protocol.mcp_server
Allows the MCP server to use a local SQLite database as an evidence store for the Epistemic Warrant Protocol, supporting persistence of evidence views and view completeness.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@protocol.mcp_serverRun warrant_now on this evidence view with the reference-v1 policy."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Epistemic Warrant Protocol (EWP)
EWP defines the deterministic boundary between what an AI agent’s memory contains and what the agent is epistemically justified in accepting.
Memory is evidence, not truth.
EWP-0.2.0. Policy reference-v1. EWP is an epistemic protocol, not an action-authorization framework. Other projects use warrant to describe permission to act; EWP uses epistemic warrant to describe what an agent is justified in accepting. may_act() is deliberately a later gate.
Stores adapt to the protocol. The protocol does not inherit the store’s epistemology.
v0.2.0 tightens scope binding, refuses future-dated checks at T, persists SQLite view completeness, and narrows the serialized WarrantView contract. The 26 goldens stay; the evaluator lock moves.
See NAME.md, docs/PROTOCOL_v0.1.md, docs/DESIGN_NOTE.md, docs/implementer/, docs/PLATFORMS.md, docs/implementer/LIVE_ADAPTERS.md, docs/MCP_CONTRACT.md, CONFORMANCE.md. MCP server: python3 -m protocol.mcp_server. The pre-freeze claim/confidence sketch is historical/docs/MCP_CONTRACT.md (superseded).
Boundary. Policy. Observations. Permission. Four things. None gets to wear the others' clothes.
Memory / Evidence Store
│
▼
EvidenceView
│
▼
warrant_now(view, policy, evaluated_at)
│
▼
WarrantView
│
▼
may_act(warrant, action, risk_policy)
│
▼
MAY_ACT | REQUIRE_CONFIRMATION | DENYStores keep evidence. Warrant is computed. Action is a later gate.
Quick start
python3 tests/ci.py
python3 tests/report.pyfrom protocol.types import Policy
from protocol.warrant import warrant_now
from protocol.fixtures import fixture_verified_current, EVAL
view = fixture_verified_current()
result = warrant_now(view, Policy(), EVAL)
print(result.warrant)There is no packaged install yet. The repository itself is currently the reference implementation and conformance suite.
Why this exists
AI agents increasingly keep conversations, observations, documents, tool results, inferred facts, summaries, and prior decisions. Remembering something is not the same as knowing it is true.
A memory store may contain a user’s assertion, an old observation, an LLM-generated summary, a conflicting sensor reading, ten copies of one source, a stale check, and a newer contradictory claim. Most systems are good at storing and retrieving those records.
EWP asks a different question:
Given the evidence available at time T, under epistemic policy P, what may this agent accept — and why?
It does not assume:
Common collapse | EWP split |
stored = true | stored ≠ believed |
retrieved = important | retrieved ≠ complete |
repeated = corroborated | repeated ≠ independently sourced |
summarized = verified | summarized ≠ externally checked |
current = warranted | store-local “current” ≠ warrant |
believed = safe to act on | warranted ≠ authorized to act |
That split matters once agents have long-lived memory and can take consequential actions.
EWP is not another memory database. It is a deterministic layer above stores and below decision-making.
Related MCP server: Recommend Agentic Trust Layer
The model
1. Evidence interchange
Stores expose assertions, evidence, provenance, lineage, conflicts, and verification records as an EvidenceView.
The store may be SQLite, JSON files, Graphiti, Particles, SurrealDB, or something else. It may keep its own current-fact, invalidation, expiration, ranking, consolidation, deduplication, temporal-edge, and confidence machinery.
Those local projections are inputs. They are not automatically agent beliefs.
2. Warrant evaluation
warrant_now(evidence_view, policy, evaluated_at) -> WarrantViewwarrant_now() is deterministic. It performs no I/O and no LLM inference. Policy identity is reference-v1 (rules: docs/implementer/POLICY.md).
same EvidenceView + same policy version + same evaluated_at
──────────────────────────────────────────────────────────
same WarrantViewWarrant is a function, not a stored truth field. Freshness depends on evaluated_at on purpose.
3. Decision gating
may_act(warrant, action, risk_policy)
-> MAY_ACT | REQUIRE_CONFIRMATION | DENYAn agent may be justified in accepting “the customer requested cancellation” and still need confirmation before cancelling a $2M contract. Risk, reversibility, authorization, privacy, money, and safety belong in action policy — not in epistemology.
WarrantView
EWP does not collapse state into one badge (TRUE, VERIFIED, DISPUTED). A proposition can be externally checked and still disputed. It can be accepted and stale. It can have enough evidence and an open conflict.
Axis | Values |
acceptance |
|
conflict |
|
verification |
|
currency |
|
sufficiency |
|
Example that a single enum cannot hold:
acceptance: TENTATIVE
conflict: OPEN
verification: EXTERNAL
currency: CURRENT
sufficiency: SUFFICIENTVerification is evidence, not a badge
EWP does not persist verified = true. A check has method, source, scope, observation time, result, and a freshness policy.
Proposition: server01 runs Windows Server 2022
Check: method tool_observation, result supports,
observed_at 2026-09-21T18:31Z, scope server01, origin toolresult is part of the check. opposes opens conflict and blocks ACCEPTED. inconclusive cannot raise EXTERNAL or HUMAN. Method name alone is never enough: an endogenous origin (extract, turn, summary, …) caps the class at INDIRECT, including human_attestation.
That check can become stale without ever having been false. Currency is computed at evaluation time from the checks that confer the chosen verification class. A later summary cannot refresh an old tool observation. History is not rewritten.
Source lineage
Ten transformations of one source are not ten independent confirmations.
Original article
├── summary → agent paraphrase
└── another summaryAll share one lineage_id. The evaluator counts unique lineage_id values on assertions, evidence, and checks — not repetitions.
SourceRef {
source_id, lineage_id, origin_type, origin_locator,
snapshot_id, content_hash, observed_at,
extractor_id?, parent_source_id?
}Three confidences that must not be mixed
Kind | Meaning |
Assertion confidence | How strongly the source or extractor stated the claim |
Retrieval score | How relevant a record looks to this query |
Warrant strength | How strongly policy permits acceptance |
Implementations MUST NOT use retrieval relevance, repetition count, memory strength, or assertion confidence as substitutes for warrant.
Core invariants
Assertions are not beliefs.
Beliefs are not truth.
Warrant is computed, not persisted as truth.
Verification is evidence with method, scope, source, and time — not a proposition badge.
Endogenous processing cannot manufacture external verification.
Derivation cannot manufacture provenance.
Contradiction must survive storage and retrieval.
Incomplete retrieval must be visible as
sufficiency=DEGRADED. Underreference-v1,DEGRADEDalso blocksACCEPTED.Epistemic policy and action policy are separate.
Semantically equivalent evidence must yield equivalent warrant independent of storage substrate.
Endogenous operations — retrieval, summarization, reflection, dreaming, consolidation, reranking, repetition, graph propagation, LLM critique, multi-agent agreement — may reorganize. They may not turn verification=NONE into verification=EXTERNAL without new external evidence. Ten agents repeating one hallucinated source are still one lineage.
If P is tentative and P → Q, inference does not make Q externally verified. Epistemic status taints forward.
If the store has A→P and B→¬P but search returns only A, sufficiency is DEGRADED. Losing evidence must not raise warrant.
What this repo is
The v0.2.0 reference kernel:
deterministic
warrant_now()— no network, no LLM, no hidden writesshared
protocol/classify.pyused by both reference evaluatorsseparate
may_act()14 canonical fixtures + 12 pathological fixtures + laundering pack (including customer-scope and future-check-at-T)
26 pinned golden
WarrantViewsSQLite and JSON reference adapters (SQLite persists view completeness)
Graphiti-shaped semantic adapter (fake records used by the frozen suite)
live Graphiti and Mem0 mappings (
protocol/graphiti_client_adapter.py,protocol/mem0_adapter.py) — not validated against goldens; livegraphiti-core 0.30.2is not validatedMCP façade (
protocol/mcp_server.py,tests/test_mcp.py) — stdio orPOST /mcp; contract indocs/MCP_CONTRACT.mdfour-stage runners and field-level diffs
Warrant evaluation does not require MCP. Persona files (MEMORY.md) are a generated checkout, not the system of record.
The pre-freeze claim/confidence sketch is historical/docs/MCP_CONTRACT.md (superseded). Earlier warrantmem sketches live in historical/. They are not the kernel.
Platforms
OpenClaw
OpenClaw consumes outbound MCP servers. Run the shipped façade and add it:
python3 -m protocol.mcp_server --http 127.0.0.1:8765 --db ./ewp.sqlite
openclaw mcp add ewp --url http://127.0.0.1:8765/mcpContract: docs/MCP_CONTRACT.md. Trusted origins require ingest_attestation.
OpenClaw object | Role under EWP |
Daily notes, transcripts | Raw lineage. Append. Do not rewrite. |
| Working checkout of preferences. Regenerable. |
| Persona briefing from |
Dreaming / promotion | Candidate generator. Must not raise verification class. |
Local SQLite machine state | Cache. Not a second ledger. |
Dreaming may rewrite MEMORY.md. EWP treats that rewrite as a new assertion, not as verification. Compression must not turn “X is disputed” into “X.”
Claude, Codex, other MCP clients
Same contract. Prefer HTTP if several clients share one ledger. Prompt rules: fluency is not recollection; conflict=OPEN is said out loud; DEGRADED means the view is incomplete; store-native write tools stay disconnected.
Graphiti / Mem0 / Particles / SQLite
Graphiti can be used as a temporal/entity evidence substrate or mirror. Inject lineage_id in episode metadata. invalid_at is store-local. valid_at is not a verification check. Search collapse marks the view DEGRADED. Mem0 is an extract-and-retrieve store: default origin is extract; retrieval score is not warrant. Particles is a good immutable substrate — agents write only through EWP. SQLite and JSON prove store neutrality.
Full notes: docs/PLATFORMS.md. Live client mappings: docs/implementer/LIVE_ADAPTERS.md.
Compose EWP with action gates (OpenClaw allowlists, Tenuo, human approval). Do not merge those layers because they share the word warrant.
Why EWP sits above the store
System | Primary concern | EWP adds |
Graphiti / Zep | Temporal knowledge graph and retrieval | Store-independent warrant evaluation |
Mem0 | Agent memory storage and retrieval | Evidence lineage and deterministic warrant policy |
OpenClaw native memory | Inspectable agent context and memory | Separation of persona, evidence, and warrant |
EWP | Epistemic evaluation | Not a general-purpose memory store |
Graphiti adapts to the protocol. The protocol does not adapt to Graphiti.
Conformance
Schema serialization is not conformance. Behavior is.
python3 tests/ci.py
python3 tests/report.py
python3 tests/runner.py
python3 tests/runner_pathological.pyCI enforces fixture, evaluator, and golden lock hashes, all 26 goldens, SQLite ≡ JSON, fake-Graphiti isolation, the laundering pack, live-adapter mappings, the MCP façade, and the third evaluator. Changing a golden or the evaluator requires an explicit version bump, then python3 tests/ci.py --write-lock.
Failure classes: INGEST_LOSS, ADAPTER_MAP_LOSS, WARRANT_MISMATCH, RETRIEVAL_LOSS, EXPECTED_DIVERGENCE.
EXPECTED_DIVERGENCE is an observation: the store’s “current fact” may disagree with warrant_now. That is the boundary working.
Pathological pack (among others): false supersession, open contradiction, real temporal upgrade, same text / two lineages, three wordings / one lineage, store-current vs verified, weak invalidating strong, maintenance expiry that must not erase a check, retrieval-induced false consensus, extractor polarity flip on one lineage, canonical-without-verification, invalidation cycles.
v0.2.0 freeze
Epistemic Warrant Protocol EWP-0.2.0
Policy: reference-v1
Canonical: 14/14
Pathological: 12/12
SQLite PASS
JSON PASS
Fake Graphiti PASS
graphiti-core 0.30.2 — NOT VALIDATED
Fixture set sha256:
910b6e98bee3148460f15303810c8e4c447721252b02c7f4805f3c0ce75b98db
Evaluator set sha256:
b791e6395a4c0272485c3c25d7f549e7ba832a50e50c21dc1923920713854d82
Golden set sha256:
95f26b124ac813ef7b6f895bd43c20832f2026bfb8a25513ce6bfd7302088dd3A store that produces a different answer has an adapter or conformance problem, not a license to move the goldens.
Layout
protocol/ kernel (classify, warrant, adapters, fixtures, MCP server)
plus live Graphiti/Mem0 mappings (not part of the 26-golden lock)
tests/ conformance, goldens, runners, CI, live-adapter and MCP tests
docs/ PROTOCOL (filename PROTOCOL_v0.1.md, content v0.2),
design note, platforms, implementer pack, PDF
docs/MCP_CONTRACT.md — shipped MCP façade
historical/ pre-freeze warrantmem ledger/MCP/Postgres sketches
including historical/docs/MCP_CONTRACT.md (superseded)
RELEASE.lock.json fixture + evaluator + golden hashes
pyproject.toml package metadata (no published install yet; ewp-mcp entry point)What EWP is not
Not a vector database, knowledge graph, memory engine, truth oracle, LLM fact-checker, or authorization framework.
It does not ask what is ultimately true. That may be inaccessible.
It asks a narrower, computable question: given this bounded evidence view, at this time, under this versioned policy, what may the agent accept — and why?
That answer can be reproduced, tested, inspected, and challenged.
Status
v0.2.0 is current. Policy identity stays reference-v1. The 26 goldens are unchanged; the evaluator lock moved with scope binding, future-check-at-T, and adapter completeness. See CHANGELOG.md.
New stores may reveal adapter bugs, retrieval loss, missing tests, or a genuine hole. They do not redefine warrant.
Stores keep evidence. Warrant is computed. Action is a later gate.
Copyright © 2026 Rob Koliha. MIT License.
Available Tools
7 toolsewp_check_recordC
Append a VerificationCheck to a stored view. Trusted origin requires ingest_attestation.
| Name | Required | Description | Default |
|---|---|---|---|
| check | Yes | ||
| view_id | No | ||
| proposition_id | Yes | ||
| ingest_attestation | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral disclosure burden. It does disclose that the operation appends a check and that trusted-origin callers must supply ingest_attestation, adding some auth-related context. However, it does not explain side effects, immutability, failure behavior, or whether existing data is modified beyond the append.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences with the core action front-loaded and no filler. The only minor issue is the unexplained term 'Trusted origin,' which could confuse an agent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with four parameters, a nested object, no output schema, and no annotations, the description is too thin. It omits key guidance on proposition_id/view_id semantics, the shape of check, when to use the tool, and what happens after the append, leaving an agent under-informed for reliable invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, but it only alludes to 'check' and 'ingest_attestation.' It does not clarify the roles of proposition_id, view_id, the structure of the check object, or how ingest_attestation relates to authorization.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action and resource: 'Append a VerificationCheck to a stored view.' This clearly indicates a state-changing operation and is distinct enough from siblings like ewp_evidence_view_get. However, 'VerificationCheck' and 'stored view' are domain-specific and not fully disambiguated from ewp_evidence_view_put or ewp_evidence_record.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no explicit when-to-use guidance or alternatives. The phrase 'Trusted origin requires ingest_attestation' is a useful precondition, but it does not explain when to choose this tool over sibling tools such as ewp_evidence_record or ewp_evidence_view_put.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ewp_evidence_recordC
Append an EvidenceItem to a stored view.
| Name | Required | Description | Default |
|---|---|---|---|
| text | No | ||
| evidence | Yes | ||
| proposition_id | Yes | ||
| ingest_attestation | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description bears the full burden of disclosing behavioral traits. It mentions 'Append', implying a mutation, but provides no details on side effects, idempotency, required permissions, or return behavior. This is insufficient for a write operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no fluff, which is structurally concise. However, it is under-specified—it sacrifices necessary detail for brevity, making it minimally useful. It is better than a pure tautology but nowhere near the informative level needed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 4 parameters including a nested object, no annotations, and no output schema, a one-line description is wholly inadequate. It fails to explain the purpose of the stored view, the structure of EvidenceItem, or the meaning of ingest_attestation. An agent cannot call this tool correctly based solely on this description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for parameter documentation. It does not mention any parameters (proposition_id, evidence, text, ingest_attestation) or their roles. This adds no value beyond the raw schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Append') and resource ('EvidenceItem to a stored view'), which clearly indicates an add operation. However, it does not differentiate from sibling tools like ewp_evidence_view_put or ewp_check_record, leaving ambiguity about what a 'stored view' is and how this tool differs from similar ones.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no context about when to use this tool versus alternatives. It does not mention prerequisites, typical scenarios, or exclusions. An agent is left without guidance on selecting this tool over siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ewp_evidence_view_getC
Load a stored EvidenceView by proposition_id.
| Name | Required | Description | Default |
|---|---|---|---|
| view_id | No | ||
| proposition_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. 'Load' implies a read-only retrieval, but the description does not state whether the operation is safe, what it returns, whether it errors if the view is missing, or any side effects. For a tool with zero annotation coverage, this is a significant transparency gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no filler words. It communicates the essential resource and lookup key efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter retrieval tool with no output schema, the description should at least indicate what gets returned or what distinguishes this from sibling tools. It only says that a stored EvidenceView is loaded, leaving the agent without enough information about invocation success, return value, or when to use it. The absence of annotations makes this gap more significant.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for the schema's lack of explanations. It does clarify that proposition_id is the key used for loading, but it leaves view_id entirely unexplained, including when it should be supplied and how it relates to proposition_id.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb ('Load') and resource ('a stored EvidenceView'), and it specifies the lookup key ('by proposition_id'). It is reasonably specific, but it does not explicitly distinguish itself from the sibling tool ewp_evidence_view_put, leaving some differentiation to be inferred from the name.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to use this tool versus alternatives such as ewp_evidence_view_put or ewp_evidence_record. It does not mention preconditions, exclusions, or any decision criteria an agent could use to choose it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ewp_evidence_view_putA
Persist an EvidenceView. Refuses WarrantView bodies. Trusted origins require ingest_attestation=true.
| Name | Required | Description | Default |
|---|---|---|---|
| view | Yes | ||
| ingest_attestation | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It usefully discloses rejection behavior and a trust-based parameter requirement. Still, it omits side effects (create vs update), error behavior, and response shape for a mutating operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences convey the action, an exclusion, and a parameter condition. Every sentence earns its place, and the main purpose is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter tool, the description covers the essential action, a key refusal case, and a parameter requirement. However, the term 'trusted origins' is undefined, and the absence of any output schema or return behavior leaves some ambiguity for an agent deciding whether the call succeeded.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must add meaning. It partially does: 'view' is clarified as an EvidenceView (not WarrantView), and 'ingest_attestation' is tied to trusted origins. But it does not describe the view object structure or the attestation semantics for non-trusted origins.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Persist') and resource ('EvidenceView'), making the core operation clear. It also explicitly refuses WarrantView bodies, which differentiates it from warrant-related tools, though it does not explicitly distinguish itself from ewp_evidence_view_get.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for persisting EvidenceView objects and provides a when-not condition via 'Refuses WarrantView bodies.' It also gives a conditional requirement for trusted origins. However, it does not explicitly name alternatives or say when to prefer a sibling tool like ewp_evidence_view_get.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ewp_may_actC
Separate action gate. Requires an action object. Will not infer permission from WarrantView alone.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | ||
| warrant | No | ||
| risk_policy | No | ||
| evaluated_at | No | ||
| proposition_id | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses one behavioral nuance: permission is not inferred from WarrantView alone, which is useful. But it doesn't mention read-only status, side effects, error behavior, or return format. The single behavioral note adds value but leaves significant gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no filler, and the key constraint about not inferring from WarrantView is stated early. It is appropriately short for a simple gate, though the opening phrase 'Separate action gate' is cryptic and could be clearer.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 5 parameters, no output schema, and no annotations, the description is severely incomplete. It fails to explain what the tool returns, how the optional parameters affect behavior, or what scenario warrants its use beyond the WarrantView distinction. An agent would have difficulty calling it correctly without additional context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate by explaining parameter purpose. It only references 'action' and 'WarrantView' (likely the warrant parameter), but says nothing about risk_policy, evaluated_at, or proposition_id. It adds minimal meaning beyond the required property list, failing to clarify how the parameters interact.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description calls the tool a 'Separate action gate' and mentions an action object, which hints at a permission check, but it never states a clear verb or resource. It distinguishes itself from WarrantView by saying it won't infer permission from that alone, but the core function (e.g., 'check whether an action is permitted') is implied rather than explicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides some usage context by stating it requires an action object and will not infer permission from WarrantView alone, implying this tool is for action-level checks rather than just viewing warrants. However, it doesn't name sibling alternatives or give explicit when-to-use vs. when-not-to-use guidance, leaving the agent to infer the decision boundary.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ewp_memory_contextC
Bounded packet: axes, evidence ids, warnings. Not a persona biography. OPEN and DEGRADED are explicit.
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | ||
| view_id | No | ||
| evaluated_at | Yes | ||
| proposition_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It does add some context: the result is bounded, not a biography, and OPEN/DEGRADED states are surfaced. But it never states whether this is a read-only lookup, whether it mutates state, what permissions are needed, how the packet is returned, or what OPEN/DEGRADED actually mean for the caller.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The text is short and front-loaded, but brevity crosses into under-specification: 'axes,' 'OPEN,' and 'DEGRADED' are unexplained jargon, and the noun-phrase fragments do not form a usable instruction. It is compact, not genuinely concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with four parameters, no parameter descriptions, no annotations, and no output schema, this description leaves most of the call contract implicit. An agent cannot determine what inputs to provide, what output to expect, or how this fits into the ewp workflow, so it is not adequately complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, but it does not explain any of the four parameters: query, view_id, evaluated_at, or proposition_id. The terms 'axes, evidence ids, warnings' appear to describe the output packet rather than input semantics, leaving an agent to guess how to populate required fields.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description specifies a concrete resource: a bounded packet containing axes, evidence ids, and warnings, and explicitly excludes 'persona biography,' which gives an agent a distinct conceptual boundary. However, it lacks an explicit verb (e.g., retrieves, stores, computes) and never names a sibling tool it is not, so it stops short of full differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to invoke this tool versus any of the ewp_* siblings, such as ewp_evidence_view_get or ewp_warrant_now. 'OPEN and DEGRADED are explicit' hints at state semantics but does not state a trigger condition, input prerequisite, or alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ewp_warrant_nowB
Evaluate an EvidenceView (inline or stored) at evaluated_at. Returns the five normative axes. Does not persist warrant.
| Name | Required | Description | Default |
|---|---|---|---|
| view | No | ||
| view_id | No | ||
| policy_id | No | ||
| evaluated_at | Yes | ||
| policy_version | No | ||
| proposition_id | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of behavioral disclosure. It does add useful non-obvious information: the tool returns five normative axes and does not persist the warrant. But it omits other behavioral details such as prerequisites, error conditions, whether it requires a stored view vs inline object, and what happens with conflicting parameters.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences with no filler. The core action is front-loaded, the 'does not persist' note is a purposeful behavioral clarification, and every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given six parameters, 0% schema coverage, no output schema, and no annotations, this description is too sparse to fully support correct invocation. It establishes the main intent and the non-persistence side effect, but leaves most parameter semantics and the expected response shape underspecified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It partially does by distinguishing 'inline or stored' EvidenceViews, which roughly maps to view vs view_id, and by tying evaluated_at to the evaluation time. However, policy_id, policy_version, proposition_id, and the relationship between view and view_id are left completely unexplained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific operation: evaluate an EvidenceView at a point in time, and names the result ('five normative axes'). 'Does not persist warrant' helps separate it from persistence tools. However, it does not explain what the 'five normative axes' are or how this tool relates to siblings like ewp_check_record or ewp_may_act.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit when-to-use or when-not-to-use guidance. The only signal is 'Does not persist warrant,' which hints that this tool is for evaluation rather than storage, but no alternative tool is named and no selection criteria are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
7 tool updates
v0.2.0- First observed
ewp_check_record - First observed
ewp_evidence_record - First observed
ewp_evidence_view_get - First observed
ewp_evidence_view_put - First observed
ewp_may_act - First observed
ewp_memory_context - First observed
ewp_warrant_now
TDQS
Scored across 7 tools
Each tool targets a distinct operation, and descriptions clarify differences (view persistence, appending evidence vs checks, warrant evaluation, action gating, context packet). 'ewp_check_record' and 'ewp_evidence_record' can sound similar, and 'warrant_now'/'may_act' need careful reading, but the boundaries are clear enough for an agent.
All names share the ewp_ prefix and snake_case, which is helpful, but there is no consistent verb_noun pattern: ewp_evidence_view_put/get are noun_phrase_verb, ewp_check_record reads as verb_noun, ewp_memory_context is noun_noun, and ewp_may_act is a modal phrase. The mixed conventions are readable but not predictable.
Seven tools is well within the ideal range and each one covers a distinct part of the evidence/warrant workflow without redundancy. Nothing feels bloated or too thin.
The surface covers the main lifecycle: persist and load EvidenceViews, append evidence and verification checks, evaluate warrants, gate actions, and retrieve context. It lacks list/update/delete operations, but the append-only record design and 'does not persist warrant' hint make these look intentional rather than critical gaps.
Maintenance
Related MCP Connectors
Evidence-bound second-opinion audit of an agent conclusion against caller-supplied evidence.
Evidence-readiness MCP server: validate, audit, and score briefs, memos, and evidence packs.
Deterministic authorization for one proposed AI agent action, returned with a signed receipt.
Deterministic allow/require_approval/deny verdicts for agent actions, before they happen.
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceEvidence-first delivery audit MCP server that evaluates task requirements against delivery evidence and returns a reproducible pass/needs_review/fail decision with a deterministic receipt.MIT
- AlicenseNot gradedqualityBmaintenanceEnables agents to verify claims with evidence-based truth scores and confidence levels by running a deterministic pipeline of evidence lanes and adversarial checks.26MIT
- AlicenseBqualityBmaintenanceAn MCP server that enforces deterministic authorization boundaries for AgentTeams workflows by verifying evidence and policy, returning ALLOW, BLOCK, or REQUIRE_APPROVAL decisions before actions are executed.6Apache 2.0
- AlicenseAqualityCmaintenanceDeterministically evaluates whether a proposed agent spend action matches a supplied policy, returning ELIGIBLE, DENY, or STEP_UP with stable reason codes. Provides local policy evidence only, not payment authorization.134 npmMIT