Openterms-mcp
Openterms
Open source cryptographic consent receipts + programmable guardrails + provider verification for AI agents.
Your agent proves what it agreed to. Your policy controls what it's allowed to do. The API provider can verify both.
License Tests
Live Demo · Quickstart · Self-Host · MCP Server · Contributing · Open Receipt Spec
What It Does Openterms sits between your AI agent and the actions it takes. Three layers:
Receipts — Before your agent calls an API, it gets an Ed25519-signed receipt. Canonical JSON (RFC 8785), SHA-256 hash, real cryptography. Anyone can verify it using public keys — no API key needed, no trust in the server required.
Policy Engine — Daily spending caps, action type whitelists, escalation thresholds. The policy engine evaluates before the receipt is signed. Denied actions never get a receipt.
Provider Verification — API providers register their terms URL and verify agent consent before serving requests. One public GET call. Both sides of the transaction trust the proof.
Quickstart 60 seconds to your first receipt:
git clone https://github.com/jstibal/openterms.git cd openterms pip install flask pyjwt cryptography pyyaml bash quickstart.sh Or with Docker:
git clone https://github.com/jstibal/openterms.git cd openterms docker compose up --build
In another terminal:
bash quickstart.sh Receipt issuance is free — no wallet, no deposit, no payment required.
Self-Host Run your own Openterms instance:
Option 1: Direct
pip install flask pyjwt cryptography pyyaml python run.py
Server at http://localhost:5000
Option 2: Docker
docker compose up --build
Option 3: Point MCP server at your instance
export OPENTERMS_API_URL=http://localhost:5000 python openterms_mcp_server.py Everything runs locally. SQLite database, no external dependencies.
Hosted Service Don't want to self-host? Use the hosted instance at openterms.com — same open source code, managed for you.
MCP Server 10 tools for AI agents:
Tool What it does issue_receipt Signed receipt before any action, with provider verification headers verify_receipt Verify receipt cryptographic integrity (public) verify_receipt_by_hash Look up and verify by canonical hash (public) check_balance Workspace balance get_pricing Per-receipt pricing list_receipts Recent receipts get_policy Active guardrails — call on startup simulate_policy Pre-check: would this action be allowed? policy_decisions Audit trail of every allow/deny/escalate provider_activity Receipt stats for your API (provider auth) MCP Config { "mcpServers": { "openterms": { "command": "python3", "args": ["openterms_mcp_server.py"], "env": { "OPENTERMS_API_URL": "https://openterms.com", "OPENTERMS_API_KEY": "openterms_your_key_here" } } } }
How Provider Verification Works Agent Openterms API Provider | | | |-- issue_receipt ------->| | |<-- receipt + headers ---| | | |-- webhook notification -->| | | | |-- API call + headers ---|-------------------------->| | |<-- verify/{hash} ---------| | |-- receipt data ---------->| |<--------- response -----|---------------------------|
Agent issues receipt → gets X-Openterms-Receipt header Agent includes header in API call Provider calls GET /v1/receipts/verify/{hash} — public, no auth Valid → serve. Invalid → reject.
API Endpoints
Core Method Path Auth Description POST /v1/receipts Bearer Issue signed receipt POST /v1/receipts/verify None Verify receipt GET /v1/receipts/verify/{hash} None Verify by hash GET /v1/receipts Bearer List receipts GET /.well-known/jwks.json None Public signing keys Policy Engine Method Path Auth Description GET /v1/policy Bearer Active policy PUT /v1/policy Admin Create/update policy POST /v1/policy/simulate Bearer Test hypothetical action GET /v1/policy/decisions Bearer Decision audit trail Provider Verification Method Path Auth Description POST /v1/providers None Register as provider POST /v1/providers/verify Provider Verify domain GET /v1/provider/stats Provider Receipt stats GET /v1/provider/receipts Provider Recent receipts
Tests
make test
120 tests passing (80 core + 40 provider verification)
Architecture openterms/ ├── app.py # Flask API (1135 lines) ├── db.py # SQLite database (15 tables) ├── openterms_mcp_server.py # MCP server + CLI (10 tools) ├── core/ │ ├── canonical.py # RFC 8785 canonicalization │ └── signing.py # Ed25519 signing + JWKS ├── services/ │ ├── receipt_service.py # Receipt pipeline │ ├── ledger_service.py # Balance tracking │ └── policy_engine.py # Rule evaluation ├── tests/ │ ├── test_core.py # 80 tests │ └── test_mvp3.py # 40 tests ├── Dockerfile ├── docker-compose.yml ├── quickstart.sh └── .env.example
Roadmap
Phase Status What it does MVP1 ✅ Shipped Signed receipts — record what happened MVP2 ✅ Shipped Policy engine — enforce what's allowed MVP3 ✅ Shipped Provider verification — both sides trust the proof
ORS Spec 🔄 In progress Open Receipt Specification — portable format
Integrations 🔄 In progress LangChain, CrewAI one-line callbacks
MVP4 Planned Receipt chaining, agent certification
Contributing
See CONTRIBUTING.md. We especially welcome framework integrations, language SDKs, and feedback on the Open Receipt Specification.
License Apache 2.0 — see LICENSE.
Copyright 2026 Staticlabs Inc.
Available Tools
10 toolscheck_balanceA
Check workspace USDC balance (minor units, 1 USDC = 1,000,000).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description bears full burden. It discloses that the balance is in minor units but omits other behavioral traits such as authentication requirements, read-only nature, or scope (e.g., which workspace).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, well-structured sentence that conveys the tool's purpose and key detail (unit) without extraneous words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with no parameters or output schema, the description is mostly adequate but leaves ambiguity about which workspace is being checked (e.g., does it use the current workspace context?). This gap could confuse an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has no parameters (input schema is empty), so the description correctly provides no parameter details. However, it adds important context about the unit of the returned balance, which is valuable beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('check') and the resource ('workspace USDC balance'), and specifies the unit (minor units with conversion factor). It distinguishes the tool from siblings as the only balance-checking tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. It does not mention any prerequisites, context, or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_policyA
Get the active policy (guardrails) for this workspace. Returns the rules that govern what this agent is allowed to do. An agent SHOULD call this on startup to understand its constraints.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It correctly indicates a read operation with no side effects, but lacks details such as whether the result is cached, update frequency, or authentication requirements. This is minimally adequate for a straightforward getter.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three concise, front-loaded sentences with no wasted words. The first sentence states the main action, the second clarifies the return, and the third provides usage direction.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has no parameters and no output schema, the description covers the core purpose and usage context (startup). It could optionally describe the return format (e.g., what fields the rules contain), but this is not critical for agent invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero parameters with 100% coverage, so no parameter information is needed from the description. The description adds value by explaining the purpose of the return value, which is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Get' and the resource 'active policy (guardrails)', specifying it returns rules that govern agent actions. This distinguishes it from sibling tools like policy_decisions and simulate_policy, which likely involve more detailed or simulated policies.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly advises calling this tool on startup to understand constraints, providing clear when-to-use guidance. It does not explicitly mention when not to use or alternatives, but the context is sufficiently clear for a simple read operation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_pricingA
Get current per-receipt pricing. Public — no API key needed.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Describes public access (no auth needed), but no annotations are provided. Does not disclose return format or any limits; minimal but acceptable for a zero-parameter tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no extraneous information. Front-loaded with action and key detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Adequate for a simple public tool with no parameters. Could mention return structure, but not essential given the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters; schema coverage is 100%. Description adds meaning by specifying 'per-receipt pricing', clarifying the scope beyond the empty schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states verb 'Get' and resource 'current per-receipt pricing'. Adds context about public access, distinguishing it from other tools like check_balance or get_policy.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Specifies that the tool is public with no API key required, providing immediate guidance on authentication. However, lacks explicit when-to-use vs alternatives, though no alternatives exist.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
issue_receiptA
Issue a cryptographically signed terms receipt BEFORE your agent takes an action. Returns an Ed25519-signed receipt proving consent to terms. If this returns POLICY_DENIED or POLICY_ESCALATION_REQUIRED, STOP and notify the user.
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | Yes | Identifier for this agent | |
| action_type | Yes | ||
| terms_url | Yes | URL of the terms being agreed to | |
| terms_hash | Yes | SHA-256 hash of the terms document (64 hex chars) | |
| timestamp | No | ISO 8601 timestamp (defaults to now) | |
| pricing_version | No | Pricing version (defaults to 2025-01) | |
| action_context | No | Optional metadata (provider, model, endpoint, etc.) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of behavioral disclosure. It reveals it returns an Ed25519-signed receipt and may return specific policy errors. It does not discuss side effects, authentication, or rate limits, but the core behavior is well-explained.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences front-load the purpose and key instructions. Every word earns its place, with no redundancy. The structure is efficient and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 7 parameters and no output schema, the description is mostly complete: it explains the return value and error conditions. It could mention the receipt format in more detail, but the core functionality is adequately covered.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 86%, providing most parameter details. The description adds no additional meaning beyond the schema, so it meets the baseline. It does not elaborate on action_type enum or action_context structure, but the schema suffices.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool issues a cryptographically signed receipt, differentiating it from siblings like check_balance or get_policy. The verb 'issue' and specific output 'Ed25519-signed receipt' make the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description specifies to use this tool 'BEFORE your agent takes an action,' providing clear timing. It also instructs to stop and notify on POLICY_DENIED or POLICY_ESCALATION_REQUIRED. However, it does not mention when not to use it or alternative tools for receipt verification.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_receiptsC
List recent receipts for this workspace.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max receipts to return (default 10, max 50) | |
| action_type | No | Filter by action type |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It states 'list' which implies read-only, but does not mention any behavioral traits such as pagination, ordering, security requirements, or whether results are cached. Minimal behavioral insight.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Extremely concise at one sentence, no wasted words. However, it could be improved by front-loading key constraints (e.g., 'recent' definition) without adding length.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Without an output schema, the description should at least hint at the return format or included fields. It omits important context like ordering (by date?), the meaning of 'recent,' and whether results are paginated. Incomplete for a list tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the description adds no extra meaning beyond the schema. Both parameters (limit and action_type) are already explained in the schema, making further elaboration unnecessary.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (list) and resource (recent receipts for this workspace). It distinguishes from sibling tools like issue_receipt and verify_receipt by focusing on listing recent items.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use versus alternatives like verify_receipt_by_hash for specific receipts or get_policy for policy details. The context of 'recent' is ambiguous, and no exclusions are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
policy_decisionsA
View recent policy evaluation decisions (allow/deny/escalate) for this workspace. Useful for auditing and understanding what the policy engine has been doing.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max decisions to return (default 10) | |
| decision | No | Filter by decision type |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the full burden falls on the description. While 'View' implies a read-only operation, the description does not disclose other behavioral traits such as whether authentication is required, rate limits, or if results are real-time vs. cached. This is insufficient for a tool with no annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long, front-loading the core function in the first sentence. The second sentence provides additional context without redundancy. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (2 parameters, no output schema, no nested objects), the description covers the purpose and typical usage (auditing). It could mention ordering or output format, but is largely complete for the intended use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Both parameters have 100% schema coverage with clear descriptions: 'limit' (Max decisions to return, default 10) and 'decision' (enum filter). The description adds no additional meaning beyond stating that the tool returns recent decisions, so baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'View', specifies the resource 'recent policy evaluation decisions', and scopes it to 'this workspace'. It also lists the possible decision types (allow/deny/escalate). This differentiates it from sibling tools like simulate_policy, which is for simulation instead of historical viewing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions that the tool is 'useful for auditing and understanding what the policy engine has been doing,' which implies when to use it, but it does not explicitly state when not to use it or provide comparisons to alternatives like simulate_policy.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
provider_activityA
View receipt activity against your terms URL (requires provider API key via OPENTERMS_PROVIDER_KEY). Shows stats, unique agents, and recent receipts for your API.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max receipts to return (default 10) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided. The description implies a read-only operation ('View'), mentions authentication requirements, and describes what is returned (stats, unique agents, receipts). However, it does not explicitly state non-destructiveness or other behavioral traits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loading the purpose and authentication requirement, followed by what is shown. Every sentence adds value with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has one optional parameter and no output schema, the description adequately explains the action and output. It misses some detail about the exact structure of 'stats' or 'unique agents', but is sufficient for selection.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with one parameter (limit) having a description. The description adds no additional meaning to the parameter beyond what the schema provides, meeting the baseline for high coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the verb 'View' with a specific resource 'receipt activity against your terms URL', clearly distinguishing it from siblings like list_receipts or verify_receipt by specifying it's for the provider's own API and shows stats, unique agents, and recent receipts.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description states the prerequisite (requires provider API key via OPENTERMS_PROVIDER_KEY) but does not explicitly guide when to use this tool versus siblings like list_receipts or check_balance. Context is implied but not explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
simulate_policyA
Test whether a hypothetical action would be allowed by the current policy WITHOUT actually issuing a receipt. Use this to pre-check before acting.
| Name | Required | Description | Default |
|---|---|---|---|
| action_type | Yes | ||
| terms_url | Yes | URL of the terms | |
| action_context | No | Optional context metadata |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided. The description discloses the key behavior of being a dry-run (no receipt issued), but does not mention return format, error handling, or auth needs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence that is efficient, front-loaded with the purpose, and communicates the essential distinction without fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Moderate complexity; description explains what and when but omits return value, errors, and permissions, which are important for a simulation tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 67% with descriptions for terms_url but not for action_type details or action_context. Description adds no extra parameter insight beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it tests whether a hypothetical action is allowed without issuing a receipt, distinguishing it from siblings like issue_receipt which actually issues.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says 'use this to pre-check before acting', providing clear context. Lacks explicit alternatives or when-not-to-use, but the sibling list and wording imply its role.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verify_receiptB
Verify a receipt's cryptographic integrity. Public — no API key needed.
| Name | Required | Description | Default |
|---|---|---|---|
| receipt_id | Yes | ||
| canonical_hash | Yes | ||
| signature | Yes | ||
| key_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description carries the full burden of disclosure. It only states the action and public nature, but omits behavioral traits such as what happens on failure, whether the operation is read-only, or any side effects. This is insufficient for a mutation-capable tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, front-loading the action. It is concise but could benefit from more detail without losing efficiency.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 4 required parameters, no output schema, and no annotations, the description is incomplete. It does not explain return values, error conditions, or parameter relationships, leaving the agent under-informed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 4 required parameters with 0% description coverage. The description does not explain the role of any parameter (e.g., receipt_id, canonical_hash), failing to add meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Verify a receipt's cryptographic integrity.' This is a specific verb-resource combination that distinguishes it from siblings like verify_receipt_by_hash, which likely uses a different input.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description notes 'Public — no API key needed,' providing clear context for when to use this tool (public access without authentication). However, it lacks explicit guidance on when not to use it or comparisons with alternatives like verify_receipt_by_hash.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verify_receipt_by_hashA
Verify a receipt by its canonical hash. Public — no API key needed. Use this to check if an agent has a valid consent receipt before serving a request. Returns receipt details and cryptographic verification result.
| Name | Required | Description | Default |
|---|---|---|---|
| canonical_hash | Yes | The canonical hash of the receipt to verify |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Discloses that no API key is needed (auth requirement) and that it returns receipt details and cryptographic verification result. Since no annotations exist, the description covers key behavioral aspects for a read-only verification tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences with a clear use-case statement. No fluff, purpose and usage are front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers purpose, usage, auth, and return value for a simple tool. Lacks explanation of 'canonical hash' or error scenarios, but acceptable given minimal complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description mentions 'canonical hash' which is already detailed in the schema (100% coverage). The description adds no significant extra meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states it verifies a receipt by its canonical hash. The verb 'verify' and resource 'receipt by hash' are specific and distinguish it from the sibling 'verify_receipt' tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states the use case: check if an agent has a valid consent receipt before serving a request. Also notes it's public, no API key needed. However, it doesn't contrast with other verification tools like 'verify_receipt'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
10 tool updates
v0.1.0- First observed
check_balance - First observed
get_policy - First observed
get_pricing - First observed
issue_receipt - First observed
list_receipts - First observed
policy_decisions - First observed
provider_activity - First observed
simulate_policy - First observed
verify_receipt - First observed
verify_receipt_by_hash
TDQS
Scored across 10 tools
Most tools have clearly distinct purposes: issuing, verifying, listing, policy simulation, and provider stats are separate concerns. The only ambiguity is between verify_receipt and verify_receipt_by_hash, though their descriptions clarify the different input methods.
Most tool names follow a consistent lowercase verb_noun pattern such as verify_receipt, issue_receipt, and get_policy. Two noun-phrase names, policy_decisions and provider_activity, deviate slightly but are still readable and predictable.
With 10 tools, the server is well-scoped for its terms/receipt policy domain. Each tool serves a distinct operational need: policy access, simulation, decisions, receipt issuance/verification, and workspace/provider management.
The tool set covers policy retrieval/simulation, receipt issuance/verification/listin, and workspace/provider accounting, so the core workflow is complete. Minor gaps exist such as no explicit receipt revocation or policy update, but these are not clearly required by the domain.
Maintenance
Related MCP Connectors
Pre-execution governance for AI agents. Deterministic PASS/FAIL/REVIEW verdicts, replayable proof.
Security gateway for AI agents: policy, approval, and audited execution, no secrets shared.
Pre-spend firewall for AI agents. Approves, blocks, flags transactions against policy rules.
The decision layer for AI agents: act, escalate or refuse, and every decision comes back signed.
Related MCP Servers
- AlicenseNot gradedqualityNot gradedmaintenanceGovernance primitives for autonomous agents. Verify actions against policy, record signed provenance, and bind intents cryptographically. Free tier available.-
- AlicenseNot gradedqualityDmaintenanceProvides cryptographic governance receipts for AI agents, enabling pre-execution evaluation and signed verdicts (EXECUTE/BLOCK/REVIEW/SHADOW) with offline-verifiable audit trails.MIT
- FlicenseNot gradedqualityCmaintenanceEnables AI agents to propose wallet payments while a local, human-authored policy decides whether each transaction is approved, requires human confirmation, or is refused, and records every decision in a signed, append-only ledger.-
- AlicenseNot gradedqualityCmaintenanceProvides permission gates and tamper-evident audit logging for AI agent tool executions, with declarative policies, consent ladders, and hash-chained verification.MIT