Tollgate
A governance-gated MCP server that exposes travel, ops, and finance tools to agents while enforcing policy, approvals, budgets, and audit.
Search flights by origin, destination, and date.
Read calendar events for a given date and query city weather.
Check payee risk scores, with interpretation controlled by the governance layer.
Page on-call engineers using gateway-injected credentials.
Send emails.
Initiate outbound money transfers.
Query ERP invoices and parse unstructured invoice text with per-field confidence scores.
Route every tool call through Tollgate’s enforcement chain: policy denial, human approval, budget escrow/clawback, rate limiting, accountability, injection defenses, and hash-chained audit.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Tollgatetransfer $4,200 to Acme with policy checks, approval, and audit trail"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Tollgate — the governance gate for AI agents that move money
Deterministic policy enforcement, human approvals with cryptographic non-repudiation, budget escrow with clawback, and a tamper-evident audit chain — a zero-dependency governance gateway for any agent that touches money. Exposed to any agent as an MCP server.
Axiom: the LLM is an untrusted component. It proposes; deterministic code disposes. Every tool call an agent makes passes through the gate — and the gate never guesses.
Why
Teams won't give agents spending authority because three questions have no answer: what exactly can it do? who is accountable? can we audit it afterwards? Tollgate answers all three with a single enforcement point that every tool call must cross:
unknown tool → rate limit → circuit breaker → integrity check → read cache
→ accountability → blacklist → budget reserve → field-semantics contract
→ injection fence → financial guardrails → adaptive risk score
→ policy rules (with business-calendar context) → authenticated approval
→ execution → hash-chained auditDenial reasons flow back to the model so it can adapt. Anything that isn't explicitly allowed is denied — and that default is measured, not assumed (see Red team).
Related MCP server: agent-security-gateway
60-second demo
git clone https://github.com/kkU1444/agent-governance-gateway.git && cd agent-governance-gateway
python -m tollgate demo-web # no API key needed
# open http://127.0.0.1:8765 — approve the $4,200 transfer in the browserA travel agent runs a 15-step adversarial scenario: read-only calls pass, external email is blocked, a replayed payment is caught, a negative amount is rejected, an unregistered agent is refused, an unknown payee forces human sign-off, and an over-limit transfer hits a hard cap. Then the ops team freezes and claws back a fraudulent transfer, and the payee lands on a blocklist.
The money lifecycle
Approving a transfer is not the same as money leaving the building:
reserve (atomic, concurrency-safe) → human approval → execution
→ holding period (24h, funds in escrow, reversible)
→ settle | freeze → recover (clawback) → payee blacklist (permanent escalation)Budget pools use BEGIN IMMEDIATE critical sections so concurrent agents see
"occupied", not a stale balance. Clawbacks are two-step (freeze, then
recover), each with operator identity and reason written into the audit
chain.
Security architecture
Threat | Mechanism |
Prompt injection | deterministic fence + pattern guard + canary tokens planted in context (a canary in tool args is proof of hijack → hard deny) |
Semantic misreading ( | field-semantics contract — meaning and thresholds of risk fields are owned by code; upstream risk signals auto-flag payees |
Model hallucination / loops | forced replanning protocol, loop breaker, goal-anchored compaction |
Concurrency / stale state | atomic budget reservation (BEGIN IMMEDIATE) |
Rogue or unattributed agents | accountability registry — no registered owner, no execution; per-agent caps; approver authority levels |
Forged approvals | HMAC or Ed25519 signatures (pure-Python RFC 8032); private keys stay with approvers; |
Tool supply-chain tampering | registration/runtime tool fingerprints vs sealed baseline |
Credential theft | credential broker issues per-call, short-lived scoped credentials; secret scanning masks leaks in args/results |
Audit tampering | SQLite hash chain + |
Resource exhaustion (DoS) | per-agent sliding-window rate limits (money is capped by budget breakers, compute by rate limits) |
Policy files hot-reload on change; every reload lands in the chain as a
policy.reload entry (old hash → new hash), so changes to the law itself
are auditable.
Learning loop: attacks are auto-recorded into an intel base, replayed on
every change (tollgate drill), and live samples merge into the red-team corpus
(tollgate redteam) — real attacks become permanent regression tests.
Red team
$ python -m tollgate redteam
恶意样本拦截: 32/32 (召回率 100%) injection corpus: 32/32 blocked
良性样本误报: 0/8 (误报率 0%) false positives: 0/8
策略不变量模糊测试: 300 例,四条不变量全部成立 300 fuzz cases, all invariants holdFour fuzz invariants: the governance layer never crashes; execution is fail-closed (actual executions ≡ audited executions); the hash chain survives any input sequence; same seed reproduces exactly. THREAT_MODEL.md maps mechanisms to STRIDE, OWASP Agentic AI threats and MITRE ATLAS, and keeps an honest residual-risk list.
MCP server
python -m tollgate mcp # stdio JSON-RPC 2.0, zero dependenciesPoint any MCP client (Claude Desktop, Cursor, your own agent) at it — every
tool call crosses the full enforcement chain. Policy denials come back as
isError tool results with reasons, so the calling model can adapt.
MCP upstream proxy — govern any MCP server
Tollgate is also an MCP client: point it at any third-party MCP server
and it spawns the upstream, pulls tools/list, and registers every tool
under a namespaced prefix (upstream__tool) — each call then crosses the
full enforcement chain, and upstream tools follow the same policy rules as
local ones:
mcp_upstreams:
- name: github
command: ["npx", "-y", "@modelcontextprotocol/server-github"]
allow_tools: ["get_*", "list_*"]
risk: read(A bundled demo upstream ships as python -m tollgate.mcp_demo_upstream;
see the mcp_upstreams section in policies/demo.yaml. A runnable real-world
example — a zero-dependency filesystem MCP server at examples/fs_server.py,
wired read-only allow / write deny — is configured there too: fs_write_file
is rejected fail-closed and never touches the disk.)
To use Tollgate as the governance hub for Claude Desktop (or any MCP client), see docs/claude-desktop.md — one config entry gives every tool call (yours and every upstream's) the full enforcement chain, with the audit hash chain as the receipt.
Install
Python ≥ 3.10, zero mandatory dependencies (a bundled YAML-subset parser is used unless PyYAML is installed):
pip install tollgate-gateway # PyPI (import / CLI name stays `tollgate`)
pip install -e . # or from this repository
tollgate demo # or: python -m tollgate demoCLI surface
Command | Purpose |
| scripted adversarial scenario (terminal / web approvals) |
| approvals console + audit replay UI |
| settlement ledger operations (authenticated) |
| hash-chain check / approval signature check |
| attribution timeline / cross-ledger reconciliation |
| decision rationale / compliance report |
| budget pools / token & latency metering |
| drift regression / adversarial suite / attack replay |
| live agent against any OpenAI-compatible endpoint |
| risk-grade a new tool, draft policy YAML |
| tool fingerprint baseline / Ed25519 keypairs |
Docs
威胁模型 / Threat model — trust boundaries, STRIDE mapping, residual risks
Roadmap
Ed25519 for terminal approvals & settlement ops (web approvals done)
Pluggable storage (Postgres) for multi-instance deployments
Delegation chains (agent acting on behalf of a department)
Policy-change approval workflow (policy as a first-class audited asset)
Contributing & security
See CONTRIBUTING.md. Security issues: follow SECURITY.md — please do not open public issues for vulnerabilities.
License
Available Tools
13 toolsdemo__demo_echoA
[MCP:demo] 原样回显参数(演示只读工具)
| Name | Required | Description | Default |
|---|---|---|---|
| payload | Yes | 任意文本 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the behavioral burden. It does disclose the key trait — output is the input returned unchanged ('原样回显'), and it is read-only with no side effects — but says nothing about error behavior for the required payload or any limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One short clause with the essential verb and qualifier front-loaded; nothing is padded. The '[MCP:demo]' prefix is a namespace marker rather than semantic content, a minor bit of noise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-string-parameter demo tool with no output schema and no annotations, the description covers enough: what it does, that it is read-only, and that the return is the input echoed back. Only edge-case behavior (empty or oversized payload) is left unstated.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% ('payload' documented as '任意文本'), so the schema already explains the single parameter. The description adds no format, size, or content constraints beyond that, which is the expected baseline when the schema does the work.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a concrete verb and object — '原样回显参数' (echo the parameters verbatim) — plus the qualifier '演示只读工具' (demo read-only tool). It is clearer than the bare name demo_echo, but it makes no attempt to differentiate from siblings (none of which overlap, so the omission is tolerable).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The parenthetical '演示' (demo) implies this is a sample/testing tool rather than a production action, which weakly signals when to use it. There is no explicit when-to-use, when-not, or alternative named, so the guidance remains implied only.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
demo__demo_gated_actionC
[MCP:demo] 受治理的写动作(演示:策略/审批如何作用于上游工具)
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | 动作名 | |
| amount | No | 金额 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden, and it does add one important trait: this write goes through policy/approval governance, so an agent can expect gating rather than an immediate effect. However it does not disclose what is mutated, whether it is reversible, what approval flow triggers, or what the result looks like.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is a single short line with no filler, which is structurally fine, but the brevity comes at the cost of under-specification rather than being dense with useful information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a write tool with no annotations and no output schema, the description should explain the governance behavior, what the demo mutates, and what an agent gets back. It gestures at policy/approval but leaves the mechanics and the target of the write entirely unspecified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters (action, amount) are documented in the schema and the baseline is 3. The description adds nothing beyond the schema — it does not clarify the valid values for 'action' or what 'amount' governs, leaving '动作名' ambiguous.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description identifies the tool as a 'governed write action' and states it is a demo of how policy/approval applies to upstream tools, which conveys the general intent. But it never says what resource is being written to or what the action does, unlike siblings such as transfer_money or send_email which name a concrete operation. An agent knows it is a gated demo write, not what it operates on.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to call this versus demo__demo_echo or the real write tools like transfer_money. The parenthetical implies it is illustrative, but the description never says to use it only for testing policy/approval flows or when to prefer the production equivalent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
erp_query_invoiceC
从 ERP 查询发票并归一化为规范字段(只读,含重试)
| Name | Required | Description | Default |
|---|---|---|---|
| invoice_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It usefully discloses that the operation is read-only and includes retry behavior. However, it does not explain authentication requirements, failure semantics, retry limits, or what 'normalization' does to the returned data.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single compact sentence with no filler and front-loads the core purpose. The parenthetical adds useful behavioral context, though it compresses several ideas (read-only, retry) without elaboration.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no annotations, no output schema, and a required parameter with 0% schema coverage, the description is too sparse. It does not describe the returned canonical fields, error behavior, or how invoice_id is interpreted.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is one required parameter, invoice_id, and schema description coverage is 0%. The description does not explain the expected invoice ID format, source system conventions, or lookup behavior. It leaves the only parameter entirely undocumented beyond its name.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action and resource: querying invoices from ERP and normalizing them into canonical fields. Siblings are unrelated tools, so explicit sibling differentiation is less critical. It could be slightly clearer about whether it returns one invoice or many, since the name is singular but 'query' is broad.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus any alternative, nor any prerequisites or exclusions. The only clue is '从 ERP' (from ERP), which implies data origin but not invocation conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fs__fs_list_directoryC
[MCP:fs] List files and directories.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Directory path relative to root |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It implies a read-only listing but does not disclose recursion behavior, hidden-file handling, permissions, ordering, or error behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with little waste. The '[MCP:fs]' prefix is noise, but the core statement is efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter listing tool with no output schema, the description is minimally adequate. It does not explain the return shape or listing behavior, but the core operation is understandable.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the single path parameter is documented as 'Directory path relative to root'. The description adds no additional parameter semantics, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: list files and directories. It is clearly a listing operation, though it does not explicitly distinguish itself from the sibling fs__fs_read_file.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives such as fs__fs_read_file. Usage is only implied by the word 'List', with no exclusions or context about when listing is appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fs__fs_read_fileC
[MCP:fs] Read the contents of a file.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | File path relative to root |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It implies a read-only operation but says nothing about encoding, binary files, size limits, path resolution relative to root, or what happens on a missing file — all material for a filesystem read.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One short, front-loaded sentence with no filler. It is appropriately sized, though its brevity comes partly at the cost of the missing behavioral detail noted elsewhere.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
A one-parameter read tool is simple enough that the definition is minimally viable, but with no output schema the description should at least indicate what is returned (raw text, error on binary) and confirm read-only safety, which it does not.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter has 100% schema description coverage ("File path relative to root"), so the baseline is 3. The description adds no syntax, relative-path rules, or constraints beyond what the schema already states.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ("Read the contents of a file") with the "[MCP:fs]" namespace marker. An agent can distinguish it from fs__fs_list_directory by inference, but the description never names the sibling or contrasts the two explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this versus fs__fs_list_directory or other fs tools, and no preconditions such as the file needing to exist or being text vs binary. The only cue is the implied "if you need contents, read".
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_calendarC
查看某日日程
| Name | Required | Description | Default |
|---|---|---|---|
| date | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure and does not meet it: it does not say whether the call is read-only, whose calendar is returned, what time zone applies, or whether the result is empty when no events exist. Only the weak implication of "查看" (view) signals it is a read operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The single phrase is front-loaded and contains no filler, which is structurally fine. The brevity here reflects under-specification rather than efficient communication, so it cannot earn a top score.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no annotations and no output schema, the description is the only source of behavioral and return-shape information, and it supplies neither. For a one-parameter read tool the surface area is small, but an agent still lacks the date format and the identity of the calendar being read.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is one parameter with 0% schema description coverage, and the description does not compensate by stating the date format (e.g. YYYY-MM-DD), time zone, or whether relative expressions are accepted. "某日" only echoes the parameter name at a conceptual level.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
"查看某日日程" gives a verb (查看) and a resource (某日日程), so the operation is identifiable as a read of one day's calendar. However, it never says whose calendar or what a "日程" entry contains, and the phrase is so terse that it barely rises above a title.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no exclusion of alternatives, and no stated prerequisites. The sibling list (search_flights, get_weather, send_email, etc.) contains nothing comparable, so the agent gets no help at all in routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_weatherC
查询城市天气
| Name | Required | Description | Default |
|---|---|---|---|
| city | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Because no annotations are provided, the description carries the full burden of behavioral disclosure, and it discloses almost nothing. The word '查询' implies a read-only retrieval, but the description says nothing about the data source, freshness, or whether the tool returns current conditions or a forecast. No behavior is contradicted; it is simply undisclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The definition is one short phrase with no filler and is fully front-loaded. However, the brevity reflects under-specification rather than disciplined conciseness, so it earns a middling score.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple single-parameter tool with no output schema, an agent still needs to know the return shape, such as temperature units, returned fields, and current conditions versus forecast, plus any constraints on the city parameter. None of this information is present, so the definition is insufficient for confident invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
schema_description_coverage is 0% for the single required parameter 'city', and the description adds no format guidance, such as city name versus city ID, or whether the parameter requires a Chinese or English name. The meaning of 'city' can be inferred from the parameter name alone, which raises the score above the floor but does not compensate for the documented gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb+resource: query city weather. That is clear, and because no sibling tool in the provided list overlaps with weather, no sibling differentiation is required. The description is clear but minimal; it does not say whether it returns the current weather or a forecast.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to use this tool, when not to use it, or how it relates to alternatives. With no overlapping sibling tools, this omission is less harmful than it would otherwise be, but the description still leaves every usage decision to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
page_oncallC
呼叫值班工程师(凭证由网关按次注入,Agent 不可见)
| Name | Required | Description | Default |
|---|---|---|---|
| message | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden, yet it only discloses that credentials are injected by the gateway and are invisible to the agent. It does not disclose the salient side effect (interrupting a human), whether the call blocks, whether repeated pages are throttled, or what is returned. For an alerting mutation this is a substantial gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One compact sentence with the key constraint parenthesized immediately after the action, so nothing is buried. It earns its brevity, though the space saved is not reinvested in any operational detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no annotations, no output schema, and zero documented parameters, the description is too thin: the agent cannot tell when to invoke it, what to put in the message, or what happens on invocation. Only the auth-injection detail is complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the single required 'message' parameter is never explained. There is no guidance on what the message should contain (severity, service name, symptom, link), which is exactly what the description should compensate for at this coverage level.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: page (呼叫) the on-call engineer. That is unambiguous and distinct from every sibling tool. It stops short of the top score because it offers no differentiation from notification-like siblings such as send_email, which an agent might reasonably choose instead.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description never says when paging is appropriate: no urgency threshold, no escalation condition, no 'use send_email instead for non-urgent'. The agent must infer entirely from the tool name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
parse_invoice_textB
从非结构化文本抽取发票要素,带逐字段置信度(只读)
| Name | Required | Description | Default |
|---|---|---|---|
| text | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden; it does disclose two behavioral facts beyond the name — the operation is read-only and the response includes per-field confidence. It says nothing about what happens on unparseable or partial input, error behavior, or which fields are extracted, so significant gaps remain.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single compact clause with the action and the value-add (confidence) front-loaded; no filler. It is arguably too terse for what it omits, but nothing present is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter extraction tool with no annotations and no output schema, the description should at least indicate return shape and failure modes. It hints at per-field confidence but not at the field set or what an empty/failed parse looks like.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is one required string parameter with 0% schema description coverage, so the description must compensate. It implies the parameter is raw invoice text ('从非结构化文本'), which is useful, but adds no constraints on language, size, or expected encoding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: extract invoice elements from unstructured text, plus an output characteristic (per-field confidence). It is clearly a parsing tool, not a query tool like erp_query_invoice, though it never names that sibling or states the boundary explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this versus erp_query_invoice, no note on input prerequisites (language, format, length), and no exclusion of cases. The parenthetical '(只读)' is the only contextual hint and it is about safety, not selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
risk_checkC
查询收款方风险评分(risk_score 越高越危险,解释权在治理层)
| Name | Required | Description | Default |
|---|---|---|---|
| payee | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description bears the full disclosure burden. It does add behavioral meaning by explaining that a higher risk_score means greater danger and that interpretation of the score is the responsibility of the governance layer. However, it says nothing about what happens when the payee is unknown, whether the lookup is a live or cached read, or what the returned fields look like.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single compact sentence with the core purpose front-loaded and no wasted text. The parenthetical clarification adds useful context without bloat.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no annotations and no output schema, so the description should explain the return shape and the known failure modes. It only hints at the meaning of risk_score (higher = worse) and omits the score range, the response structure, and the behavior for an unrecognized payee.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for the schema gap, but it adds nothing about the 'payee' parameter. It is unclear whether it expects an account number, a name, or an identifier, which is a meaningful gap for a required parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb and resource ('查询收款方风险评分'), so an agent immediately knows it retrieves a risk score for a payee. It is not confused with any sibling, but it does not explicitly contrast itself with related tools such as transfer_money, which the agent might expect it to precede.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to call it: no mention of using it before transfer_money, no prerequisites, and no exclusions. The agent must infer the intended workflow entirely from the sibling list.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_flightsC
搜索航班
| Name | Required | Description | Default |
|---|---|---|---|
| date | Yes | 出发日期 YYYY-MM-DD | |
| origin | Yes | 出发地三字码,如 PEK | |
| destination | Yes | 目的地三字码,如 SFO |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of disclosure. 'Search' implies a read-only operation, but the description says nothing about the data source, whether results include live pricing/availability, rate limits, or how results are ordered or paged.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Extremely short and front-loaded with no wasted words, but this tips into under-specification. The single phrase does not carry enough information for a 3-required-parameter search tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
All three required parameters are documented in the schema, but there is no output schema and the description says nothing about what a search returns (flight list, prices, availability) or the one-way-only semantics implied by a single date field. For a search tool with no annotations and no output schema, this leaves meaningful gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and each parameter has a clear description (date format YYYY-MM-DD, three-letter airport codes with examples), so the schema does the heavy lifting. The description contributes nothing beyond the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('搜索航班' / search flights), which is unambiguous. Sibling tools are unrelated domains (invoice, calendar, weather, email), so no differentiation is required, but the description adds no scope detail such as one-way vs. round-trip or what is returned.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool or when not to. There is no mention of prerequisites, whether dates must be in the future, or whether it handles multi-city/round-trip searches via the single 'date' parameter.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
send_emailD
发送邮件
| Name | Required | Description | Default |
|---|---|---|---|
| to | Yes | ||
| body | Yes | ||
| subject | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden, yet it discloses nothing about side effects, irreversibility (sent mail cannot be recalled), rate limits, auth/from-address requirements, or delivery failure behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is short but only because it is empty; there is nothing to be front-loaded, and the four characters provide no information an agent could act on.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a side-effecting tool with three required, undocumented parameters, no annotations, and no output schema, the description is completely inadequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All three parameters (to, subject, body) have 0% schema description coverage and the description supplies no meaning: no format for `to` (single vs multiple, comma-separated, display names), no subject/body length or HTML/text expectations.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The text "发送邮件" merely restates the tool name send_email; it names the resource and action but adds no distinguishing scope, recipient/format detail, or reason to prefer it.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no prerequisites, no exclusions, and no reference to alternatives (none of the siblings send mail, but the agent is told nothing about that).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
transfer_moneyC
向外转账付款
| Name | Required | Description | Default |
|---|---|---|---|
| to | Yes | 收款方账号或邮箱 | |
| amount | Yes | ||
| currency | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are supplied, so the description carries the full burden, yet it discloses almost nothing beyond the name. For a funds-movement operation it says nothing about irreversibility, required permissions or authorization, amount limits, idempotency, or failure modes such as insufficient balance — only the outward direction is added.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The text is a single five-character fragment rather than a concise description; it is under-specified rather than tight. There is no structure to front-load because there is essentially one phrase with no supporting detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
A high-stakes mutation tool with zero annotations, no output schema, and partial parameter documentation requires a far richer description to be callable correctly. Nothing about confirmation, effects, or return behavior is present, so the definition is not sufficient for safe invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 33%: only `to` is documented ('收款方账号或邮箱'), while `amount` and `currency` have no descriptions anywhere. The tool description adds nothing about expected formats, currency defaults, or decimal/precision conventions, so the coverage gap is not compensated.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The phrase '向外转账付款' names a verb (transfer/pay) and resource (money) and adds the direction ('outbound'), so the core action is identifiable. However, it is a bare fragment with no scope, no counterparty model, and nothing that separates it from the only related sibling, risk_check, which an agent would plausibly need to call first.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no when-to-use or when-not-to-use guidance and does not mention prerequisites, limits, or any alternative tool. An agent learns nothing about how this differs from risk_check or when a transfer should be preceded by a check.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
4 tool updates
v0.1.3- Added
demo__demo_echo - Added
demo__demo_gated_action - Added
fs__fs_list_directory - Added
fs__fs_read_file
9 tool updates
v0.1.0- First observed
erp_query_invoice - First observed
get_calendar - First observed
get_weather - First observed
page_oncall - First observed
parse_invoice_text - First observed
risk_check - First observed
search_flights - First observed
send_email - First observed
transfer_money
TDQS
Scored across 13 tools
Each tool mostly maps to a distinct resource/action, and the demo/fs namespaces clarify provenance. erp_query_invoice vs parse_invoice_text and risk_check vs transfer_money are related but separable; only the generic demo_gated_action could conceptually overlap with governed writes like send_email or transfer_money.
Most names are snake_case, but prefix conventions are mixed: demo__demo_*, fs__fs_*, erp_query_invoice without a namespace separator, and bare names like get_calendar and send_email. The verb_noun pattern is common but not uniform, with page_oncall and risk_check deviating.
Thirteen tools fit comfortably in a well-scoped range and cover demo governance, filesystem access, ERP invoice lookup, calendar/weather/flights, messaging, payments, and risk checks. No tool appears purely redundant, although the demo tools are scaffolding.
The surface spans many domains but most have only one operation: filesystem has read/list but no write, calendar only get, email only send, and flights only search. This may be acceptable for an illustrative governance gateway, but agents would encounter dead ends for update/delete/read workflows.
Maintenance
Related MCP Connectors
MCP server for your apps' tools and custom tools, plus hosted AI agents and approval-gated workflows
Zero-secret MCP gateway for AI agents: risk-scored, audited calls with human-in-the-loop approval.
MCP server for mandates, delegation, policy-gated execution, credential grants, and audit.
- gatewayOAuthai.sealgate
MCP gateway with runtime security policy, tool-call-level control, and audit of agent actions.
Related MCP Servers
- FlicenseNot gradedqualityBmaintenanceAn MCP server that enables AI agents to safely interact with a double-entry payments ledger, enforcing idempotency, policy-based access control, and human-in-the-loop approval for high-value actions.-
- FlicenseNot gradedqualityDmaintenanceMCP server that provides a security gateway for AI agents, enforcing allow/confirm/deny policies on tool calls and requiring human approval for risky operations, with full audit logging.-
- AlicenseNot gradedqualityAmaintenanceDeterministic, auditable payment policy enforcement for AI agents. It provides pre-action authorization with scopes, budgets, allowlists, and signed mandates via an MCP server.MIT
- AlicenseNot gradedqualityBmaintenanceGoverns AI agents' spending by enforcing budgets, approvals, and kill switches before any payment, providing an MCP interface for tool calls with policy checks.377 npmApache 2.0