OpenWorkProof
You can use this MCP server to inspect, sign, verify, and export OpenWorkProof evidence, run the reference SOC workflow, and operate ledger-backed verification/acceptance workflows.
Fetch synthetic Slips alerts, analyze supplied JSONL into cases and a signed evidence bundle, and verify bundles with separately supplied trust pins; missing pins yield UNKNOWN.
Generate Ed25519 key pairs, compute key IDs and canonical digests, sign payloads, and verify signatures.
Verify WorkOrder identity bindings and nested AgentRequest/HumanDecision claims.
List canonical domains and validate profiles, scopes, observations, judgment commitments, and action-binding manifests; compare scopes with observations.
Replay SQLite ledgers; query status and binding status; explain binding decisions; derive settlement readiness.
Run ledger-coordinated tests and repo-read operations; commit verification results or signed decisions; prepare unsigned decision drafts.
Build public, diagnostic, or customer-private delivery packages; verify and render surface bundle reports.
Retrieve authoritative JSON Schemas and their frozen digests.
Analyze local or remote repositories for structure, languages, line counts, and dependencies.
Provides a GitHub Action that integrates OpenWorkProof verification and acceptance evidence into existing pull request delivery workflows.
OpenWorkProof
English · 简体中文
Contributors: dengyier & Tim Shing(成孝添)
Check what an AI agent was allowed to do, what it recorded, and whether its evidence holds up.
OpenWorkProof (OWP) is an open-source toolkit for developers and teams using AI agents. Use it to review signed work records, check exported evidence, or run a bounded Codex preview-editing task. Security engineers can also try a reference workflow for reviewing Slips alerts.
You keep the final decision to accept or reject the result. Connecting OWP to an agent gives it tools; protection of a Codex task requires a separate Guard setup.
Get started · Codex Guard · Docs · Community
Current release: 1.6.1 · PyPI · Release notes · MCP Registry
What can you do with it?
Your task | What OWP helps you do | Start here |
Review an agent's work records | Check signed task scope, recorded actions and evidence; export a bundle another reviewer can inspect. Your integration must supply the records. | |
Let Codex edit a preview copy | Explicitly allow supported text edits inside one preview directory and reject out-of-scope requests in the guarded launch path. | Guard setup — experimental |
Review Slips alert data | Group supplied JSONL alerts into review cases, inspect simulated decisions and export a signed evidence bundle. | SOC walkthrough — reference implementation |
Add evidence review to a delivery workflow | Integrate verification into a GitHub Action or your own agent workflow, then keep human acceptance as a separate step. |
OWP does not automatically watch every agent or tool on your computer. Fleet permissions, WorkBuddy integration and live SOC remediation are not part of the verified release paths above.
Related MCP server: Agent Receipts
Get started with MCP
You need Python 3.10+, uv, and an MCP-capable client. Add this local stdio server to the client's MCP configuration:
{
"mcpServers": {
"openworkproof": {
"command": "uvx",
"args": ["openworkproof==1.6.1"]
}
}
}This is the common mcpServers configuration shape. Some clients use a different file or top-level key; see the client-specific setup. uvx downloads the package and dependencies when needed. OWP does not require an OWP cloud account or API key.
After the client connects, it should discover 32 tools. Try this first with the included synthetic data:
Use
owp_soc_sample_alertsto get the OpenWorkProof sample. Pass itsalerts_jsonltoowp_soc_analyze_slips, then pass the returned bundle toowp_soc_verify_bundle. Explain the cases and simulated actions. Do not operate a real host. If independently obtained trusted keys and checkpoints are missing, keep the verification result UNKNOWN and explain what is missing.
You should receive a case summary and evidence bundle. UNKNOWN is expected without independent trust information; it does not mean installation failed. This sample uses a deterministic investigation stub and simulated actions. It does not test detection accuracy or remediate a host.
To use your own alerts, follow the SOC guide. Alert content is returned to your MCP client and can enter its model conversation, so use data you are authorized to share with that client.
Optional: install the SOC Review Skill
The Skill gives your agent a repeatable procedure for using those tools. With Node.js/npm available:
npx skills add dengyier/OpenWorkProof --skill openworkproof-soc-reviewChoose your agent and install scope in the installer. Read the instructions first, or use the Skill ZIP with the 2026-11-09 credit revision.
The Skill does not configure MCP or enable Guard. Configure the MCP server above separately. Your client's usual model charges still apply.
Try Codex preview protection
Experimental, separately enabled. Guard is for supported local text-editing tasks in a designated preview directory. Use a new test project or a copy you own first.
Read the English first-run guide before enabling. It includes a complete test project, scope review, expected checks and uninstall steps. The approval prompts are currently in Chinese, while the default output is JSON. Review the scope yourself and enter yes only when you understand it; do not use a trust shortcut to skip that review.
enable runs a live probe and run uses your existing Codex login and model allowance. Continue only after doctor confirms the required setup, current review and live probe. Ordinary Codex launches are not automatically protected.
The recorded live-host baseline covers macOS, Python 3.12 and Codex CLI 0.147.0, from the Guard implementation introduced in 1.5.0. Check compatibility and rerun the probe in your own environment. Builds, deployment, online search, personal MCP/plugins and whole-computer isolation are outside this launch path. See scope and limitations.
Install the CLI package, then run these commands from your target Git project after creating a preview directory and a text file such as preview/index.html:
uv tool install --python 3.12 'openworkproof==1.6.1'
owp-guard install --project "$(pwd -P)" --allow-dir preview
owp-guard enable --project "$(pwd -P)"
owp-guard doctor --project "$(pwd -P)"
owp-guard run --project "$(pwd -P)" --prompt "Update the heading in preview/index.html. Keep the change in preview; do not publish."Check an evidence bundle from the command line
Already have an OWP bundle? Install the package as above, then use the command matching its format:
# Core Surface Bundle
owp surface-verify /path/to/surface-bundle
# Core Acceptance Bundle
owp acceptance-bundle-verify /path/to/acceptance-bundle
# SOC reference output; missing external trust intentionally returns UNKNOWN/nonzero
owp-aisoc verify /path/to/soc-reviewThese formats and their trust requirements differ. Follow the Core verification guide or SOC trust guide. Obtain expected public keys and checkpoints through a separate trusted route; copying them from an untrusted bundle does not establish who you are trusting.
What a result means
Verification checks evidence under the stated scope and trust inputs. It does not establish that a business outcome is correct. Core
VERIFIEDand bindingBOUNDdo not mean customer acceptance or payment.Human acceptance is separate. The intended reviewer keeps the decision to accept or reject a delivery. See the acceptance workflow.
SOC results are reference results. Investigation is a deterministic stub; actions and acceptance statuses are simulated. There is no live SOC deployment, production detection benchmark, OS isolation or HSM in this integration.
Signing tools can handle sensitive keys. Generic key-generation/signing tools can return or accept private-key material. Keep production signing keys out of model conversations and use an externally controlled signing workflow.
OWP is open source. The current package and Skill are free to use under their licenses; your model provider and infrastructure may charge separately. Public listings, automated scores and engineering tests are not customer adoption or a security certification.
Documentation
Need | Documentation |
Connect MCP and understand the 32 tools | |
Review Slips alerts and install the Skill | |
Set up a guarded Codex task | |
Build an integration with signed task scope and human authority | |
Understand protocol mechanics and historical validation | |
Report a reproducible problem or contribute |
Community and contributing
The card is a live directory badge; follow it for the scanned version and scope. Find OWP on MCPRush, Glama, and AgentSkills.in.
The community record preserves directory contributions, external research, integration experiments and technical writing, with their original links and checked dates. These records have different scopes and do not imply endorsement or production adoption.
Contribute a reproducible bug report, an integration, or a documentation improvement. Please report security issues privately through GitHub Security Advisories.
License
OWP Core: Apache-2.0. Tim Shing(成孝添), GitHub alphatin123, contributed the aisoc component under MIT. The combined package metadata uses Apache-2.0 AND MIT.
Available Tools
32 toolsowp_analyze_repoA
Analyse a repository's structure: file count, languages, dependencies.
Args:
source: Local path or remote Git URL to the repository.
clone_enabled: If True and source is a URL, clone it to a
temporary directory first (default True).
Returns: Repository analysis including file entries, language stats, line counts, and dependency information.
| Name | Required | Description | Default |
|---|---|---|---|
| source | Yes | ||
| clone_enabled | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of behavioral disclosure. It does reveal the cloning behavior (clone to temp directory) and that analysis includes file entries and dependencies, but it omits potential side effects like network usage or cleanup of temporary directories. It's adequate but not exhaustive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured, using Args and Returns sections for clarity. Every sentence earns its place, with no filler or redundancy. The main purpose is front-loaded, and the parameter and return details are presented efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (2 parameters) and the presence of an output schema, the description provides sufficient context: clear purpose, parameter semantics, behavioral details, and return value overview. It covers all necessary aspects for an agent to invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must explain parameters, and it does thoroughly. 'source' is described as a local path or remote Git URL, and 'clone_enabled' explains its default and behavior conditionally. This adds significant meaning beyond the bare schema titles.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function with a specific verb ('Analyse') and resource ('repository's structure'), listing concrete output aspects (file count, languages, dependencies). This distinguishes it from siblings like owp_repo_read, which likely focuses on file contents, making the purpose unmistakable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context on when to use the tool: whenever repository structure analysis is needed. It also explains the clone_enabled parameter behavior, indicating remote vs local usage. However, it does not explicitly mention alternatives or exclusions, so it falls short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
owp_build_delivery_packageC
Export a public, diagnostic, or customer-private delivery package.
| Name | Required | Description | Default |
|---|---|---|---|
| ledger | Yes | ||
| output | Yes | ||
| privacy_view | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
There are no annotations to rely on, so the description carries the burden. The description implies a read/export operation, but it's unclear if this produces a file, returns a link, or triggers a background process. The word 'build' in the name and 'Export' in the description suggest some processing might occur, but the agent is not told about side effects (e.g., does it create a persistent package? Is it idempotent?). No error conditions, permissions, or side-effect disclosures are mentioned.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence with no fluff. It front-loads the action ('Export') and describes the resource. Every word earns its place. However, it's so brief that it misses important information, which hurts its score below 5, but as a pure exercise in conciseness, it's well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has three required parameters, no annotations, no schema descriptions, and an output schema (details not shown). However, the description doesn't explain the output, the meaning of the parameters, or the context in which this tool is used. There's no mention of what happens with 'output' (is it a path? a format?), or what 'privacy_view' options exist. The description covers maybe 10% of what an agent would need to use this tool confidently. Given the complexity of the sibling tools (crypto, verification, binding), this is insufficient context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% and the description doesn't add any parameter-specific meanings. The parameters 'ledger', 'output', and 'privacy_view' have no descriptions in the schema, and the description's mention of 'public, diagnostic, or customer-private' hints at 'privacy_view' values but doesn't connect them clearly. The agent is left to guess the valid values for each parameter, the expected format (e.g., paths, URIs, enums), and how the three parameters interact. For a build tool with 0% coverage, this is a significant gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Export a public, diagnostic, or customer-private delivery package.' uses a clear verb ('Export') and names the resource ('delivery package'), but likely a type of package. The phrase 'public, diagnostic, or customer-private' provides some scope, though the actual difference between these package types is not explained. However, among many 'owp_' sibling tools, this one is differentiated by the verb 'build' in the name and 'Export' in the description, though alternatives like 'owp_verify_*' also involve packages. It's adequate but doesn't fully distinguish from potential sibling tools that might also deal with delivery packages.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit guidance on when to use this tool versus alternatives. The description is a single sentence with no mention of prerequisites, when not to use, or reference to sibling tools. The list of siblings (e.g., 'owp_run_verification', 'owp_get_decision') suggests a broader workflow, but the description doesn't guide the agent on when 'build' is appropriate versus other actions. No exclusions or alternatives are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
owp_compute_digestA
Compute the canonical SHA-256 digest of an OpenWorkProof payload.
The digest is computed over the RFC 8785 JCS canonicalisation of
{"domain": "openworkproof/<object_type>/v0.1", "payload": <payload>}
(with digest and signature fields stripped from the payload
at the top level).
Args: object_type: One of the allowed canonical domains. payload: JSON string of the payload object.
| Name | Required | Description | Default |
|---|---|---|---|
| payload | Yes | ||
| object_type | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full transparency burden. It excels by detailing the exact computation method: RFC 8785 JCS canonicalisation, the envelope structure, and the removal of digest and signature fields. It does not mention error handling or permission requirements, but the algorithmic behavior is clearly disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is efficiently structured with a clear one-sentence summary, then necessary algorithmic detail, then concise parameter explanations. There is no fluff or redundant information. Each sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, describing return values is unnecessary. The description covers the algorithm, the exact input semantics, and the envelope structure. It does not mention that object_type valid values can be obtained from a sibling tool (owp_list_domains), which is a minor contextual gap, but overall it is complete for the intended cryptographic functionality.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Given the input schema has 0% description coverage, the description compensates by providing an 'Args' section that gives meaning to both parameters. It states object_type must be an allowed canonical domain and payload is a JSON string of the payload object. It also explains which fields are stripped, adding semantic value. It could be improved by referencing how to get the allowed domains (e.g., owp_list_domains).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a clear, specific verb+resource statement: 'Compute the canonical SHA-256 digest of an OpenWorkProof payload.' It further defines the exact canonicalization envelope and the stripping of digest and signature fields, which thoroughly distinguishes it from sibling tools like owp_get_schema_digest or owp_compute_key_id.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not explicitly state when to use this tool versus alternatives. It implies use for computing the OWP payload digest, but gives no direct comparison or exclusion with siblings such as owp_sign_payload or owp_verify_signature. The specificity of the tool makes the usage implied rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
owp_compute_key_idA
Compute the OpenWorkProof key_id for a given Ed25519 public key.
Args: public_key_b64url: The raw public key bytes encoded as unpadded base64url (43 characters).
| Name | Required | Description | Default |
|---|---|---|---|
| public_key_b64url | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
There are no annotations, so the description must carry the full burden. It only says 'Compute', which restates the name and gives no additional behavioral context (e.g., whether it is deterministic, pure, or has any error conditions). This is a minimal disclosure for a computation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence followed by a compact Args block with no verbal filler. It front-loads the core purpose and immediately provides the parameter specification, making it easy to scan.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple single-parameter tool with an output schema, the description sufficiently covers the input format and what the tool computes. It omits potential edge cases (e.g., invalid key handling), but such details are not essential given the tool's simplicity and the presence of an output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description provides crucial parameter details beyond the schema: it specifies the exact encoding ('unpadded base64url') and expected length ('43 characters') for public_key_b64url. This fully compensates for the schema's 0% description coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Compute') and clearly identifies the resource (OpenWorkProof key_id) and the input (Ed25519 public key), making the tool's purpose unambiguous. It distinguishes itself from sibling tools like owp_sign_payload or owp_compute_digest by naming the exact derivation target.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The usage is implied rather than explicitly stated: it computes a key_id from a public key, and no alternative tools are mentioned. While the purpose is clear enough to infer appropriate use, the description lacks explicit guidance on when to choose this tool over similar ones.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
owp_control_observation_validateA
Assess one v0.5 control observation set against its contracts.
This read-only tool never signs, commits, accepts, or settles anything.
Signer authority is reported as not_checked, never as authorized.
| Name | Required | Description | Default |
|---|---|---|---|
| payload_json | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Even with no annotations, the description discloses critical behavior: it never signs, commits, accepts, or settles, and it reports signer authority as not_checked, never authorized. This clearly communicates what the tool does not do and what limitation exists.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, first sentence introduces the core purpose, remaining sentences add essential safety semantics. No wasted or redundant text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is mostly complete for a single-parameter validation tool with an output schema: it conveys purpose, read-only nature, and the signer-authority limitation. It falls short only in parameter guidance and explicit mention of when to prefer this over sibling tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is one required parameter, payload_json, with 0% schema description coverage. The description implies the payload is the control observation set, but does not explain the expected JSON structure, required fields, or encoding, so it does not compensate for the missing parameter documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names the specific resource: one v0.5 control observation set, and the action: assess against contracts. This clearly distinguishes it from siblings like owp_integrity_observation_validate by the resource type and version.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The read-only statement provides clear contextual guidance: this tool can validate without side effects. It does not explicitly list when not to use it or name alternatives, so it stops short of a full 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
owp_explain_binding_decisionB
Verify and explain one BindingDecision (read-only).
| Name | Required | Description | Default |
|---|---|---|---|
| payload_json | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the transparency burden and does state 'read-only,' which is a meaningful behavioral safeguard. It does not explain what verification covers or what side effects are absent, but an explicit read-only qualifier plus the available output schema is reasonable for this simple tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no wasted words. It communicates the core action, the resource, and the safety profile immediately.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter read-only tool with an output schema, the description is passable but not complete. The key gaps are missing payload semantics and lack of guidance on when to pick this tool instead of the many related decision- and binding-focused sibling tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has one required payload_json string with 0% description coverage. The description adds only that it concerns a BindingDecision, but does not clarify how a BindingDecision must be serialized, whether the string must be raw JSON, or what makes the payload valid. That is insufficient for the parameter to be used confidently.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the operation as verifying and explaining one BindingDecision and explicitly notes it is read-only. This is specific and grounded in the tool name's resource, though it does not fully differentiate it from sibling tools that also touch decisions or bindings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance tells when to use this tool over alternatives like owp_get_decision, owp_get_binding_status, or owp_validate_judgment_commitment. The only hint is the phrase 'explain one BindingDecision,' which implies a narrow use case but does not state exclusions or contrast with siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
owp_generate_keypairA
Generate an Ed25519 signing key pair; this tool takes no input parameters.
Returns the private key as a hex string and the public key as
base64url, along with the derived key_id.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden; it does disclose the return shapes (hex private key, base64url public key, derived key_id), which is useful behavioral context. It says nothing about whether the key material is persisted, whether generation is idempotent, or any security/permission considerations for a tool that emits secret key material.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the operation and immediately followed by the result contract. No filler or redundant restatement beyond the useful note that no inputs are required.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so the brief return-value summary is optional extra value rather than a requirement. What is missing is any note on key lifecycle or security handling, but for a simple parameterless generator the description is largely sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, and the description explicitly confirms it takes no input, so nothing is left ambiguous. Baseline for a parameterless tool applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb and resource (generate an Ed25519 signing key pair) plus what it returns, so the operation is unambiguous. It does not, however, distinguish itself from siblings such as owp_compute_key_id, even though it also emits a key_id, leaving potential overlap unexplained.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to call this versus alternatives like owp_compute_key_id or owp_sign_payload, nor any exclusions or prerequisites. The only contextual fact offered is that it takes no input parameters, which is restated from the schema rather than usage guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
owp_get_binding_statusC
Read the current binding decision head from a ledger (read-only).
| Name | Required | Description | Default |
|---|---|---|---|
| ledger_path | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations available, the description carries the full burden for behavioral disclosure, but it only adds 'read-only,' which largely restates the verb 'Read'. It does not disclose what happens if the ledger_path is invalid, whether the binding decision head can be absent, or any other behavioral edge cases.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, short sentence that front-loads the action and object. Every word contributes meaning, with no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter read tool with an output schema, the description is minimally adequate. However, the jargon 'binding decision head' is unexplained, and the lack of guidance relative to similar siblings leaves some contextual gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description should compensate for the undocumented ledger_path parameter. It only vaguely ties the parameter to 'a ledger' and does not explain path format, expected location, or validity requirements.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Read') and the specific resource ('current binding decision head from a ledger'), and it explicitly notes that the operation is read-only. It does not, however, differentiate this from sibling tools like owp_get_decision or owp_explain_binding_decision.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus the many related sibling tools such as owp_get_decision or owp_validate_action_binding_manifest. There is also no mention of prerequisites, exclusions, or typical scenarios where this tool is preferred.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
owp_get_decisionB
Prepare, but do not sign or commit, a versioned decision draft.
| Name | Required | Description | Default |
|---|---|---|---|
| ledger | Yes | ||
| request_json | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description should disclose side effects. It only mentions what it does NOT do (sign/commit) without explaining what 'prepare' entails, whether it creates/modifies state, or requires specific permissions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that conveys the core purpose and constraint in minimal words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having an output schema, the tool's parameters and behavioral context are unexplained; the description is too minimal for an agent to correctly invoke it without additional assumptions.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema provides no descriptions for 'ledger' or 'request_json' (0% coverage), and the description does not mention them, leaving the agent without any guidance on parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('Prepare') on a specific resource ('a versioned decision draft') with an explicit constraint ('but do not sign or commit'), which clearly distinguishes it from sibling tools like owp_sign_payload and owp_get_binding_status.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit usage context or alternative tool names are given; the 'do not sign or commit' implies it is a precursor to signing/committing but does not state when to use this tool over others.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
owp_get_schemaA
Get the authoritative JSON Schema for an OpenWorkProof object type.
Args:
object_type: One of work-order, capability-grant,
action-receipt, acceptance-receipt,
acceptance-rejection-receipt.
version: Schema version (default 0.1).
| Name | Required | Description | Default |
|---|---|---|---|
| version | No | 0.1 | |
| object_type | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. The verb 'Get' and adjective 'authoritative' imply a read-only operation with no side effects, but the description does not explicitly state behavior for invalid inputs, error conditions, or whether the returned schema is cached or dynamically generated. This is acceptable for a simple getter but leaves some uncertainty.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is succinct, uses a clear structure with a one-line purpose followed by an Args list, and contains no redundant or filler content. Every sentence contributes useful information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity and the presence of an output schema, the description adequately covers the key aspects: what the tool does, the allowed object types, and the version default. It does not explain return value shape, but that is handled by the output schema, so the description is sufficiently complete for a getter tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage, so the description compensates by listing all valid object_type values (work-order, capability-grant, etc.) and explaining the version default. This adds significant meaning beyond the schema's bare property definitions, though it does not specify constraints on the version format.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Get') and identifies the resource ('authoritative JSON Schema for an OpenWorkProof object type'). This clearly distinguishes it from sibling tools like owp_get_schema_digest, which retrieves a digest rather than the schema itself.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear usage context by enumerating the valid object_type values and specifying the default version. However, it does not explicitly mention when to use this tool over alternatives (e.g., owp_get_schema_digest) or any exclusions, but the purpose is unambiguous enough that a user would know when it applies.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
owp_get_schema_digestA
Get the frozen SHA-256 digest of an authoritative JSON Schema.
This digest is a protocol-review anchor: changing it requires an explicit version-bump decision.
Args:
object_type: One of the five schema-bearing object types.
version: Schema version (default 0.1).
| Name | Required | Description | Default |
|---|---|---|---|
| version | No | 0.1 | |
| object_type | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It conveys that the tool is read-only ('Get') and explains the versioning constraint, but it does not mention error behavior, permissions, or any edge cases. The output schema covers return format, but other behavioral traits remain unspecified.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured: a clear one-sentence purpose, a one-sentence context/constraint, and a clean Args list. There is no redundant information, and the key details are front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema and sibling tools available, the description provides sufficient information for a simple getter: purpose, versioning policy, and parameter semantics. The only notable gap is the lack of explicit enumeration of the five object types, but that may be intentionally left to discovery tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has no descriptions, so the description must compensate. It does clarify that object_type is 'one of the five schema-bearing object types' and that version defaults to '0.1', which adds meaning. However, it fails to list the five valid object types or provide enums, leaving the agent to discover them via other tools.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Get the frozen SHA-256 digest of an authoritative JSON Schema' with a specific verb and resource. The terms 'frozen' and 'authoritative' differentiate it from siblings like owp_get_schema (likely retrieving the schema) and owp_compute_digest (likely computing a digest from arbitrary data).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides context by calling the digest a 'protocol-review anchor' and noting that changing it requires an explicit version-bump decision, implying use during protocol review. However, it does not explicitly name alternative tools or exclusion conditions, so it falls short of full guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
owp_get_settlement_readinessB
Derive readiness only; this does not prove payment or settlement.
| Name | Required | Description | Default |
|---|---|---|---|
| ledger | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description must carry the burden of behavioral disclosure. It does provide a meaningful limitation ('this does not prove payment or settlement') and clarifies the tool derives readiness only. However, it does not disclose other behavioral traits such as read-only status, potential side effects, permissions, or error conditions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no filler. Every word adds value, particularly the critical caveat about not proving payment or settlement.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple with one parameter and an output schema, so the description does not necessarily need to explain return values. However, it lacks context about what 'readiness' means, what the ledger parameter should be, and how this maps to the broader settlement workflow, making it minimally adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not explain the sole 'ledger' parameter at all. Since the description must compensate for the missing schema documentation and does not, parameter semantics are weak.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear action ('derive readiness') and a specific resource ('settlement readiness'), and it distinguishes this tool from verification/proof tools by explicitly saying it 'does not prove payment or settlement.' However, it does not define what 'readiness' means, leaving some ambiguity about the exact output.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies that this tool should be used when readiness alone is needed and not for proving payment or settlement. It does not explicitly name alternative tools or provide detailed when-to-use/when-not-to-use guidance, but the caveat gives some contextual direction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
owp_integrity_observation_validateA
Assess one v0.5 population observation set against its contracts.
This read-only tool never signs, commits, accepts, or settles anything.
Signer authority is reported as not_checked, never as authorized.
| Name | Required | Description | Default |
|---|---|---|---|
| payload_json | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations present, the description carries the burden and does well by explicitly stating 'This read-only tool never signs, commits, accepts, or settles anything' and that 'Signer authority is reported as not_checked, never as authorized.' These are meaningful behavioral constraints beyond the basic assess action.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is highly compact: one purpose sentence followed by two short behavioral clauses. Every sentence contributes new information, and there is no fluff or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity—one parameter, an output schema, and no annotations—the description provides solid coverage by clarifying the read-only nature and signer authority behavior. The main gap is the lack of parameter format details, but the output schema compensates for return-value expectations, making the description reasonably complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter `payload_json` has no schema description and 0% description coverage. The tool description never names the parameter or explains its required JSON structure, only indirectly implying that the payload is the population observation set. This leaves the agent without enough information to correctly construct the input.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb 'Assess' and a precise object: 'one v0.5 population observation set against its contracts.' This differentiates it from sibling tools like owp_control_observation_validate, which presumably handles control observations, and clearly states both the resource and the action.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance is given for when to use this tool versus alternatives. The read-only note is behavioral, not a usage instruction, and no sibling tool is mentioned as an alternative or exclusion case. The description only restates the tool's core purpose.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
owp_list_domainsA
List canonical OpenWorkProof domains; this tool takes no input parameters.
Returns:
A dict with canonical_domains (all 9) and signed_domains
(8 — excludes sidecar-event which cannot be signed).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the behavioral disclosure burden and does well: it explains the return dict, counts (all 9 canonical domains, 8 signed domains), and the key exception that sidecar-event cannot be signed. It does not explicitly state read-only behavior or permission requirements, but 'List' strongly implies a safe read operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded and efficient. The core purpose appears in the first clause, followed by useful return details, with no wasted sentences.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter list tool with an output schema, the description is sufficiently complete. It adds a helpful summary of return values and an important excluded domain, though it does not route the agent against sibling tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the baseline is 4. The description appropriately confirms that it takes no input parameters, consistent with the empty input schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb and resource: 'List canonical OpenWorkProof domains'. It is unambiguous about what the tool returns, but it does not explicitly distinguish this tool from related sibling tools such as owp_get_schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description states the tool takes no input parameters, which is useful invocation context, but it gives no explicit guidance on when to use this tool versus alternatives. There are many sibling tools, and no routing or exclusion guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
owp_render_surface_reportC
Return the verified derived report, never payment or acceptance.
| Name | Required | Description | Default |
|---|---|---|---|
| package_path | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It communicates that the result is a verified derived report and not payment/acceptance, which is useful, but it does not disclose side effects, failure semantics, authentication needs, or what 'verified' guarantees. The single sentence is too thin for a tool with no annotation support.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no filler or repetition. Every word contributes either to the core action or to a critical exclusion, making it maximally efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite low complexity (one parameter, no nested objects) and an existing output schema, the description does not explain the meaning of package_path, the nature of the derived report, or the conditions under which this tool should be selected over its many siblings. The output schema only documents return shape, not operational context, so this remains incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description does not mention package_path at all. The only parameter's meaning, format, or allowed values are completely undocumented in both the schema and the description, leaving the agent to guess what the path refers to.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb and resource ('Return the verified derived report'), so an agent has a basic idea of what the tool produces. However, 'derived report' is undefined and the caveat 'never payment or acceptance' is an exclusion rather than a positive definition, leaving ambiguity about the exact artifact.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'never payment or acceptance' provides a negative boundary and hints at when not to use this tool, but it does not state when to use it or name an alternative sibling. There is no positive usage context or conditional routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
owp_repo_readB
Forward a repo-read execution to the ledger coordinator.
Args: ledger: Path to the SQLite ledger file. payload: JSON string of the repo-read execution payload.
| Name | Required | Description | Default |
|---|---|---|---|
| ledger | Yes | ||
| payload | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure, but it merely states the forwarding action without noting whether this mutates state, requires auth, or has other consequences. The name implies a read operation, but the description does not confirm safety or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single clear sentence followed by a terse parameter list; every element earns its place with no redundancy. The front-loaded action and structured args make it easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the parameters, but for a tool with no annotations, it lacks usage context and behavioral details such as when to invoke this forwarder and what the ledger coordinator does with the payload. The existing output schema reduces the need for return documentation, but other gaps remain.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema provides only names and string types (0% description coverage), so the description compensates by explaining 'ledger' as a path to a SQLite ledger file and 'payload' as a JSON string of the execution payload. This adds meaningful semantics beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening sentence clearly states the action ('Forward a repo-read execution') and target ('to the ledger coordinator'), distinguishing it as a forwarding operation among related repo tools. It is specific and unambiguous, though it does not explicitly contrast with siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like owp_analyze_repo or owp_get_schema; it only describes the action, leaving the agent to infer context. There are no exclusions or conditions stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
owp_run_testsB
Run tests, write an execution receipt to the ledger, and save test evidence files.
The ledger coordinator checks the signed request before execution. The configured executor writes execution artifacts under the runtime and evidence roots supplied in the payload.
Args:
ledger: SQLite ledger file that receives the execution receipt.
payload: JSON string of the run-tests execution payload (must
include the signed AgentRequest and typed arguments).
| Name | Required | Description | Default |
|---|---|---|---|
| ledger | Yes | ||
| payload | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral disclosure burden and does a good job stating that the ledger coordinator checks the signed request and that execution artifacts are written under runtime and evidence roots. It still omits failure modes, permission requirements, and reversibility.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core action and side effects, then follows with useful process context and an Args section. It is appropriately sized, though the Args section is somewhat formal and could be tightened.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the main action, side effects, and parameter roles. However, for a tool that runs tests and writes execution artifacts, it remains vague about what tests are run, where test configuration comes from, and what happens on failure, leaving meaningful gaps even with an output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It explains the ledger as a SQLite file receiving the execution receipt and the payload as a JSON string containing a signed AgentRequest and typed arguments, but it does not specify the payload structure in detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a clear verb and resource: it runs tests, writes a receipt, and saves evidence files. It distinguishes itself by explaining the receipt and evidence side effects, but it does not explicitly contrast itself with siblings such as owp_run_verification.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It mentions that the payload must include a signed AgentRequest, which is a prerequisite, but it gives no guidance on when to use this tool versus alternatives such as owp_run_verification. There are no exclusions or contextual selection cues.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
owp_run_verificationA
Write verification results or signed decisions to the ledger, or prepare a draft.
operation must be commit_arm, prepare_decision, or
commit_decision. commit_arm appends a validated verification
result to the SQLite ledger. commit_decision appends the supplied
signed verification decision. prepare_decision returns an unsigned
draft without committing that decision. The tool never retries an
indeterminate commit.
| Name | Required | Description | Default |
|---|---|---|---|
| ledger | Yes | ||
| payload | Yes | ||
| operation | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does a reasonable job: it discloses that commits append to a SQLite ledger, that prepare_decision returns an unsigned draft without committing, and that the tool never retries an indeterminate commit. Those are meaningful behavioral traits beyond the name. It still doesn't cover authorization requirements, idempotency of repeated commits, or what happens on a failed validation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The purpose statement is front-loaded and the per-operation breakdown is efficient, with every sentence contributing. Slightly awkward line wrapping and a missing transition between the purpose sentence and the operation rules cost it the top score, but there is no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values needn't be explained, and the description covers the draft-versus-commit distinction plus retry behavior. For a mutation tool with zero annotations, though, missing payload/ledger format and failure/error semantics leave it adequate rather than complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It usefully documents the operation parameter's three valid values even though the schema declares no enum, which is real added meaning. But the ledger and payload parameters get no explanation of expected format or content, leaving two of three parameters fully undocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The first sentence names a concrete verb and resource: writing verification results or signed decisions to the ledger, or preparing a draft. The three operation modes (commit_arm, prepare_decision, commit_decision) are then spelled out, so an agent can tell what the tool does. It falls short of 5 because it doesn't distinguish itself from related siblings like owp_sign_payload or owp_verify_signature.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description states which operation values are allowed and what each does, which implicitly guides selection among the three modes. However, it gives no explicit guidance on when to choose this tool over siblings such as owp_sign_payload or owp_get_decision, and no prerequisites or exclusion conditions are stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
owp_scope_compareB
Compare a signed v0.3 scope with one verifier observation.
| Name | Required | Description | Default |
|---|---|---|---|
| scope_json | Yes | ||
| observed_scope_json | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It implies a read-only comparison but does not explain what 'compare' means operationally, whether there are side effects, what kinds of mismatches are reported, or whether expected observations need a specific format.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence with no filler, repetition, or unnecessary details. It is front-loaded with the action and clearly states the two inputs, earning every word.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple with two string parameters and an output schema present, so the description is minimally complete for basic invocation. However, without annotations or usage guidance, the description does not fully equip an agent to understand comparison semantics or when this is the correct tool among the many sibling validation tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for the unannotated parameters. It does help by suggesting scope_json maps to the signed scope and observed_scope_json maps to the verifier observation, but it adds no detail about JSON structure, encoding, or how the v0.3 version applies to the parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Compare') and identifies the resources ('a signed v0.3 scope' and 'one verifier observation'), which clearly differentiates it from most siblings like owp_scope_validate or owp_integrity_observation_validate. The version qualifier 'v0.3' adds useful precision, though 'verifier observation' is somewhat domain-specific and could be clearer.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance about when to use this tool versus alternatives such as owp_scope_validate or other observation-validation tools. The description states what the tool does but provides no context on prerequisites, selection criteria, or when it should be avoided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
owp_scope_validateA
Intrinsically validate a v0.3 scope without checking authority.
This read-only tool does not accept a ledger, private key, or signature instruction. Full Manager authority is checked only by the non-MCP commit boundary.
| Name | Required | Description | Default |
|---|---|---|---|
| scope_json | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the transparency burden and does well by stating 'This read-only tool does not accept a ledger, private key, or signature instruction.' This discloses side-effect-free behavior and input constraints. It does not detail validation result behavior, but an output schema is present.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two tight sentences, front-loaded with the main purpose and followed by a useful constraint. Every sentence earns its place with no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter validation tool with an output schema, the description covers purpose, read-only behavior, and the authority-checking boundary. It could add a sibling-tool comparison or explicit return semantics, but the output schema reduces that need.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 0% description coverage, and the description only adds that the scope is 'v0.3' and that no ledger/key/signature inputs are involved. It leaves the meaning of scope_json mostly to the property name and type. The description partially compensates but does not fully explain the expected JSON structure or validation rules.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and object: 'Intrinsically validate a v0.3 scope.' It also distinguishes this from authority-checking operations by stating 'without checking authority.' The term 'intrinsically' is somewhat underdefined, but the core purpose is clear and differentiated from sibling tools like owp_scope_compare.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly excludes authority-checking use cases: 'Full Manager authority is checked only by the non-MCP commit boundary.' It does not explicitly name a sibling alternative to use instead, but it gives a clear boundary for when this tool is not appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
owp_sign_payloadA
Sign a canonical OpenWorkProof payload with an Ed25519 private key.
Args:
object_type: One of the allowed signed domains (call
owp_list_domains to see the list).
payload: JSON string of the unsigned payload object.
private_key_hex: The Ed25519 private key as a hex string.
Returns:
The signed payload dict with signature_alg, signer_key_id,
digest, and signature fields added.
| Name | Required | Description | Default |
|---|---|---|---|
| payload | Yes | ||
| object_type | Yes | ||
| private_key_hex | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It explains the output structure (dict with signature_alg, signer_key_id, digest, and signature fields) and directs to owp_list_domains for valid object types. However, it lacks details on error handling, canonicalization behavior, key format validation, or side effects, leaving some behavioral aspects undisclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured, starting with the main action in the first sentence, then using an Args/Returns layout for clarity. Every sentence adds necessary information; no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the essential aspects for a signing tool: inputs, prerequisite domain listing, and return fields. It is reasonably complete given that an output schema exists (though not shown). However, it does not elaborate on the 'canonical' requirement or potential errors, leaving minor gaps in fully guiding usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema provides no descriptions (0% coverage), so the description fully compensates by explaining each parameter: object_type (from allowed list), payload (JSON string), and private_key_hex (Ed25519 key). This is essential context that the schema lacks, adding significant meaning to the parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function with a specific verb ('Sign') and resource ('canonical OpenWorkProof payload with an Ed25519 private key'). It differentiates from siblings like owp_verify_signature or owp_compute_digest by focusing on the signing action, and references owp_list_domains for the object_type domain list, further clarifying its scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context on prerequisites: object_type must come from the allowed domains listed by owp_list_domains, and the private key must be a hex string. It implies when to use (when needing to sign a payload) but does not explicitly state alternatives or when not to use it, though the self-explanatory purpose makes exclusions unnecessary.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
owp_soc_analyze_slipsARead-only
Review supplied Slips JSONL locally and return cases plus a signed evidence bundle.
Accepts up to 128 KiB, 500 lines and 50 source windows. Uses a synthetic-trained model, a deterministic investigation stub and in-memory simulated actions. Does not control real hosts, push to AiSOC or upload telemetry. Returned keys and checkpoints are self-supplied evidence, not an independent trust anchor.
| Name | Required | Description | Default |
|---|---|---|---|
| tenant | No | local-review | |
| alerts_jsonl | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare readOnlyHint=true, destructiveHint=false and openWorldHint=false, and the description goes well beyond them: hard limits (128 KiB, 500 lines, 50 source windows), a synthetic-trained model, a deterministic investigation stub, in-memory simulated actions, and the caveat that returned keys/checkpoints are self-supplied evidence rather than a trust anchor. This is exactly the behavioral context an agent needs before invoking.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The first sentence front-loads the action and output, and the following sentences efficiently enumerate limits and scope exclusions. Dense but every clause carries information; only minor tightening is possible.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return-value detail is unnecessary, yet the description still characterizes the return as cases plus a signed evidence bundle. Combined with limits and honest caveats about trust, the definition is nearly complete; the undocumented 'tenant' parameter is the remaining gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for both parameters, so the description carries the burden. Its size/line/window limits do convey meaningful constraints on alerts_jsonl, but the 'tenant' parameter (default 'local-review') is entirely unaddressed in both schema and description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb and resource: review supplied Slips JSONL locally and return cases plus a signed evidence bundle. It is clearly distinguishable from siblings like owp_soc_sample_alerts and owp_soc_verify_bundle. It stops short of explicitly contrasting itself against those siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It implies the use case (local review of supplied Slips JSONL) and states what it does not do: no real host control, no AiSOC push, no telemetry upload. However, it gives no explicit 'when to use this vs. verify_bundle / sample_alerts' guidance or prerequisite conditions, leaving routing largely to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
owp_soc_sample_alertsARead-only
Return synthetic Slips JSONL and scope for the reference SOC workflow.
No host scanning, external connections or real remediation is performed. This does not activate Guard or protect other MCP tool calls.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false and openWorldHint=false, so the description's added value is the explicit disclaimer of no host scanning, no external connections, no real remediation, and no Guard activation. That is meaningful context an agent would otherwise assume wrongly for a 'SOC alerts' tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with what is returned. The final sentence about Guard protection is slightly awkwardly phrased but still earns its place as a safety clarification.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return structure needn't be described, and the zero-param input needs no elaboration. The description covers origin (synthetic), side-effect profile (none), and safety boundaries; only the relationship to downstream sibling tools is unstated.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is nothing for the description to disambiguate; baseline is 4. No parameter guidance is needed or missing.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Return) and a specific resource (synthetic Slips JSONL plus scope) tied to a named reference SOC workflow. An agent can distinguish it from owp_soc_analyze_slips by the 'synthetic sample' framing, though that contrast is implicit rather than stated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit 'use this when…' statement and no mention of the obvious alternative, owp_soc_analyze_slips, which appears to consume the very JSONL this tool produces. The agent must infer the ordering from the phrase 'reference SOC workflow' alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
owp_soc_verify_bundleARead-only
Verify a reference SOC bundle using separately acquired expected trust pins.
Inputs are JSON strings, each at most 8 MiB. Omitted external keys or checkpoint pins yield UNKNOWN, not trusted acceptance. Copying pins from the same bundle only tests consistency; caller-supplied pins do not prove organizational independence. A FAILED/UNKNOWN status is not acceptance. No filesystem writes.
| Name | Required | Description | Default |
|---|---|---|---|
| bundle_json | Yes | ||
| trusted_keys_json | No | ||
| trusted_checkpoints_json | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false, openWorldHint=false, so the safety profile is covered. The description adds value beyond that: an 8 MiB per-input cap, the UNKNOWN-on-missing-pin behavior, the warning that FAILED/UNKNOWN is not acceptance, and the explicit 'No filesystem writes' guarantee.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core action, then a compact block of constraints. Every sentence carries information (size limit, UNKNOWN semantics, independence caveat, no writes); only the 'caller-supplied pins do not prove organizational independence' line is slightly redundant with the preceding sentence.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and the description covers the remaining essentials: input format and size, the trust model, the meaning of UNKNOWN/FAILED, and the absence of side effects. An agent has enough to call this correctly and interpret the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must carry the load. It does establish that all inputs are JSON strings capped at 8 MiB and that trusted_keys_json/trusted_checkpoints_json are the 'separately acquired' pins, but it never describes the expected structure of bundle_json or the pin formats, leaving the largest gap unaddressed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: 'Verify a reference SOC bundle using separately acquired expected trust pins.' The qualifier 'reference SOC bundle' plus 'trust pins' distinguishes it from the sibling owp_verify_surface_bundle and from signature-level tools like owp_verify_signature, though it never names an alternative explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives real usage context: omitted external keys or checkpoint pins yield UNKNOWN, and copying pins from the same bundle only tests consistency rather than independence. That tells the agent how to supply inputs meaningfully, but there is no explicit statement of when to prefer this over sibling verification tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
owp_statusA
Replay an OpenWorkProof ledger and return its authoritative state.
Args: ledger: Path to the SQLite ledger file.
| Name | Required | Description | Default |
|---|---|---|---|
| ledger | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full responsibility for disclosing side effects and safety. It mentions replay and returning state but does not explicitly state that the operation is read-only, whether it modifies the ledger, or any other behavioral traits. This ambiguity is a significant gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: one sentence for purpose and a minimal args list. It is front-loaded and contains no redundant information, every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has a single parameter and an output schema, so return values are covered elsewhere. However, the description lacks behavioral transparency (e.g., read-only guarantee, error conditions) and does not address the broader context of how this tool fits with siblings, making it incomplete for safe autonomous use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema only provides the type 'string' for the 'ledger' parameter, but the description adds meaning by explaining it is a 'Path to the SQLite ledger file.' This goes beyond the schema and clarifies the parameter's role.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Replay an OpenWorkProof ledger and return its authoritative state.' This is a specific verb (replay) and resource (ledger) with a clear outcome, and it distinguishes from sibling tools by focusing on state retrieval rather than key generation, signing, or verification.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for checking ledger state, but it does not explicitly state when to use it over siblings or provide any exclusions. The intended usage is clear from context, but no direct guidance is given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
owp_validate_action_binding_manifestB
Validate one signed ActionBindingManifest (read-only, no authority).
| Name | Required | Description | Default |
|---|---|---|---|
| payload_json | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description's '(read-only, no authority)' is a valuable behavioral disclosure that signals a safe, non-mutating operation. However, the description does not explain expected behavior on invalid/signed inputs, system effects, or assumptions about the manifest.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one front-loaded, efficient sentence with no filler: the core purpose and the read-only/no-authority property are both conveyed without redundancy. It is concise and scannable, though slightly more guidance could be useful.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the basic purpose and key safety property, but it does not help the agent choose among the many sibling validation/verification tools. An output schema exists, so return-value documentation is less necessary, but the lack of usage context and parameter detail keeps it from being fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, and the description does not explicitly document payload_json semantics. However, the phrase 'one signed ActionBindingManifest' reasonably suggests that payload_json is the JSON-serialized manifest to validate, which provides some meaningful parameter context beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: 'Validate one signed ActionBindingManifest'. This clearly identifies the tool's exact object and distinguishes it from sibling validation/verification tools such as owp_validate_judgment_commitment or owp_verify_signature.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not state when to use this tool versus alternatives, nor does it provide exclusion or fallback guidance. Given the large set of sibling validation and verification tools, the absence of explicit selection guidance is a notable gap.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
owp_validate_judgment_commitmentA
Validate one signed JudgmentCommitment (read-only, no authority).
Without a ledger or trusted key context the authority is reported as
not_checked; this tool never signs and never commits.
| Name | Required | Description | Default |
|---|---|---|---|
| payload_json | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It explicitly discloses that the tool is read-only, never signs, never commits, and reports authority as 'not_checked' without ledger/key context. This is clear behavioral disclosure, though the return format is not described.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences, front-loaded with the primary action and safety properties, with no redundant words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with one parameter, no annotations, and an output schema, the description adequately covers safety and authority behavior. However, it lacks details about the exact validation logic or expected payload structure, limited by parameter semantics.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has a single required parameter payload_json with 0% coverage, and the description does not explain the parameter's format or content. The name and tool purpose imply it is the JudgmentCommitment, but no explicit details are provided.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool's function: validate a signed JudgmentCommitment. It emphasizes read-only, no authority, never signs, and never commits, which distinguishes it from signing and committing tools like owp_sign_payload.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for validating JudgmentCommitment objects but does not explicitly state when to choose this tool over sibling validation tools like owp_validate_profile or owp_validate_action_binding_manifest. It provides context about authority reporting but no exclusions or alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
owp_validate_profileC
Validate a signed Evidence Lifecycle v0.2, v0.3, or v0.5 profile.
| Name | Required | Description | Default |
|---|---|---|---|
| profile_json | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden for disclosing behavior, but it only says 'validate'. It does not mention whether the operation is read-only, if any side effects exist, or what permissions are required. This leaves the agent uncertain about the tool's effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence with no redundant information, effectively conveying the core purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of the tool, the description is too sparse. It does not explain what constitutes a valid profile, how validation is performed, what the output might be, or any error conditions. This lack of context makes it insufficient for an agent to use the tool confidently.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter, profile_json, has no description in the schema, and the tool description adds no detail about its format, expected content, or constraints. Since schema coverage is 0%, the description provides no compensation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (validate) and the object (a signed Evidence Lifecycle profile), which distinguishes it from sibling tools that perform other operations like running tests or building packages. However, it does not specify what validation entails (e.g., signature check, schema compliance).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance is given on when to use this tool versus its siblings. The description does not provide context such as 'Use this to verify a profile before submission' or any alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
owp_verify_nested_claimA
Verify a nested claim (AgentRequest or HumanDecision) against a WorkOrder.
This checks that:
The WorkOrder identity bindings are valid.
The claim's
work_order_digestmatches the WorkOrder.The claim's actor is bound to a matching key in the WorkOrder.
The claim's Ed25519 signature is valid.
Args: claim_json: JSON string of the AgentRequest or HumanDecision. work_order_json: JSON string of the parent WorkOrder.
Returns:
{"valid": true} if the nested claim passes all checks.
| Name | Required | Description | Default |
|---|---|---|---|
| claim_json | Yes | ||
| work_order_json | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It transparently enumerates the validation checks (identity bindings, digest match, actor binding, Ed25519 signature) and specifies the success return value. However, it does not disclose failure behavior (e.g., returns {"valid": false} or raises an exception), which is a minor gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a concise intro, bulleted checks, an Args section, and a Returns line. Every sentence adds value, and the formatting aids quick comprehension. No redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description provides the essential information needed to invoke the tool correctly: purpose, argument roles, validation criteria, and success return format. It does not fully describe failure return semantics, but given the moderate complexity and the presence of an output schema, the description is largely complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description compensates by explaining each parameter: claim_json is a JSON string of the AgentRequest or HumanDecision, and work_order_json is a JSON string of the parent WorkOrder. This adds meaningful context beyond the raw schema types, though it could be more detailed about required fields within those JSON objects.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Verify') and identifies the resource ('a nested claim (AgentRequest or HumanDecision) against a WorkOrder'). It clearly distinguishes this from sibling tools like owp_verify_work_order and owp_verify_signature by naming the nested claim types.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly implies when to use this tool: when you need to verify a nested claim against a WorkOrder. It lists the checks performed, giving context, but does not explicitly compare with alternatives or state when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
owp_verify_signatureA
Verify an Ed25519 signature on a signed OpenWorkProof payload.
Args:
object_type: The canonical domain of the object.
signed_payload: JSON string of the signed payload (must
contain signature_alg, signer_key_id, digest,
and signature).
public_key_b64url: The signer's public key as base64url.
Returns:
{"valid": true} if the signature is valid, {"valid": false}
otherwise.
| Name | Required | Description | Default |
|---|---|---|---|
| object_type | Yes | ||
| signed_payload | Yes | ||
| public_key_b64url | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description provides behavioral specificity by detailing required fields in signed_payload ('must contain signature_alg, signer_key_id, digest, and signature') and describing the exact return values. However, it does not disclose error behavior for invalid input (e.g., malformed JSON, missing fields, bad base64url), which is a minor gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with an opening sentence, a compact Args section, and a Returns section. Every sentence is informative and there is no redundant text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers parameters, return values, and signed_payload requirements, making it usable for invocation. However, it lacks error-handling details and does not clarify how object_type is used in the verification process. Given the tool's simplicity, these are minor omissions and the description is mostly complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema provides no field descriptions, but the description explains each parameter: object_type as 'the canonical domain of the object', signed_payload as 'JSON string of the signed payload' with required fields, and public_key_b64url as 'the signer's public key as base64url'. This fully compensates for the 0% schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The first sentence 'Verify an Ed25519 signature on a signed OpenWorkProof payload' clearly states the action (verify) and the resource (Ed25519 signature on OpenWorkProof payload). This distinguishes it from sibling verification tools like owp_verify_work_order and owp_verify_nested_claim, which focus on different verification aspects.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is used for verifying Ed25519 signatures, but it does not explicitly state when to choose this tool over alternatives such as owp_verify_work_order or owp_verify_nested_claim. There are no usage exclusions or comparisons, leaving the agent to infer from the tool name and description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
owp_verify_surface_bundleB
Verify and replay one surface bundle without writing or signing.
| Name | Required | Description | Default |
|---|---|---|---|
| package_path | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It does disclose a key behavioral trait: no writing or signing. However, it does not explain what 'replay' entails, whether reads or network access occur, or what failure states look like, leaving the behavioral profile incomplete.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One compact sentence, front-loaded with the core action 'Verify and replay' and then the key qualifier 'without writing or signing'. There is no filler or repeated information from the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple and has an output schema, so return values need not be described, but the description still omits usage context and package_path semantics. With no annotations and no parameter documentation, an agent has to infer too much to reliably select and invoke this tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The sole parameter, package_path, has no schema description (0% coverage), and the description never mentions it explicitly. The phrase 'one surface bundle' loosely implies that package_path points to a bundle, but the description does not clarify the expected path type or format.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb+object pair, 'Verify and replay one surface bundle', and adds the important qualifier 'without writing or signing'. This clearly identifies what the tool does and distinguishes its non-mutating nature from many verification-related sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The 'without writing or signing' clause implies a safe verification context, but the description never states when to choose this tool over owp_run_verification, owp_verify_work_order, owp_verify_nested_claim, or other siblings. No exclusions or alternative conditions are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
owp_verify_work_orderA
Verify a WorkOrder's identity bindings and maintainer signature.
Args: work_order_json: JSON string of the WorkOrder object.
Returns:
{"valid": true} if all six key bindings are well-formed,
distinct, and the maintainer's signature is valid.
| Name | Required | Description | Default |
|---|---|---|---|
| work_order_json | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does substantial work: it explains the success return ('{"valid": true}') and the exact validation criteria (six key bindings well-formed, distinct, valid maintainer signature). It does not disclose invalid-input behavior or potential exceptions, which is a minor gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a compact docstring with a clear one-line summary followed by standard Args/Returns sections. Every sentence provides necessary information, and there is no redundant or filler content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter verification tool with an output schema, the description supplies the key context: the input format and the success criteria. It is slightly incomplete only in not covering invalid-result/error behavior, but the output schema likely covers the return shape.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% and the only parameter is documented as 'JSON string of the WorkOrder object,' which adds semantic meaning beyond the bare 'string' type. However, it does not describe the WorkOrder object's required fields or expected internal structure, leaving some ambiguity.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Verify a WorkOrder's identity bindings and maintainer signature.' This precisely identifies the tool's function and distinguishes it from sibling tools like owp_verify_signature, which verify raw signatures rather than full WorkOrder identity bindings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context that this is for WorkOrder-level verification, and the mention of 'WorkOrder' naturally scopes it against generic signature verification siblings. It does not explicitly list exclusions or alternative tools, but for a targeted verification routine the intended use case is reasonably clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
3 tool updates
v1.6.0- Added
owp_soc_analyze_slips - Added
owp_soc_sample_alerts - Added
owp_soc_verify_bundle
2 tool updates
v1.4.0- Added
owp_render_surface_report - Added
owp_verify_surface_bundle
13 tool updates
v1.2.0- Added
owp_build_delivery_package - Added
owp_control_observation_validate - Added
owp_explain_binding_decision - Added
owp_get_binding_status - Added
owp_get_decision - Added
owp_get_settlement_readiness - Added
owp_integrity_observation_validate - Added
owp_run_verification - Added
owp_scope_compare - Added
owp_scope_validate - Added
owp_validate_action_binding_manifest - Added
owp_validate_judgment_commitment - Added
owp_validate_profile
14 tool updates
v1.1.1- First observed
owp_analyze_repo - First observed
owp_compute_digest - First observed
owp_compute_key_id - First observed
owp_generate_keypair - First observed
owp_get_schema - First observed
owp_get_schema_digest - First observed
owp_list_domains - First observed
owp_repo_read - First observed
owp_run_tests - First observed
owp_sign_payload - First observed
owp_status - First observed
owp_verify_nested_claim - First observed
owp_verify_signature - First observed
owp_verify_work_order
TDQS
Scored across 32 tools
Most tools are distinguishable by object type plus action (sign vs. verify vs. validate a given artifact), but several boundaries blur: `owp_get_decision` overlaps with `owp_run_verification`'s prepare_decision mode, and `owp_validate_profile` sits awkwardly beside the scope/observation validators. The verification family (`verify_signature`, `verify_work_order`, `verify_nested_claim`, `verify_surface_bundle`, `soc_verify_bundle`) is large and requires careful description reading to pick correctly.
Nearly all names use an `owp_` prefix with consistent snake_case verb_noun structure (validate_profile, verify_signature, compute_digest, get_schema). Minor deviations exist: `owp_status` and `owp_repo_read` are noun-first, and the SOC tools insert a namespace segment (`owp_soc_*`), but the pattern remains readable and predictable.
At 32 tools this is well past the range where an agent can hold the surface in mind, and the breadth comes partly from many narrow, near-duplicate read-only validators (profile, scope, integrity observation, control observation, judgment commitment, action binding manifest). The protocol is genuinely broad, but the set could be consolidated considerably.
The surface covers signing primitives, key management, canonical digests, schema retrieval, ledger replay/status, decision drafting and commit, delivery packaging, settlement readiness, plus a full SOC and repo-analysis workflow. Gaps remain on the authoring side: WorkOrders, capability grants, and acceptance receipts can be verified or schema-fetched but have no dedicated creation/commit tool, forcing reliance on generic `sign_payload`.
Maintenance
Related MCP Connectors
Tamper-evident proof creation and verification for AI agents via MCP, A2A, and REST.
Public MCP for agent verification, work discovery and governed interoperability.
Agent-native MCP for governed commerce, x402 payments, paid capabilities, and verifiable receipts.
Governed MCP: agent audit, provenance, deterministic checks, and receipt-backed FragGate execution.
Related MCP Servers
- AlicenseCqualityBmaintenanceCryptographic identity and trust protocol for AI agents. 38 MCP tools across 8 protocol layers: Ed25519 identity, delegation chains, values compliance, signed communication, policy engine, task coordination, cross-layer integration, and agentic commerce. 264 tests passing.154368 npm4Apache 2.0
- AlicenseAqualityBmaintenanceCryptographic accountability for AI agents. Ed25519-signed receipts for every MCP tool call. Constraints, chains, AI judgment, invoicing, and local dashboard included.245 npm1MIT
- AlicenseNot gradedqualityCmaintenanceTamper-evident audit logging for AI agents. Append-only, hash-chained, optionally Ed25519-signed log. The MCP server lets an agent keep and verify a record of what it actually did.8MIT
- AlicenseNot gradedqualityCmaintenanceA sovereign, MIT-licensed MCP server for professional-service workflows, providing offline-capable, Ed25519-signed tools for autonomous agents and human developers.MIT