Skip to main content
Glama
forestrie

@forestrie/mcp-resolve

by forestrie

@forestrie/mcp-resolve

An MCP server that fetches the material @forestrie/mcp-verify verifies: a receipt, a genesis document, an accumulator snapshot, a registration status, a service configuration. Every result says where its bytes came from and which of the four questions of the trust model they can support. Listed in the MCP registry as dev.forestrie/resolve.

This package is the courier, not the verifier. The verifier runs entirely in your process with no network, no account, no key and no backend, and its own rule is that installing it can never imply a network dependency. So anything that fetches lives here, under a separate name, and depends on the verifier's published core at an exact version pin. The verifier never depends on this package.

Use

{
  "mcpServers": {
    "forestrie-resolve": {
      "command": "npx",
      "args": ["-y", "@forestrie/mcp-resolve"],
      "env": {
        "FORESTRIE_BASE_URL": "https://api-a.forest-2.forestrie.dev",
        "FORESTRIE_RPC_URL": "https://<your-chain-rpc-endpoint>"
      }
    }
  }
}

Both environment variables are optional and both are yours. baseUrl is any SCRAPI base URL and rpcUrl is your own chain access; a call may pass either explicitly, and the environment values are used only when a call omits them. The package ships no default operator and no default chain provider, and names none.

Two public lanes exist and are examples, not defaults:

Lane

Base URL

Service id

A

https://api-a.forest-2.forestrie.dev

canopy-dev-1

B

https://api-b.forest-2.forestrie.dev

canopy-prod-1

Requires Node 20.11 or later.

Related MCP server: VouchSpec Catalog MCP

The six tools

Tool

What it does

Provenance

Supports

fetch_scitt_configuration

GET {baseUrl}/.well-known/scitt-configuration

fetched

none: operator self-description

query_registration

one GET of the registration-status URL for a statement's content hash; returns pending or the receipt location, never polls

fetched

none: registration status

fetch_receipt

GET a receipt by URL or by log coordinates; returns the bytes and the verifier's decoding of them

fetched

none on its own: a receipt is the operator's claim

fetch_genesis

GET the forest's genesis document; returns the bytes and the chain binding they carry

fetched

sealing, as known-log-key with the key this copy carries, and only if you keep the copy

fetch_accumulator

reads the log's published accumulator from the univocity contract at your RPC URL and returns the snapshot the known-accumulator root consumes

chain-read

split-view against the chain; sealing and append-authority by inheritance from the contract's publish-time checks

verify_fetched_receipt

fetches a receipt and verifies it with the verifier's core under a root you supply as bytes, or under an accumulator read from the chain in the same call

fetched + supplied or chain-read

the verifier's own answers, passed through unaltered

Every tool is annotated read-only, idempotent and open-world, because every one of them talks to something outside your process.

What a fetched thing proves

A receipt fetched from the operator is the operator's claim until it is verified under a trust root you hold. The public trust model, spec/receipt-trust-model.md in forestrie/protocol, names four questions a receipt can answer (sealing, split-view, append-authority, attribution) and four trust roots a caller can verify under (genesis, known-log-key, known-accumulator, checkpoint-chain). The roots are not ordered. Which one is right depends on what you hold, and fetching changes what you hold.

That is why every result here carries provenance (for each artefact: fetched from a URL, read from a chain, or supplied by you, and when) and supports (which questions the material can serve as evidence for, under which root, with a one-line note). The notes are fixed strings the tests assert verbatim; they are listed and explained in docs/what-fetching-proves.md.

Two consequences are built into the tool surface rather than left to documentation:

  • A fetched genesis is never a root. verify_fetched_receipt takes its root as bytes you supply or as an accumulator read from the chain; its schema has no form that fetches a genesis and verifies under it in the same call. A genesis obtained from the operator at check time makes the operator the supplier of both the receipt and the root, which proves consistency with a document the operator chose to serve today and nothing more. fetch_genesis exists so you can obtain the document once, keep it, and pass it as bytes from then on.

  • The chain binding is the forest's, never the operator's. The univocity contract address and chain id are bound in a forest's genesis document. fetch_accumulator and the chain path of verify_fetched_receipt take them from a genesis you hold, or explicitly, never from a default, never from a genesis fetched inside the call, and never from an environment variable.

The verifier's own TRANSPARENCY.md (shipped in its tarball) explains what a transparency log is and what a receipt contains; this package does not repeat it. Its docs/trust-roots.md explains the roots in depth.

What this package never does

  • Never writes: no registration, no grants, no keys.

  • Never polls: query_registration is one request, and you decide whether to call it again. An HTTP 429 comes back as a structured problem with retryAfterMs, not as an error.

  • Never chooses an operator or a chain provider for you.

  • Never caches a fetched genesis or accumulator across calls: every result carries a fresh at.

  • Never edits the verifier's answers. verify_fetched_receipt returns the verifier's stages, questions and diagnostics unaltered and appends two diagnostics of its own that say where the bytes came from. not_answered_by_this_root is a real answer and reaches you unchanged.

Layout and gates

src/core/   pure over bytes: URL construction, response classification,
            provenance and supports labelling, the compose logic.
            No node:*, no fetch, no fs. Exported as ".".
src/net/    the ONLY place fetch is called; every function takes fetchImpl.
            Exported as "./net".
src/node/   the MCP adapter: SDK, stdio, {path}/base64 inputs, env defaults.
            Exported as "./server".

CI blocks on: src/core bundling for the browser with no Node builtin; the unit project running under a fetch that throws (the network layer is tested only through injected fakes, replaying recorded exchanges frozen under test/fixtures/ with a sha256 manifest and a PROVENANCE.md); one copy of @forestrie/encoding and @forestrie/receipt-verify in the repo and in a scratch install of the packed tarball; the real bin writing nothing to stdout but MCP frames; and server.json agreeing with package.json. A live project against a real lane exists, is opt-in by environment variable, and is never a required check.

pnpm test        # purity gates + unit tests
pnpm typecheck
pnpm build
pnpm test:live   # FORESTRIE_LIVE=1 plus FORESTRIE_BASE_URL, FORESTRIE_RPC_URL and the chain values

Conventions, invariants and the release path are in AGENTS.md.

Dependencies

Exact pins, bumped deliberately: @forestrie/mcp-verify (core export only), @forestrie/scrapi-client, @forestrie/receipt-verify, @forestrie/encoding, @modelcontextprotocol/sdk. The chain read is three JSON-RPC calls made locally through the injected fetchImpl.

License

MIT.

Available Tools

6 tools
fetch_accumulatorFetch accumulator from chainA
Read-onlyIdempotent

Read the log's published accumulator from the univocity contract at your rpcUrl: eth_chainId, then eth_getBlockByNumber latest, then one eth_call logState(logId) at that block. The contract address and chain id come from a genesis you hold ({genesis, rpcUrl, logId}) or are given explicitly ({rpcUrl, univocity, logId, chainId?}); a chain id mismatch is reported as a problem before any call. Returns the snapshot CBOR the verifier's known-accumulator root consumes, base64-encoded, with size, block number and block hash. Provenance: chain-read. Supports: split-view under known-accumulator, against the chain rather than the operator; sealing and append-authority by inheritance from the contract's publish-time checks, not by a local signature check.

ParametersJSON Schema
NameRequiredDescriptionDefault
chainYesThe forest's chain binding: from a genesis you hold, or given explicitly. Never defaulted, never taken from a fetched genesis, never read from the environment except rpcUrl.

Output Schema

ParametersJSON Schema
NameRequiredDescription
problemNo
snapshotNo
supportsYes
provenanceNo
accumulatorNo

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (which already cover readOnly/idempotent/openWorld), the description discloses the exact call order (eth_chainId, eth_getBlockByNumber latest, one eth_call), that a chain-id mismatch is reported before any call, the provenance (chain-read), and that sealing/append-authority is inherited from the contract rather than a local signature check. That is substantial behavioral context the structured fields do not carry.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Information is dense and front-loaded, with the primary action stated first and supporting detail (input shapes, return, provenance) following. It is slightly overwrought with parenthetical variants, but nearly every clause carries distinct information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter tool with a full output schema, annotations, and 100% schema coverage, the description supplies everything an agent needs: call semantics, input forms, the pre-call guardrail, and what the returned snapshot is for. Nothing material is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the schema itself documents the two union branches, so the baseline is 3. The description adds genuine meaning on top: it frames the two shapes as genesis-derived vs. explicit, notes the chainId is optional and checked pre-call, and clarifies rpcUrl sourcing. It does not restate field formats, which the schema already handles.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence states a specific verb (read) and resource (the log's published accumulator from the univocity contract), with the exact RPC sequence used. This distinguishes it clearly from siblings like fetch_genesis and fetch_receipt, which fetch different artifacts.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It establishes the context in which the tool applies (split-view under known-accumulator, against the chain rather than the operator) and the two supported input shapes, plus the chain-id-mismatch guardrail. It does not explicitly name sibling alternatives or state when-not-to-use, so it stops short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_genesisFetch genesis documentA
Read-onlyIdempotent

GET {baseUrl}/api/forest/{logId}/genesis: the forest's genesis document as CBOR, base64-encoded, with the chain binding it carries (univocity contract address, chain id, forest log id) decoded; the bootstrap key stays in the bytes for the verifier's genesis root to read. For capture: obtain it once, keep it, and pass it as bytes from then on. A copy obtained at check time is not the genesis trust root as intended, and its chain binding is likewise the operator's claim today; keep the copy from registration, or cross-check it against a source you trust independently. Provenance: fetched. Supports: sealing, as known-log-key with the key this copy carries.

ParametersJSON Schema
NameRequiredDescriptionDefault
logIdYesUUID (with dashes), or a 16/32-byte hex log id
baseUrlNoany SCRAPI base URL; falls back to FORESTRIE_BASE_URL when omitted — never defaulted by the package itself

Output Schema

ParametersJSON Schema
NameRequiredDescription
genesisNo
problemNo
supportsYes
provenanceNo
chainBindingNo

TDQS

A4.2/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations cover the safety profile (readOnly, idempotent, non-destructive, openWorld), and the description adds substantive behavior beyond them: return encoding (CBOR, base64), that the bootstrap key is preserved for the verifier, the provenance ('fetched'), and the trust-root caveat about copies taken at check time. This is real context an agent cannot get from the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The endpoint is front-loaded, but the body is a dense, semicolon-chained run-on with cryptic boilerplate tags ('Provenance: fetched. Supports: sealing...') that are hard to parse. It is information-rich yet not cleanly structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema and full annotations present, the description still supplies the trust and capture context an agent needs to use the result correctly. Minor gaps remain around the cryptic 'Supports' tag and when a fresh fetch is legitimate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both logId and baseUrl are already documented in the schema; the description only embeds them in the URL template, adding no format or fallback semantics beyond what the schema states. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (GET) and resource (the forest's genesis document) plus the exact endpoint template, so the agent knows precisely what is retrieved. It is readily distinguishable from siblings like fetch_receipt or fetch_accumulator because it names the genesis document and its chain-binding contents.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives concrete usage guidance: 'obtain it once, keep it, and pass it as bytes from then on,' with an explicit when-not ('A copy obtained at check time is not the genesis trust root as intended'). It does not name sibling tools as alternatives, so it stops short of the top band.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_receiptFetch receiptA
Read-onlyIdempotent

GET a receipt: either by receiptUrl (as returned by query_registration) or by {baseUrl, bootstrapLogId, logId, massifHeight, entryId}. Returns the receipt bytes base64-encoded plus the verifier's decoding of them. Provenance: fetched. Supports: none on its own; a receipt is the operator's claim, so verify it under a trust root you hold (or use verify_fetched_receipt).

ParametersJSON Schema
NameRequiredDescriptionDefault
logIdNoUUID (with dashes), or a 16/32-byte hex log id
baseUrlNoany SCRAPI base URL; falls back to FORESTRIE_BASE_URL when omitted — never defaulted by the package itself
entryIdNo32 lowercase hex: idtimestamp_be8 || mmrIndex_be8
receiptUrlNoas returned by query_registration
massifHeightNo
bootstrapLogIdNoUUID (with dashes), or a 16/32-byte hex log id

Output Schema

ParametersJSON Schema
NameRequiredDescription
decodedNo
problemNo
receiptNo
supportsYes
provenanceNo

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive/open-world, so the safety profile is covered. The description adds genuinely new behavioral context the annotations cannot: the return shape (base64 bytes plus verifier decoding), the 'Provenance: fetched' marker, and the trust caveat that a receipt is only the operator's claim. It does not discuss auth or rate limits, so not a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three dense sentences, front-loaded with the retrieval modes before the return shape and trust guidance. Every sentence carries information, though the cryptographic jargon and packed clause structure cost a little readability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, the description needn't explain returns, yet it still summarizes them helpfully, and with rich annotations it focuses on the trust model. The main residual gap is not clarifying whether the two addressing modes are mutually exclusive or how conflicts are resolved, so not a perfect 5.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 83%, so the baseline is 3, and the description goes beyond by framing the six parameters as two alternative addressing schemes and tying receiptUrl back to query_registration. It does not add per-field syntax detail beyond the schema, keeping it at a solid 4 rather than 5.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (GET) and resource (a receipt), and enumerates the two distinct input shapes: by receiptUrl or by the {baseUrl, bootstrapLogId, logId, massifHeight, entryId} tuple. It also names the sibling it works with (query_registration for the URL, verify_fetched_receipt for trust), so an agent can distinguish it from siblings without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states that this tool 'supports: none on its own' and routes the agent to verify_fetched_receipt or its own trust root, which is a clear when-not and alternative. It is slightly less explicit about when to prefer receiptUrl over the tuple form, so it stops short of full when/when-not coverage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_scitt_configurationFetch SCITT configurationA
Read-onlyIdempotent

GET {baseUrl}/.well-known/scitt-configuration: the transparency service's self-description (service id, base URL, supported algorithms), returned as JSON. Provenance: fetched. Supports: none of the four questions; this is what the operator says about itself.

ParametersJSON Schema
NameRequiredDescriptionDefault
baseUrlNoany SCRAPI base URL; falls back to FORESTRIE_BASE_URL when omitted — never defaulted by the package itself

Output Schema

ParametersJSON Schema
NameRequiredDescription
problemNo
supportsYes
provenanceNo
configurationNo

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/openWorld, so the safety profile is covered. The description adds the endpoint path, that the result is JSON, and a genuinely useful trust caveat — the self-description is only 'what the operator says about itself' rather than verified truth. It omits pagination/error behavior, but adds real context beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the concrete endpoint, then supporting facts in terse form. The 'Provenance: fetched' / 'Supports:' shorthand is slightly compressed jargon but each clause carries information; no filler sentences.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, the description needn't explain return values, and the rich annotations cover the safety profile. Combined with a fully documented single parameter, an agent has what it needs to invoke this correctly; only the lack of alternative-routing guidance keeps it from a 5.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema fully documents baseUrl including the FORESTRIE_BASE_URL fallback. The description only mirrors baseUrl via the {baseUrl} path placeholder and adds no syntax or semantic detail beyond the schema — the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (GET) and resource (the /.well-known/scitt-configuration self-description), and enumerates what the resource contains (service id, base URL, supported algorithms). An agent can distinguish this config-fetch from the sibling fetch_receipt/fetch_genesis/fetch_accumulator calls without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives some orientation ('Supports: none of the four questions; this is what the operator says about itself'), which implies when it is relevant, but it never names an alternative tool or states a condition that selects this over a sibling. Usage is implied rather than directed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

query_registrationQuery registration statusA
Read-onlyIdempotent

One GET of {baseUrl}/logs/{bootstrapLogId}/{logId}/entries/{contentHash}, where contentHash is the hex sha256 of the signed statement bytes. Returns pending (with retryAfterMs when the server said so) or the receipt's URL and entry id. Never polls: call again yourself if you want to. Provenance: fetched. Supports: none of the four questions; this is registration status.

ParametersJSON Schema
NameRequiredDescriptionDefault
logIdYesUUID (with dashes), or a 16/32-byte hex log id
baseUrlNoany SCRAPI base URL; falls back to FORESTRIE_BASE_URL when omitted — never defaulted by the package itself
contentHashYeshex sha256 of the signed statement bytes
bootstrapLogIdYesUUID (with dashes), or a 16/32-byte hex log id

Output Schema

ParametersJSON Schema
NameRequiredDescription
statusNo
entryIdNo
problemNo
locationNo
supportsYes
provenanceNo
receiptUrlNo
retryAfterMsNo

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations cover the safety profile (readOnly, idempotent, openWorld, non-destructive), so the bar is lower; the description still adds single-shot semantics and the pending/retryAfterMs response branch. It doesn't discuss auth requirements or error cases, keeping it short of 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The endpoint and return shape are front-loaded in the first two sentences, and the no-polling rule is stated early. The trailing 'Provenance: fetched. Supports: none of the four questions' is meta-noise that doesn't earn its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values needn't be re-explained, and the description still summarizes the two response branches plus the non-polling contract. Nothing critical for invocation is missing, though auth and failure behavior are unaddressed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all four parameters, including contentHash as the hex sha256 of signed statement bytes, are already documented. The description restates contentHash without adding syntax or format detail beyond the schema, matching the baseline for fully-covered schemas.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb, resource and endpoint shape (GET /logs/{bootstrapLogId}/{logId}/entries/{contentHash}) and what comes back: pending with retryAfterMs, or the receipt's URL and entry id. An agent can distinguish this from fetch_receipt, which retrieves the receipt itself rather than its locator.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Never polls: call again yourself if you want to' gives concrete retry guidance, and the return of a receipt URL (rather than the receipt) implicitly routes retrieval to a sibling. There is no explicit when-not or named alternative, so it falls short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

verify_fetched_receiptFetch and verify receiptA
Read-onlyIdempotent

Fetch a receipt (as fetch_receipt) and verify it with @forestrie/mcp-verify's core under a trust root you supply as bytes (genesis, keyXy, accumulator, or checkpoints) or under an accumulator read from the chain in this call ({root: 'known-accumulator', chain: {genesis, rpcUrl, logId} or {rpcUrl, univocity, logId, chainId?}}). A genesis fetched in the same call is never the root. The result is the verifier's own: stages, the four questions (sealing, split-view, append-authority, attribution; not_answered_by_this_root is a real answer) and diagnostics, passed through unaltered, plus receipt_fetched_from_operator always and root_read_from_chain when the chain path was taken. Supply payload bytes and the entry id to have attribution answered.

ParametersJSON Schema
NameRequiredDescriptionDefault
grantNotrue to verify a grant receipt (verifyGrantReceipt) instead of a payload receipt
logIdNoUUID (with dashes), or a 16/32-byte hex log id
trustYesWhich trust root to verify under: bytes you supply (genesis, keyXy, accumulator, checkpoints), or {root:'known-accumulator', chain:…} to read the accumulator from the chain in this call. Never a genesis fetched in this same call.
baseUrlNoany SCRAPI base URL; falls back to FORESTRIE_BASE_URL when omitted — never defaulted by the package itself
entryIdNorequired for payload verification; optional for a COSE grant, required for a raw grant payload
payloadNothe exact registered payload (payload verification), or the committed grant bytes when grant:true
receiptUrlNoas returned by query_registration
massifHeightNo
bootstrapLogIdNoUUID (with dashes), or a 16/32-byte hex log id

Output Schema

ParametersJSON Schema
NameRequiredDescription
okNo
rootNo
stageNo
anchorNo
reasonNo
stagesNo
courierNo
problemNo
supportsYes
verifierNo
questionsNo
provenanceNo
diagnosticsNo

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations cover the safety profile (readOnly, idempotent, non-destructive, openWorld), and the description adds real behavioral detail beyond them: the four verification questions, that 'not_answered_by_this_root is a real answer', that result fields are passed through unaltered, and that a genesis fetched in the same call is never the trust root. Return-shape disclosure partially overlaps the output schema, keeping this from a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose and the trust-root enumeration are front-loaded, but the dense single-paragraph form with heavily nested parentheticals (the chain object grammar inline) makes it harder to parse than the content warrants. Every sentence carries technical weight, so little is wasted, but structure could be cleaner.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 9-parameter tool with a nested trust union and an output schema, the description covers the hard parts (trust-root selection, chain vs byte roots, result composition) thoroughly. Minor elements like baseUrl and receiptUrl sourcing are left to the schema, which is acceptable given 89% coverage and an existing output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 89%, so the schema already carries most parameter meaning (baseline 3). The description adds above-schema value by tying payload+entryId to the attribution answer and enumerating the trust-root shapes and the chain path, helping the agent map inputs to verification outcomes.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a concrete compound verb+resource ('Fetch a receipt ... and verify it') and explicitly frames the fetch as being like fetch_receipt, letting an agent distinguish it from the plain fetch sibling. The scope is unambiguous: retrieve then cryptographically verify under a supplied trust root.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The framing '(as fetch_receipt) and verify' implicitly routes agents who only want a raw receipt to fetch_receipt, and it gives a live condition ('Supply payload bytes and the entry id to have attribution answered'). It stops short of an explicit when-not statement, so it is strong context rather than full routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 6 tool updatesv0.1.1
    • First observedfetch_accumulator
    • First observedfetch_genesis
    • First observedfetch_receipt
    • First observedfetch_scitt_configuration
    • First observedquery_registration
    • First observedverify_fetched_receipt

TDQS

A4.1/5.0

Scored across 6 tools

Disambiguation4/5

Most tools target distinct resources: configuration, registration status, receipt, genesis, accumulator, and verification. The only overlap is fetch_receipt and verify_fetched_receipt, where the latter fetches and verifies the same receipt, but descriptions clarify the distinction.

Naming Consistency4/5

All names use lower snake_case with an action_entity pattern. The verbs vary (fetch, query, verify) appropriately, though fetch_ is used for four of six tools, making the pattern mostly predictable.

Tool Count5/5

Six tools is well-scoped for a resolver/verifier that fetches SCITT configuration, registration status, receipts, genesis, accumulators, and verifies receipts. Each tool has a clear, non-redundant role.

Completeness3/5

The surface covers core fetch and verify operations, but notable gaps exist for a transparency verifier: there is no tool to fetch checkpoints/signed tree heads, public keys (keyXy), or log entries by index. These are referenced as trust roots or verification inputs, so agents may hit dead ends.

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    F
    maintenance
    Provides a universal read path for agents to extract facts, metadata, and provenance from local files and guarded remote URLs without using generative LLMs.
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables MCP hosts to verify agent spending mandates and receipts, providing stateless tools for authorization, chain verification, credential verification, and DID resolution.
    Apache 2.0