@forestrie/mcp-resolve
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@@forestrie/mcp-resolvefetch the genesis document from https://api-a.forest-2.forestrie.dev"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
@forestrie/mcp-resolve
An MCP server that fetches the material
@forestrie/mcp-verify
verifies: a receipt, a genesis document, an accumulator snapshot, a
registration status, a service configuration. Every result says where its
bytes came from and which of the four questions of the trust model they can
support. Listed in the MCP registry as dev.forestrie/resolve.
This package is the courier, not the verifier. The verifier runs entirely in your process with no network, no account, no key and no backend, and its own rule is that installing it can never imply a network dependency. So anything that fetches lives here, under a separate name, and depends on the verifier's published core at an exact version pin. The verifier never depends on this package.
Use
{
"mcpServers": {
"forestrie-resolve": {
"command": "npx",
"args": ["-y", "@forestrie/mcp-resolve"],
"env": {
"FORESTRIE_BASE_URL": "https://api-a.forest-2.forestrie.dev",
"FORESTRIE_RPC_URL": "https://<your-chain-rpc-endpoint>"
}
}
}
}Both environment variables are optional and both are yours. baseUrl is
any SCRAPI base URL and rpcUrl is your own chain access; a call may pass
either explicitly, and the environment values are used only when a call
omits them. The package ships no default operator and no default chain
provider, and names none.
Two public lanes exist and are examples, not defaults:
Lane | Base URL | Service id |
A |
|
|
B |
|
|
Requires Node 20.11 or later.
Related MCP server: VouchSpec Catalog MCP
The six tools
Tool | What it does | Provenance | Supports |
|
| fetched | none: operator self-description |
| one | fetched | none: registration status |
|
| fetched | none on its own: a receipt is the operator's claim |
|
| fetched |
|
| reads the log's published accumulator from the univocity contract at your RPC URL and returns the snapshot the | chain-read |
|
| fetches a receipt and verifies it with the verifier's core under a root you supply as bytes, or under an accumulator read from the chain in the same call | fetched + supplied or chain-read | the verifier's own answers, passed through unaltered |
Every tool is annotated read-only, idempotent and open-world, because every one of them talks to something outside your process.
What a fetched thing proves
A receipt fetched from the operator is the operator's claim until it is
verified under a trust root you hold. The public trust model,
spec/receipt-trust-model.md
in forestrie/protocol, names four questions a receipt can answer
(sealing, split-view, append-authority, attribution) and four trust roots a
caller can verify under (genesis, known-log-key, known-accumulator,
checkpoint-chain). The roots are not ordered. Which one is right depends
on what you hold, and fetching changes what you hold.
That is why every result here carries provenance (for each artefact:
fetched from a URL, read from a chain, or supplied by you, and when) and
supports (which questions the material can serve as evidence for, under
which root, with a one-line note). The notes are fixed strings the tests
assert verbatim; they are listed and explained in
docs/what-fetching-proves.md.
Two consequences are built into the tool surface rather than left to documentation:
A fetched genesis is never a root.
verify_fetched_receipttakes its root as bytes you supply or as an accumulator read from the chain; its schema has no form that fetches a genesis and verifies under it in the same call. A genesis obtained from the operator at check time makes the operator the supplier of both the receipt and the root, which proves consistency with a document the operator chose to serve today and nothing more.fetch_genesisexists so you can obtain the document once, keep it, and pass it as bytes from then on.The chain binding is the forest's, never the operator's. The univocity contract address and chain id are bound in a forest's genesis document.
fetch_accumulatorand the chain path ofverify_fetched_receipttake them from a genesis you hold, or explicitly, never from a default, never from a genesis fetched inside the call, and never from an environment variable.
The verifier's own TRANSPARENCY.md
(shipped in its tarball) explains what a transparency log is and what a
receipt contains; this package does not repeat it. Its
docs/trust-roots.md
explains the roots in depth.
What this package never does
Never writes: no registration, no grants, no keys.
Never polls:
query_registrationis one request, and you decide whether to call it again. An HTTP 429 comes back as a structuredproblemwithretryAfterMs, not as an error.Never chooses an operator or a chain provider for you.
Never caches a fetched genesis or accumulator across calls: every result carries a fresh
at.Never edits the verifier's answers.
verify_fetched_receiptreturns the verifier'sstages,questionsanddiagnosticsunaltered and appends two diagnostics of its own that say where the bytes came from.not_answered_by_this_rootis a real answer and reaches you unchanged.
Layout and gates
src/core/ pure over bytes: URL construction, response classification,
provenance and supports labelling, the compose logic.
No node:*, no fetch, no fs. Exported as ".".
src/net/ the ONLY place fetch is called; every function takes fetchImpl.
Exported as "./net".
src/node/ the MCP adapter: SDK, stdio, {path}/base64 inputs, env defaults.
Exported as "./server".CI blocks on: src/core bundling for the browser with no Node builtin;
the unit project running under a fetch that throws (the network layer is
tested only through injected fakes, replaying recorded exchanges frozen
under test/fixtures/ with a sha256 manifest and a PROVENANCE.md); one
copy of @forestrie/encoding and @forestrie/receipt-verify in the repo
and in a scratch install of the packed tarball; the real bin writing
nothing to stdout but MCP frames; and server.json agreeing with
package.json. A live project against a real lane exists, is opt-in by
environment variable, and is never a required check.
pnpm test # purity gates + unit tests
pnpm typecheck
pnpm build
pnpm test:live # FORESTRIE_LIVE=1 plus FORESTRIE_BASE_URL, FORESTRIE_RPC_URL and the chain valuesConventions, invariants and the release path are in AGENTS.md.
Dependencies
Exact pins, bumped deliberately: @forestrie/mcp-verify (core export
only), @forestrie/scrapi-client, @forestrie/receipt-verify,
@forestrie/encoding, @modelcontextprotocol/sdk. The chain read is three
JSON-RPC calls made locally through the injected fetchImpl.
License
MIT.
Available Tools
6 toolsfetch_accumulatorFetch accumulator from chainARead-onlyIdempotent
Read the log's published accumulator from the univocity contract at your rpcUrl: eth_chainId, then eth_getBlockByNumber latest, then one eth_call logState(logId) at that block. The contract address and chain id come from a genesis you hold ({genesis, rpcUrl, logId}) or are given explicitly ({rpcUrl, univocity, logId, chainId?}); a chain id mismatch is reported as a problem before any call. Returns the snapshot CBOR the verifier's known-accumulator root consumes, base64-encoded, with size, block number and block hash. Provenance: chain-read. Supports: split-view under known-accumulator, against the chain rather than the operator; sealing and append-authority by inheritance from the contract's publish-time checks, not by a local signature check.
| Name | Required | Description | Default |
|---|---|---|---|
| chain | Yes | The forest's chain binding: from a genesis you hold, or given explicitly. Never defaulted, never taken from a fetched genesis, never read from the environment except rpcUrl. |
Output Schema
| Name | Required | Description |
|---|---|---|
| problem | No | |
| snapshot | No | |
| supports | Yes | |
| provenance | No | |
| accumulator | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations (which already cover readOnly/idempotent/openWorld), the description discloses the exact call order (eth_chainId, eth_getBlockByNumber latest, one eth_call), that a chain-id mismatch is reported before any call, the provenance (chain-read), and that sealing/append-authority is inherited from the contract rather than a local signature check. That is substantial behavioral context the structured fields do not carry.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Information is dense and front-loaded, with the primary action stated first and supporting detail (input shapes, return, provenance) following. It is slightly overwrought with parenthetical variants, but nearly every clause carries distinct information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter tool with a full output schema, annotations, and 100% schema coverage, the description supplies everything an agent needs: call semantics, input forms, the pre-call guardrail, and what the returned snapshot is for. Nothing material is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the schema itself documents the two union branches, so the baseline is 3. The description adds genuine meaning on top: it frames the two shapes as genesis-derived vs. explicit, notes the chainId is optional and checked pre-call, and clarifies rpcUrl sourcing. It does not restate field formats, which the schema already handles.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The first sentence states a specific verb (read) and resource (the log's published accumulator from the univocity contract), with the exact RPC sequence used. This distinguishes it clearly from siblings like fetch_genesis and fetch_receipt, which fetch different artifacts.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It establishes the context in which the tool applies (split-view under known-accumulator, against the chain rather than the operator) and the two supported input shapes, plus the chain-id-mismatch guardrail. It does not explicitly name sibling alternatives or state when-not-to-use, so it stops short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_genesisFetch genesis documentARead-onlyIdempotent
GET {baseUrl}/api/forest/{logId}/genesis: the forest's genesis document as CBOR, base64-encoded, with the chain binding it carries (univocity contract address, chain id, forest log id) decoded; the bootstrap key stays in the bytes for the verifier's genesis root to read. For capture: obtain it once, keep it, and pass it as bytes from then on. A copy obtained at check time is not the genesis trust root as intended, and its chain binding is likewise the operator's claim today; keep the copy from registration, or cross-check it against a source you trust independently. Provenance: fetched. Supports: sealing, as known-log-key with the key this copy carries.
| Name | Required | Description | Default |
|---|---|---|---|
| logId | Yes | UUID (with dashes), or a 16/32-byte hex log id | |
| baseUrl | No | any SCRAPI base URL; falls back to FORESTRIE_BASE_URL when omitted — never defaulted by the package itself |
Output Schema
| Name | Required | Description |
|---|---|---|
| genesis | No | |
| problem | No | |
| supports | Yes | |
| provenance | No | |
| chainBinding | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover the safety profile (readOnly, idempotent, non-destructive, openWorld), and the description adds substantive behavior beyond them: return encoding (CBOR, base64), that the bootstrap key is preserved for the verifier, the provenance ('fetched'), and the trust-root caveat about copies taken at check time. This is real context an agent cannot get from the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The endpoint is front-loaded, but the body is a dense, semicolon-chained run-on with cryptic boilerplate tags ('Provenance: fetched. Supports: sealing...') that are hard to parse. It is information-rich yet not cleanly structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema and full annotations present, the description still supplies the trust and capture context an agent needs to use the result correctly. Minor gaps remain around the cryptic 'Supports' tag and when a fresh fetch is legitimate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both logId and baseUrl are already documented in the schema; the description only embeds them in the URL template, adding no format or fallback semantics beyond what the schema states. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (GET) and resource (the forest's genesis document) plus the exact endpoint template, so the agent knows precisely what is retrieved. It is readily distinguishable from siblings like fetch_receipt or fetch_accumulator because it names the genesis document and its chain-binding contents.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives concrete usage guidance: 'obtain it once, keep it, and pass it as bytes from then on,' with an explicit when-not ('A copy obtained at check time is not the genesis trust root as intended'). It does not name sibling tools as alternatives, so it stops short of the top band.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_receiptFetch receiptARead-onlyIdempotent
GET a receipt: either by receiptUrl (as returned by query_registration) or by {baseUrl, bootstrapLogId, logId, massifHeight, entryId}. Returns the receipt bytes base64-encoded plus the verifier's decoding of them. Provenance: fetched. Supports: none on its own; a receipt is the operator's claim, so verify it under a trust root you hold (or use verify_fetched_receipt).
| Name | Required | Description | Default |
|---|---|---|---|
| logId | No | UUID (with dashes), or a 16/32-byte hex log id | |
| baseUrl | No | any SCRAPI base URL; falls back to FORESTRIE_BASE_URL when omitted — never defaulted by the package itself | |
| entryId | No | 32 lowercase hex: idtimestamp_be8 || mmrIndex_be8 | |
| receiptUrl | No | as returned by query_registration | |
| massifHeight | No | ||
| bootstrapLogId | No | UUID (with dashes), or a 16/32-byte hex log id |
Output Schema
| Name | Required | Description |
|---|---|---|
| decoded | No | |
| problem | No | |
| receipt | No | |
| supports | Yes | |
| provenance | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/idempotent/non-destructive/open-world, so the safety profile is covered. The description adds genuinely new behavioral context the annotations cannot: the return shape (base64 bytes plus verifier decoding), the 'Provenance: fetched' marker, and the trust caveat that a receipt is only the operator's claim. It does not discuss auth or rate limits, so not a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three dense sentences, front-loaded with the retrieval modes before the return shape and trust guidance. Every sentence carries information, though the cryptographic jargon and packed clause structure cost a little readability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, the description needn't explain returns, yet it still summarizes them helpfully, and with rich annotations it focuses on the trust model. The main residual gap is not clarifying whether the two addressing modes are mutually exclusive or how conflicts are resolved, so not a perfect 5.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 83%, so the baseline is 3, and the description goes beyond by framing the six parameters as two alternative addressing schemes and tying receiptUrl back to query_registration. It does not add per-field syntax detail beyond the schema, keeping it at a solid 4 rather than 5.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (GET) and resource (a receipt), and enumerates the two distinct input shapes: by receiptUrl or by the {baseUrl, bootstrapLogId, logId, massifHeight, entryId} tuple. It also names the sibling it works with (query_registration for the URL, verify_fetched_receipt for trust), so an agent can distinguish it from siblings without opening schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states that this tool 'supports: none on its own' and routes the agent to verify_fetched_receipt or its own trust root, which is a clear when-not and alternative. It is slightly less explicit about when to prefer receiptUrl over the tuple form, so it stops short of full when/when-not coverage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_scitt_configurationFetch SCITT configurationARead-onlyIdempotent
GET {baseUrl}/.well-known/scitt-configuration: the transparency service's self-description (service id, base URL, supported algorithms), returned as JSON. Provenance: fetched. Supports: none of the four questions; this is what the operator says about itself.
| Name | Required | Description | Default |
|---|---|---|---|
| baseUrl | No | any SCRAPI base URL; falls back to FORESTRIE_BASE_URL when omitted — never defaulted by the package itself |
Output Schema
| Name | Required | Description |
|---|---|---|
| problem | No | |
| supports | Yes | |
| provenance | No | |
| configuration | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/idempotent/openWorld, so the safety profile is covered. The description adds the endpoint path, that the result is JSON, and a genuinely useful trust caveat — the self-description is only 'what the operator says about itself' rather than verified truth. It omits pagination/error behavior, but adds real context beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the concrete endpoint, then supporting facts in terse form. The 'Provenance: fetched' / 'Supports:' shorthand is slightly compressed jargon but each clause carries information; no filler sentences.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, the description needn't explain return values, and the rich annotations cover the safety profile. Combined with a fully documented single parameter, an agent has what it needs to invoke this correctly; only the lack of alternative-routing guidance keeps it from a 5.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema fully documents baseUrl including the FORESTRIE_BASE_URL fallback. The description only mirrors baseUrl via the {baseUrl} path placeholder and adds no syntax or semantic detail beyond the schema — the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (GET) and resource (the /.well-known/scitt-configuration self-description), and enumerates what the resource contains (service id, base URL, supported algorithms). An agent can distinguish this config-fetch from the sibling fetch_receipt/fetch_genesis/fetch_accumulator calls without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives some orientation ('Supports: none of the four questions; this is what the operator says about itself'), which implies when it is relevant, but it never names an alternative tool or states a condition that selects this over a sibling. Usage is implied rather than directed.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
query_registrationQuery registration statusARead-onlyIdempotent
One GET of {baseUrl}/logs/{bootstrapLogId}/{logId}/entries/{contentHash}, where contentHash is the hex sha256 of the signed statement bytes. Returns pending (with retryAfterMs when the server said so) or the receipt's URL and entry id. Never polls: call again yourself if you want to. Provenance: fetched. Supports: none of the four questions; this is registration status.
| Name | Required | Description | Default |
|---|---|---|---|
| logId | Yes | UUID (with dashes), or a 16/32-byte hex log id | |
| baseUrl | No | any SCRAPI base URL; falls back to FORESTRIE_BASE_URL when omitted — never defaulted by the package itself | |
| contentHash | Yes | hex sha256 of the signed statement bytes | |
| bootstrapLogId | Yes | UUID (with dashes), or a 16/32-byte hex log id |
Output Schema
| Name | Required | Description |
|---|---|---|
| status | No | |
| entryId | No | |
| problem | No | |
| location | No | |
| supports | Yes | |
| provenance | No | |
| receiptUrl | No | |
| retryAfterMs | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover the safety profile (readOnly, idempotent, openWorld, non-destructive), so the bar is lower; the description still adds single-shot semantics and the pending/retryAfterMs response branch. It doesn't discuss auth requirements or error cases, keeping it short of 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The endpoint and return shape are front-loaded in the first two sentences, and the no-polling rule is stated early. The trailing 'Provenance: fetched. Supports: none of the four questions' is meta-noise that doesn't earn its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values needn't be re-explained, and the description still summarizes the two response branches plus the non-polling contract. Nothing critical for invocation is missing, though auth and failure behavior are unaddressed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all four parameters, including contentHash as the hex sha256 of signed statement bytes, are already documented. The description restates contentHash without adding syntax or format detail beyond the schema, matching the baseline for fully-covered schemas.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb, resource and endpoint shape (GET /logs/{bootstrapLogId}/{logId}/entries/{contentHash}) and what comes back: pending with retryAfterMs, or the receipt's URL and entry id. An agent can distinguish this from fetch_receipt, which retrieves the receipt itself rather than its locator.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Never polls: call again yourself if you want to' gives concrete retry guidance, and the return of a receipt URL (rather than the receipt) implicitly routes retrieval to a sibling. There is no explicit when-not or named alternative, so it falls short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verify_fetched_receiptFetch and verify receiptARead-onlyIdempotent
Fetch a receipt (as fetch_receipt) and verify it with @forestrie/mcp-verify's core under a trust root you supply as bytes (genesis, keyXy, accumulator, or checkpoints) or under an accumulator read from the chain in this call ({root: 'known-accumulator', chain: {genesis, rpcUrl, logId} or {rpcUrl, univocity, logId, chainId?}}). A genesis fetched in the same call is never the root. The result is the verifier's own: stages, the four questions (sealing, split-view, append-authority, attribution; not_answered_by_this_root is a real answer) and diagnostics, passed through unaltered, plus receipt_fetched_from_operator always and root_read_from_chain when the chain path was taken. Supply payload bytes and the entry id to have attribution answered.
| Name | Required | Description | Default |
|---|---|---|---|
| grant | No | true to verify a grant receipt (verifyGrantReceipt) instead of a payload receipt | |
| logId | No | UUID (with dashes), or a 16/32-byte hex log id | |
| trust | Yes | Which trust root to verify under: bytes you supply (genesis, keyXy, accumulator, checkpoints), or {root:'known-accumulator', chain:…} to read the accumulator from the chain in this call. Never a genesis fetched in this same call. | |
| baseUrl | No | any SCRAPI base URL; falls back to FORESTRIE_BASE_URL when omitted — never defaulted by the package itself | |
| entryId | No | required for payload verification; optional for a COSE grant, required for a raw grant payload | |
| payload | No | the exact registered payload (payload verification), or the committed grant bytes when grant:true | |
| receiptUrl | No | as returned by query_registration | |
| massifHeight | No | ||
| bootstrapLogId | No | UUID (with dashes), or a 16/32-byte hex log id |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | No | |
| root | No | |
| stage | No | |
| anchor | No | |
| reason | No | |
| stages | No | |
| courier | No | |
| problem | No | |
| supports | Yes | |
| verifier | No | |
| questions | No | |
| provenance | No | |
| diagnostics | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover the safety profile (readOnly, idempotent, non-destructive, openWorld), and the description adds real behavioral detail beyond them: the four verification questions, that 'not_answered_by_this_root is a real answer', that result fields are passed through unaltered, and that a genesis fetched in the same call is never the trust root. Return-shape disclosure partially overlaps the output schema, keeping this from a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose and the trust-root enumeration are front-loaded, but the dense single-paragraph form with heavily nested parentheticals (the chain object grammar inline) makes it harder to parse than the content warrants. Every sentence carries technical weight, so little is wasted, but structure could be cleaner.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 9-parameter tool with a nested trust union and an output schema, the description covers the hard parts (trust-root selection, chain vs byte roots, result composition) thoroughly. Minor elements like baseUrl and receiptUrl sourcing are left to the schema, which is acceptable given 89% coverage and an existing output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 89%, so the schema already carries most parameter meaning (baseline 3). The description adds above-schema value by tying payload+entryId to the attribution answer and enumerating the trust-root shapes and the chain path, helping the agent map inputs to verification outcomes.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a concrete compound verb+resource ('Fetch a receipt ... and verify it') and explicitly frames the fetch as being like fetch_receipt, letting an agent distinguish it from the plain fetch sibling. The scope is unambiguous: retrieve then cryptographically verify under a supplied trust root.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The framing '(as fetch_receipt) and verify' implicitly routes agents who only want a raw receipt to fetch_receipt, and it gives a live condition ('Supply payload bytes and the entry id to have attribution answered'). It stops short of an explicit when-not statement, so it is strong context rather than full routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
6 tool updates
v0.1.1- First observed
fetch_accumulator - First observed
fetch_genesis - First observed
fetch_receipt - First observed
fetch_scitt_configuration - First observed
query_registration - First observed
verify_fetched_receipt
TDQS
Scored across 6 tools
Most tools target distinct resources: configuration, registration status, receipt, genesis, accumulator, and verification. The only overlap is fetch_receipt and verify_fetched_receipt, where the latter fetches and verifies the same receipt, but descriptions clarify the distinction.
All names use lower snake_case with an action_entity pattern. The verbs vary (fetch, query, verify) appropriately, though fetch_ is used for four of six tools, making the pattern mostly predictable.
Six tools is well-scoped for a resolver/verifier that fetches SCITT configuration, registration status, receipts, genesis, accumulators, and verifies receipts. Each tool has a clear, non-redundant role.
The surface covers core fetch and verify operations, but notable gaps exist for a transparency verifier: there is no tool to fetch checkpoints/signed tree heads, public keys (keyXy), or log entries by index. These are referenced as trust roots or verification inputs, so agents may hit dead ends.
Related MCP Connectors
Read-only gateway for durable agent identity, consent, recognized work, and signed receipts.
Read-only Remote MCP for externally grounded AI agent trust receipts.
Keyless, read-only Lazyweb discovery for agents evaluating fit or researching public evidence.
One search across every agent registry: 100K+ MCP/A2A/x402 services, signed receipts.
Related MCP Servers
AlicenseNot gradedqualityFmaintenanceProvides a universal read path for agents to extract facts, metadata, and provenance from local files and guarded remote URLs without using generative LLMs.MIT- FlicenseNot gradedqualityAmaintenanceEnables querying and verifying signed receipts of static inspections of public agent skills via read-only tools such as search_receipts, get_receipt, and get_verification_material.1-
- AlicenseNot gradedqualityAmaintenanceEnables AI agents to query cryptographically verified facts with zero-knowledge proofs, selective disclosure, and tamper-evident provenance.192 npm1Apache 2.0

vantic-mcpofficial
AlicenseNot gradedqualityCmaintenanceEnables MCP hosts to verify agent spending mandates and receipts, providing stateless tools for authorization, chain verification, credential verification, and DID resolution.Apache 2.0