request
nonceYes
payeeYes
amountYesInteger amount as a decimal string
currencyYes

TDQS

A3.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses both possible outcomes—an allow path returning a signed COSE receipt JSON and a deny path returning the fail-closed reason. This goes beyond the annotations, which only indicate hints like readOnly false and idempotent false. It doesn't explain the policy itself, but it clearly communicates the behavioral contract.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise: two short sentences, front-loaded with the primary action, and each sentence adds distinct value. There is no filler, redundancy, or unnecessary background.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

While the description explains return variants, it does not cover policy prerequisites, parameter formats, or the meaning of nonce, payee, and currency. With no output scheme and only 40% schema description coverage, these omissions make it difficult for an agent to invoke the tool correctly the first time.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 40%, yet the description adds no parameter-level meaning for nonce, payee, or currency, and does not even mention 'amount' or 'tool'. With most parameters undocumented in both schema and description, the agent has little guidance on how to set valid inputs.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the action ('spend'), the resource ('mock rail'), and the policy-gating nature of the operation. It also distinguishes the tool from siblings like cedulon_verify_receipt and cedulon_audit by describing the spend-specific outcome.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies this tool is used when a policy-gated spend should be attempted, and sibling names suggest the other tools serve different purposes. However, it does not explicitly state when to use this tool over alternatives, nor does it provide exclusions or condition-based routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cedulon_statusA
Read-only

Server version, policy summary, receipt count, and chain head hash.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already declare readOnlyHint=true and openWorldHint=false, covering the safety profile. The description adds useful context about the specific data fields exposed, but does not disclose any further behavioral details such as response format, freshness, or failure modes. This is comparable to a straightforward status read where the annotations carry the main burden.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, compact sentence that front-loads the most important information: it enumerates exactly what the status tool exposes. Every word earns its place and there is no redundant or filler content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a parameterless status endpoint with read-only annotations, the description is largely sufficient: it names the key result fields. There is no output schema to supplement the return values, but the listed fields are concrete enough for an agent to understand what this tool offers in the context of its siblings.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters and the schema is empty, so there are no parameter semantics to document. With 0 params, the baseline of 4 applies, and the description does not need to compensate for any parameter coverage gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The title 'Server status' plus the description's list of returned data ('Server version, policy summary, receipt count, and chain head hash') clearly identifies this as a read-only status tool. It is distinct from the sibling tools (spend, audit, verify_receipt, export_ledger), though it lacks an explicit verb such as 'returns' or 'gets'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no explicit guidance on when to choose this tool versus its siblings such as cedulon_audit or cedulon_export_ledger. There is no stated condition, exclusion, or mention of alternatives; usage is only weakly implied by the word 'status' in the title.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cedulon_verify_receiptA
Read-only

Verify a spend receipt COSE_Sign1 (and payee countersignature when present). Supply expectIssuerKeyPem to check it against a key you already hold; without one the receipt is only checked against the key it carries, which any key satisfies.

ParametersJSON Schema
NameRequiredDescriptionDefault
coseHexNo
receiptNoFull SignedReceipt object from cedulon_spend
publicKeyPemNo
counterCoseHexNo
expectPayeeKeyPemNoPayee key you hold out of band, for the countersignature.
payeePublicKeyPemNo
expectIssuerKeyPemNoIssuer key you hold out of band. Omit and the check is self-referential.

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnlyHint, so the description carries the burden of behavioral caveats. It adds the important warning that omitting expectIssuerKeyPem makes verification self-referential and 'any key satisfies' it, which prevents an agent from over-trusting a nominally verified receipt.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two dense sentences with no filler. It front-loads the primary purpose and then delivers the single most important usage caveat, making every word earn its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 7 optional parameters, no required fields, no output schema, and no guidance on which parameter combinations are valid, the description is not complete enough for reliable invocation. It explains the issuer-key pitfall but leaves the receipt/countersignature input representations and the verification result unspecified.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 43%, and the free-text description explains only expectIssuerKeyPem behaviorally. The relationship between coseHex, receipt, counterCoseHex, publicKeyPem, and payeePublicKeyPem is left unstated, so an agent cannot confidently choose among the seven optional input modes from the description alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with the verb 'Verify' and names the specific resource: a spend receipt COSE_Sign1 plus the optional payee countersignature. This clearly separates it from spend/audit/export/status siblings and makes the tool's operation unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides concrete conditional guidance: supply expectIssuerKeyPem when you want to check against a key you already hold, and omit it when you accept the receipt's self-carried key. It does not name alternative tools, but the parameter-level when/how instructions are clear enough for correct invocation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 1 tool updatev0.12.0
    • Changedcedulon_audit1 field changed
      • addedInput schema / properties / extract
        Added value: +{
        +  "description": "A signed rail extract you were presented with: { body: { accountId, railId, windowStartMs, windowEndMs, settlements: [{ ref, amount, currency, timestampMs }], clockSkewMs? }, signature, publicKeyPem }. Present, it is the settlement side of the audit: this server's in-process settlement rows are not consulted, rows added through extraSettlements are refused beside it (an empty list adds nothing and is accepted), and the result carries scope. The receipt side is still this server's own receipt chain and checkpoints, so an extract for an account or rail this server did not settle on reports this server's receipts as unmatched; that is the correct reading of that pairing, not a defect. A body the library would refuse to sign (malformed window, amount outside the grammar, negative clock skew), an empty account, rail or signature, or a key that is not a PEM is refused as extract: ... before anything is reconciled. Absent, the audit runs over this server's own ledger and declares no scope.",
        +  "type": "object"
        +}
  2. 2 tool updatesv0.5.1
    • Changedcedulon_audit6 fields changed
      • addedInput schema / properties / issuerTrust
        Added value: +{
        +  "description": "Issuer key(s) you hold out of band: { publicKeyPem: string | string[] }. Without it the audit checks this server's records against this server's own key.",
        +  "type": "object"
        +}
      • addedInput schema / properties / manifest
        Added value: +{
        +  "description": "A Trade Manifest you were presented with. Omit for a no-manifest deployment. Present without manifestTrust is unauthenticated-manifest.",
        +  "type": "object"
        +}
      • addedInput schema / properties / manifestTrust
        Added value: +{
        +  "description": "Manifest publisher key(s) you hold out of band: { publicKeyPem: string | string[] }",
        +  "type": "object"
        +}
      • addedInput schema / properties / payeeTrust
        Added value: +{
        +  "description": "Payee keys you hold out of band, keyed by payee: { \"payee-1\": publicKeyPem }",
        +  "type": "object"
        +}
      • addedInput schema / properties / trust
        Added value: +{
        +  "description": "Rail key you hold out of band: { publicKeyPem, accountId?, railId?, windowStartMs?, windowEndMs? }",
        +  "type": "object"
        +}
      • addedInput schema / properties / witnessTrust
        Added value: +{
        +  "description": "Transparency log key you hold out of band: { publicKeyPem: string | string[] }",
        +  "type": "object"
        +}
    • Changedcedulon_verify_receipt2 fields changed
      • addedInput schema / properties / expectIssuerKeyPem
        Added value: +{
        +  "description": "Issuer key you hold out of band. Omit and the check is self-referential.",
        +  "type": "string"
        +}
      • addedInput schema / properties / expectPayeeKeyPem
        Added value: +{
        +  "description": "Payee key you hold out of band, for the countersignature.",
        +  "type": "string"
        +}
  3. 5 tool updatesv0.2.3
    • First observedcedulon_audit
    • First observedcedulon_export_ledger
    • First observedcedulon_spend
    • First observedcedulon_status
    • First observedcedulon_verify_receipt

TDQS

A4/5.0

Scored across 5 tools

Disambiguation5/5

Each tool maps to a distinct operation: status for server health and context, spend for initiating a payment, audit for reconciliation, verify_receipt for signature validation, and export_ledger for extracting data. There is no meaningful functional overlap between any pair.

Naming Consistency4/5

All names use lowercase snake_case and share the cedulon_ prefix, which is a solid convention. However, the action pattern is slightly inconsistent: status and audit are noun-style, while spend, verify_receipt, and export_ledger are verb or verb_noun style.

Tool Count5/5

Five tools is well-scoped for a focused payment/audit server. Each tool has a clear role—information, spend, verification, audit, export—and none feels redundant or excessive.

Completeness5/5

The tool set covers the core workflow: spend creates a receipt, verify_receipt validates it, audit reconciles the ledger or a presented extract, and export_ledger provides data portability. Status supplies the necessary server-level context, so there are no obvious dead ends for the stated domain.

Maintenance

ActivityMaintained
ResponsivenessWithin a week

Related MCP Connectors

Related MCP Servers