BugSecure MCP

Verify a payout certificate

verify_certificate

Read-onlyIdempotent

Retrieve a BugSecure payout certificate by its public token and return the document, signed bytes, detached JWS signature, and public key, enabling external verification of authenticity with a JWS library.

Instructions

Look up a BugSecure payout certificate by the public token from its verification link. Returns the document for reading, plus the signed bytes (base64url), the detached JWS signature and BugSecure’s published public key that signed it, so its authenticity can be checked with a JWS library. This tool does NOT verify the signature itself: never describe a certificate as authenticated unless the signature was verified, and never describe an unsigned certificate (isSigned: false) as authenticated.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`publicToken`	Yes	The opaque token at the end of the certificate’s verification link (not the printed BSC-… reference).

Output Schema

TableJSON Schema

Name	Required	Description	Default
`signingKey`	No	The published RSA public key (JWK) matching keyId; null when none matches.
`certificate`	No

Schema Changelog

Changes observed during successful MCP inspections.

First observedv0.1.0Sep 25, 2026

TDQS

A4.5/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive, so the bar is lower; the description adds the critical disclosure that the tool does not verify the signature itself and instructs the agent never to label certificates authenticated unless verified. This is valuable behavioral context beyond structured fields.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three compact sentences: action, return payload, and a critical precaution. No filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a security-sensitive lookup with a well-defined schema and safety annotations, the description covers what the agent needs: token provenance, usable output, and correct authenticity caveats. Nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the sole publicToken parameter already has a pattern and description. The description reinforces that the token comes from the verification link, but adds little beyond the schema, so baseline 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Look up') and resource ('BugSecure payout certificate') plus retrieval key ('public token from its verification link'), and describes the returned artifacts. It is readily distinguishable from sibling listing tools because it is token-based verification lookup.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly frames when to use it: when you have a certificate's verification link/token and need the certificate plus signature material. It does not name explicit alternatives/exclusions, but the token-based retrieval context is sufficiently clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.