Skip to main content
Glama

Reference implementation of the Context Validity Declaration (CVD) from the position paper The Agent Steward: Context Provenance and Temporal Validity as a Missing Governance Dimension in Multi-Agent Enterprise Ecosystems (Kefreen Lacerda, 2026).

The silent failure

An agent serving organizational context — prices, policies, product facts — that has silently gone out of date passes every technical health check. It responds within SLA. It returns success. It raises no exception. It is simply wrong.

A stale spreadsheet at least shows an old timestamp. A stale agent answer carries no observable signal at all:

{
  "sku": "WIDGET-PRO",
  "unit_price_usd": 4800.00
}

Price list changed 9 days ago. The agent doesn't know. Neither do you. Confidently wrong — and invisible.

{
  "status": "refused",
  "reason": "context_expired",
  "disclosure": "…last validated 14 days
   ago… The accountable steward is
   Ana Souza; contact them to revalidate."
}

Visibly stale — and recoverable. Someone accountable is one message away.

The CVD attaches a small, declarative validity contract to any exposed context (an MCP tool/resource, or an Agent Card) so that obsolescence becomes detectable at runtime.

Related MCP server: agent-gate

How it works

flowchart LR
    A["agent calls<br/>guarded tool"] --> B{"age =<br/>now − last_validated"}
    B -->|"age ≤ freshness_slo"| C["✅ FRESH<br/>answer, unchanged"]
    B -->|"age > freshness_slo"| D{"decay_policy<br/>.on_violation"}
    D -->|refuse_with_disclosure| E["🛑 refusal that<br/>names the steward"]
    D -->|warn| F["⚠️ answers,<br/>but flagged"]
    D -->|escalate_to_steward| G["📣 routed to<br/>escalation target"]
    D -->|"unknown policy"| E

One decision point, four outcomes — and the unsafe path (answering on expired context as if nothing happened) does not exist.

The five primitives

A CVD manifest declares exactly five fields. Nothing more:

#

Primitive

Meaning

1

steward

Named identity of the accountable human — a person, not a functional mailbox

2

source_of_record

The system this context derives from

3

freshness_slo

Maximum tolerated staleness, as an ISO 8601 duration (P7D, PT12H, P1DT6H)

4

last_validated

ISO 8601 timestamp of the last affirmative human validation

5

decay_policy

on_violation (required) + optional fallback

As a manifest (examples/pricing_context.json):

{
  "steward": "Ana Souza (Head of Pricing Operations)",
  "source_of_record": "SAP ERP price list PL-2026-Q3",
  "freshness_slo": "P7D",
  "last_validated": "2026-07-15T09:00:00Z",
  "decay_policy": {
    "on_violation": "refuse_with_disclosure",
    "fallback": "escalate_to_steward"
  }
}
NOTE

freshness_slo rejects years and months (P1Y, P1M) — they don't map to a fixed duration. Express the window in days: P30D, P365D. Timestamps accept a trailing Z; naive timestamps are treated as UTC.

Install

pip install -e .            # core — zero dependencies, Python ≥ 3.9
pip install -e ".[mcp]"     # + official MCP Python SDK, for the example server
pip install -e ".[dev]"     # + pytest

The core (cvd.models, cvd.evaluator, cvd.guard) is standard library only. It installs, imports, and tests without mcp — the SDK is needed only for the example server.

Quickstart

Two lines of ceremony: declare the contract, guard the function.

from cvd import ContextValidity, DecayPolicy, cvd_guard

pricing_cv = ContextValidity(
    steward="Ana Souza (Head of Pricing Operations)",
    source_of_record="SAP ERP price list PL-2026-Q3",
    freshness_slo="P7D",
    last_validated="2026-07-15T09:00:00Z",
    decay_policy=DecayPolicy(on_violation="refuse_with_disclosure"),
)

@cvd_guard(pricing_cv)
def get_enterprise_price(sku: str) -> dict:
    return {"sku": sku, "unit_price_usd": 4800.00}

While the context is fresh, the function behaves as if the guard weren't there. Once it expires, the function is not even called — the caller gets the structured refusal instead.

Need the decision itself, or prefer exceptions?

from cvd import evaluate, ContextExpired

decision = evaluate(pricing_cv)          # Decision(freshness, allowed, action, age, slo, …)

@cvd_guard(pricing_cv, raise_on_expired=True)
def get_price(sku: str) -> dict: ...     # raises ContextExpired, carrying the Decision

on_violation

Wrapped call

Result when stale

refuse_with_disclosure / refuse

not invoked

{"status": "refused", "reason": "context_expired", "disclosure": …}

warn

invoked

{"status": "stale_warning", "disclosure": …, "result": <original>}

escalate_to_steward

not invoked

refusal + escalate_to = fallback, or the steward if absent

anything unknown

not invoked

fails safe as refuse_with_disclosure, noting the unknown policy

Guarding an MCP tool

The guard stacks directly under @mcp.tool()functools.wraps keeps the signature intact for the SDK's introspection (src/cvd/mcp_server.py):

from mcp.server.fastmcp import FastMCP
from cvd import cvd_guard

mcp = FastMCP("pricing-context-server")

@mcp.tool()
@cvd_guard(PRICING_CV)
def get_enterprise_price(sku: str) -> dict:
    ...
pip install -e ".[mcp]"
python -m cvd.mcp_server

The bundled manifest is deliberately past its window, so the tool refuses out of the box. Update last_validated to a recent timestamp and it answers normally.

See it fail loud

python demo.py — deterministic, no third-party packages. It evaluates the same manifest at two explicit instants:

=== 2. STALE — past the 7-day window (age: 14 days) ===
freshness      : STALE
allowed        : False
action         : refuse
tool result    : {
  "status": "refused",
  "reason": "context_expired",
  "disclosure": "This context derives from SAP ERP price list PL-2026-Q3 and has
    exceeded its freshness SLO of P7D: it was last validated 14 days ago, on
    2026-07-15T09:00:00Z. The accountable steward is Ana Souza (Head of Pricing
    Operations); contact them to revalidate."
}
CVD demo — fail loud, not fail confident
manifest: examples/pricing_context.json

=== 1. FRESH — within the 7-day window (age: 2 days) ===
now            : 2026-07-17T09:00:00+00:00
last_validated : 2026-07-15T09:00:00Z
freshness_slo  : P7D
freshness      : FRESH
allowed        : True
action         : answer
tool result    : {
  "sku": "WIDGET-PRO",
  "unit_price_usd": 4800.0,
  "currency": "USD"
}

=== 2. STALE — past the 7-day window (age: 14 days) ===
now            : 2026-07-29T09:00:00+00:00
last_validated : 2026-07-15T09:00:00Z
freshness_slo  : P7D
freshness      : STALE
allowed        : False
action         : refuse
tool result    : {
  "status": "refused",
  "reason": "context_expired",
  "disclosure": "This context derives from SAP ERP price list PL-2026-Q3 and has exceeded its freshness SLO of P7D: it was last validated 14 days ago, on 2026-07-15T09:00:00Z. The accountable steward is Ana Souza (Head of Pricing Operations); contact them to revalidate.",
  "escalate_to": null
}

Run the tests with pytest — 34 cases covering the freshness boundary, all four decay policies, both parsers, and the guard's no-call guarantee.

Why refuse instead of answer?

Because a visible refusal is a recoverable operational event; a confident wrong answer is an invisible one.

An agent whose context has exceeded its freshness window must refuse to answer with confidence — returning a disclosure that names the accountable steward — rather than answer incorrectly with confidence. The refusal is not a failure of the system. It is the system working: obsolescence, which used to be silent, now produces a signal, an owner, and a path back to validity.

  • age == slo counts as FRESH. The SLO is a tolerance, not a fuse; the boundary belongs to the caller.

  • Unknown policies fail safe. A typo in decay_policy must never silently become "answer anyway".

  • The steward is a person. Disclosure that names pricing-team@ names no one. Accountability needs a face.

  • Years/months rejected in SLOs. P1M is 28–31 days depending on when you ask — an ambiguous freshness window is a contradiction in terms.

  • The clock is injectable (evaluate(cv, now=…), cvd_guard(cv, now_fn=…)), so every behavior in this README is reproducible in a test.

Citation

Lacerda, K. (2026). The Agent Steward: Context Provenance and Temporal Validity
as a Missing Governance Dimension in Multi-Agent Enterprise Ecosystems.
Zenodo. https://doi.org/10.5281/zenodo.21660205

A
license - permissive license
-
quality - not tested
C
maintenance

Maintenance

Maintainers
Response time
Release cycle
Releases (12mo)
Commit activity

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Servers

View all related MCP servers

Related MCP Connectors

  • A paid remote MCP for agent memory MCP, built to return verdicts, receipts, usage logs, and audit-re

  • MCP server connecting AI agents to non-custodial staking data across 130+ networks.

  • MCP server for AI agents to plan, verify, and deploy Cloudflare-native apps.

View all MCP Connectors

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/kefreen/cvd-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server