fidacy-mcp
fidacy-mcp is a cryptographic action firewall and integrity proof service for AI agents. It gates payment actions behind cryptographically signed mandates and provides tamper-evident audit trails, spend reports, anomaly detection, trust verdicts, and artifact anchoring.
Payment Authorization:
request_paymentauthorizes or denies a payment against the active mandate, returning an ALLOW with a short-lived Ed25519-signed grant or a DENY with the violated rule. Grants must be verified by the downstream executor before moving funds.Mandate Verification:
verify_mandatereturns the active mandate envelope (caps, allowed payees/categories, time windows, revocation rules) and Fidacy's Ed25519 public key for independent grant validation.Audit & Proof: Every decision is recorded in a hash-chained, tamper-evident log.
get_audit_proofprovides a verifiable proof for a specific decision, including chain integrity status.list_decisionslists recent payment decisions (filterable by ALLOW/DENY) with payee, amount, reason, and blocking rule.explain_decisiongives a plain-language explanation and proof for why a payment was allowed or blocked.Spend Reports:
spend_summarygenerates operator reports over a configurable time window, showing total payments, amounts per payee, blocked amounts, and which mandate rules triggered blocks.Anomaly Detection:
sentinel_alertsflags suspicious patterns in the local audit chain—first-ever payees, amount spikes, velocity bursts, payments near mandate ceilings, and retries after denial. Deterministic and explainable, no ML model required.Trust Verdicts:
assess_actionreturns a signed trust verdict (JWS) from the live Fidacy engine for any proposed action (ap2_payment,message_send,voice_call,custom,claim_document). Advisory only—no money moves.Artifact Integrity:
anchor_artifactproves a file existed unaltered at a specific moment by locally hashing it (SHA-256) and anchoring the hash to Fidacy's audit chain, checkpointed to the Bitcoin blockchain. Returns a signed receipt (JWS).check_artifactverifies if an artifact was previously anchored and its Bitcoin checkpoint status; a hash mismatch signals tampering. The file itself is never uploaded.Account Management:
upgradeinitiates an upgrade from the local/anonymous install to a full Fidacy account (preserving history).register_emailopts in the operator's email for contact and history attachment (consent-based).
@fidacy/mcp
The action firewall for AI agents. A drop-in MCP server that gates payment actions against a cryptographically signed mandate before money can move. Non-custodial: Fidacy authorizes and proves, it never holds funds.
Install once, works in any MCP-compatible agent: Claude Code, Claude Desktop, Hermes, OpenClaw, and anything else that speaks MCP.
Works with: Claude Code · Claude Desktop · OpenClaw · Hermes · Brex CrabTrap
Your agent could be paying scammers right now. Prompt-injected into the wrong payee, an inflated amount, or the same invoice twice — and your logs aren't evidence. Fidacy blocks it before money moves, and hands back a signed verdict anyone can verify against public keys. You don't trust us — you check the signature.
Quick start (free, local-first, no account)
{
"mcpServers": {
"fidacy": { "command": "npx", "args": ["-y", "@fidacy/mcp"] }
}
}Runs on your machine, offline, deny-by-default. Add trusted payees + caps in
~/.fidacy/config.json. Verify any verdict yourself against the public keys at
/.well-known/jwks.json.
Related MCP server: pop-pay
Why
An agent can hallucinate or be prompt-injected into a payment: wrong payee,
wrong amount, fabricated invoice. Prompt-level guardrails are probabilistic and
bypassable. @fidacy/mcp is a deterministic gate between the agent's intent and
the executor: the action is dead on arrival unless it validates against a signed
mandate, and every decision lands in an immutable hash-chained audit trail.
Enforcement model
Register
@fidacy/mcpas the agent's only payment-capable tool. Do not give the agent a raw payment tool. Tool inventory is the runtime firewall.The agent calls
request_payment. Fidacy checks it against the mandate (payee allowlist, per-tx cap, total cap, currency, time window, revocation).ALLOW returns a short-lived Ed25519 grant. DENY returns no grant and the violated rule. The downstream executor MUST require the grant, so a denied action cannot proceed.
Every decision is appended to a hash-chained log.
get_audit_proofreturns the portable, verifiable proof.
One install, two backends
@fidacy/mcp ships two complementary capabilities in a single install:
Verdict layer (advisory):
assess_actioncalls the live Fidacy engine and returns a signed trust verdict. It moves no money; it returns a judgment whose proof (riskPayloadJws+signingKeyId) is verifiable by anyone via@fidacy/verifyagainst the engine JWKS at/.well-known/jwks.json.Payment firewall (enforcement):
request_payment/verify_mandate/get_audit_proofgate and prove a payment against a signed mandate through the core, returning short-lived Ed25519 grants.
Mental model: assess_action -> engine (signed verdict);
request_payment and friends -> core (payment firewall).
Tools
Tool | Backend | Purpose |
| engine | Signed Fidacy trust verdict for a proposed action. Advisory. |
| core | Authorize a payment action. ALLOW + grant, or DENY + rule. |
| core | Read the mandate envelope + Fidacy public key. |
| core | Hash-chained proof for a decision id. |
assess_action
Returns a signed Fidacy trust verdict from the live engine for a proposed
action. The signed proof is riskPayloadJws + signingKeyId, verifiable by
anyone via @fidacy/verify against {engineUrl}/.well-known/jwks.json.
Inputs:
kind(optional, defaultap2_payment): one ofap2_payment,message_send,voice_call,custom,claim_document.mandate(required): the action/mandate object for thatkind.mandateType,spendingMandate,idempotencyKey,a2a.task_id(optional).
Environment:
Var | Default | Purpose |
|
| Base URL of the Fidacy engine. |
| (none) | An |
The server boots without FIDACY_ENGINE_API_KEY; the tool is always registered.
Only calling assess_action without the key returns a helpful error telling
you to set it. The key is never logged, echoed, or attached to any error.
Install
npm install -g @fidacy/mcp # or run via npx, no installClaude Code
claude mcp add fidacy -- npx -y @fidacy/mcpClaude Desktop (claude_desktop_config.json)
{
"mcpServers": {
"fidacy": { "command": "npx", "args": ["-y", "@fidacy/mcp"] }
}
}Hermes (config.yaml)
mcp_servers:
fidacy:
command: npx
args: ["-y", "@fidacy/mcp"]OpenClaw
Add the same server via the Tools panel, or the mcpServers block in your
agent config. Any MCP-compatible host uses the same command.
Wiring the real core (production)
The MCP layer talks to your core through one interface (FidacyCore). Your
repository stays private. Set FIDACY_MODE=http and implement three endpoints:
POST /v1/mandate/get->MandatePOST /v1/decide->Decision(runs your Ed25519/AP2 verification + audit append)POST /v1/audit/proof->AuditProof
No change to the MCP layer is needed.
Dev
npm install
npm run build
npm start # stdio server, in-memory demo mandateAvailable Tools
12 toolsanchor_artifactAnchor Artifact (Bitcoin-anchored integrity proof)A
Prove an artifact existed exactly as-is at this moment, and make any later tampering detectable. Give a file path (hashed locally with SHA-256 — the file itself is NEVER uploaded) or a precomputed sha256. The hash is registered on Fidacy's tamper-evident audit chain, which is checkpointed to the Bitcoin blockchain, and you get a signed receipt (JWS) verifiable offline against the engine JWKS. Use it for contracts, invoices, medical prescriptions, insurance claims, images, audio, video. kind defaults to document; optional label is a short reference (an invoice number, a case id — no PII).
| Name | Required | Description | Default |
|---|---|---|---|
| kind | No | ||
| path | No | ||
| label | No | ||
| sha256 | No | ||
| subject | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Discloses side effects beyond annotations: file is never uploaded (hashed locally), hash is registered on a blockchain-checkpointed audit chain, and a JWS receipt is returned. This adds privacy and verification details that complement the openWorldHint=true and idempotentHint=false annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three well-structured sentences: purpose, mechanism, and use cases. Every sentence provides necessary information with no repetition or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers the anchoring workflow, output (JWS receipt), and offline verification, which is substantial given no output schema. Lacks error conditions or receipt contents, but this is acceptable when a sibling tool (check_artifact) may handle verification.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema coverage, the description explains most parameters: path (hashed locally, not uploaded), sha256 (precomputed), kind (defaults to document), and label (short reference, no PII). It fails to mention `subject` and does not explicitly state mutual exclusivity of path/sha256, leaving a partial gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a clear action: 'Prove an artifact existed exactly as-is at this moment' — a specific verb and resource. It also distinguishes itself from siblings like check_artifact (verification) and get_audit_proof (retrieval) by focusing on the anchoring/creation act.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly lists use cases (contracts, invoices, prescriptions, etc.) and gives the path/sha256 alternative. However, it does not contrast with sibling tools or state when not to use it, so no exclusions are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
assess_actionAssess Action (Signed Trust Verdict)ARead-onlyIdempotent
Return a SIGNED Fidacy trust verdict from the live engine (default https://api.fidacy.com) for a proposed action. The signed proof is riskPayloadJws + signingKeyId, verifiable by anyone via @fidacy/verify against the engine JWKS at /.well-known/jwks.json. kind is one of ap2_payment, message_send, voice_call, custom, claim_document; mandate is the action/mandate object for that kind. This is the verdict (advisory) layer and moves no money; it complements the payment-firewall tools (request_payment et al.) in the same install.
| Name | Required | Description | Default |
|---|---|---|---|
| a2a | No | ||
| kind | No | ||
| mandate | Yes | ||
| mandateType | No | ||
| idempotencyKey | No | ||
| spendingMandate | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, lowering the burden; the description adds value by detailing the signed proof composition (riskPayloadJws + signingKeyId), the verification path via @fidacy/verify against the engine JWKS, and the default engine URL. This provides meaningful behavioral context beyond the annotations without contradicting them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is four sentences, front-loaded with the primary action, and every sentence earns its place: purpose, proof/verification mechanics, key parameter semantics, and usage positioning. It is dense without being bloated.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 6 parameters, nested objects, and no output schema, the description covers the core behavior well: what is returned (signed verdict with riskPayloadJws + signingKeyId), where it runs (live engine), and its role among sibling tools. It is incomplete only on the four ancillary parameters, which prevents a perfect score.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema property descriptions are 0% covered, so the description must compensate. It adds real meaning for the two central parameters: kind (enum values, acting as a discriminator) and mandate ("the action/mandate object for that kind"). However, four remaining parameters (a2a, mandateType, idempotencyKey, spendingMandate) receive no explanation, including nested objects, leaving a partial compensation gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb-resource-scope statement: "Return a SIGNED Fidacy trust verdict from the live engine... for a proposed action," which clearly states what the tool does. It also distinguishes itself from siblings by explicitly labeling this as "the verdict (advisory) layer" that "moves no money," contrasting with the payment-firewall tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The final sentence gives explicit usage boundaries: this is the advisory/verdict layer, it moves no money, and it complements the payment-firewall tools (request_payment et al.). This effectively tells the agent when to use it (for signed advisory verdicts) and when not to (when money needs to move), while naming an alternative tool family.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
check_artifactCheck Artifact (was this hash anchored?)ARead-onlyIdempotent
Check whether an artifact was anchored by this account and the state of its Bitcoin checkpoint. Give a file path (hashed locally, never uploaded) or a sha256. If the current hash of a file does NOT match any anchored record that you expected to match, the file changed since anchoring — that is exactly the tampering signal.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | ||
| sha256 | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds meaningful behavioral context beyond the annotations: it discloses that file paths are hashed locally and never uploaded, that the check is scoped to 'this account', and it explains the tampering signal interpretation. These details go beyond the readOnlyHint, idempotentHint, and destructiveHint already provided by annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is remarkably concise: two sentences that cover purpose, usage, and interpretation without redundancy. Every sentence contributes new information. It is front-loaded with the main purpose and does not waste words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no output schema, so the description must convey return semantics. It implies a result about the checkpoint state and explicitly describes the mismatch/tampering signal, but it does not specify the exact return format or fields. Given the simplicity of the tool and the annotations covering safety, the description is nearly complete, though a bit more detail on the output could push it to 5.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema provides only names and types for 'path' and 'sha256' with no descriptions (0% coverage). The description compensates fully by explaining that the two parameters are alternatives ('Give a file path ... or a sha256'), clarifying the hashing behavior for the path, and defining the sha256 format implicitly. This is essential semantic information not present in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool checks whether an artifact was anchored by this account and reports the state of its Bitcoin checkpoint. It uses a specific verb ('Check') and resource ('artifact'), and the title 'was this hash anchored?' reinforces the purpose. It is easily distinguished from siblings like 'anchor_artifact' which performs the anchoring.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains how to use the tool: provide either a file path (hashed locally, never uploaded) or a sha256. It also provides interpretive guidance for the tampering signal when a hash does not match an expected anchored record. While it does not explicitly name alternative tools, the usage context is clear and practical.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
explain_decisionExplain a Decision (why was this allowed or blocked)ARead-onlyIdempotent
Explain one decision in plain language: what was requested, what the mandate did about it, why, and the tamper-evident proof for it. Use when an operator asks why a specific payment was blocked.
| Name | Required | Description | Default |
|---|---|---|---|
| decisionId | Yes | Decision id from request_payment, list_decisions or spend_summary |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds valuable context about the output, including the tamper-evident proof and the explanation components, which goes beyond the annotations. There is no contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and front-loaded, stating the core action in the first phrase. It uses only two sentences, with no unnecessary words, and every part adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one parameter and no output schema, the description adequately explains the tool's output content (request, mandate action, rationale, proof) and usage context. It does not cover edge cases or error behavior, but for this simplicity level, it is largely complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 100% coverage for the single parameter decisionId, with a clear description of its origin. The tool description does not add further meaning to the parameter, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Explain one decision in plain language' and enumerates the specifics (request, mandate action, rationale, proof). This distinguishes it from sibling tools like list_decisions (which lists decisions) and verify_mandate (which verifies mandates), making the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit guidance on when to use the tool: 'Use when an operator asks why a specific payment was blocked.' This clearly indicates a typical scenario, but it does not explicitly mention when not to use it or contrast with alternative tools, which would make it a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_audit_proofGet Audit ProofARead-onlyIdempotent
Return the tamper-evident, hash-chained proof for a decision id, including whether the chain is intact and the public key it verifies against.
| Name | Required | Description | Default |
|---|---|---|---|
| decisionId | Yes | Decision id returned by request_payment |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate read-only, idempotent, and non-destructive behavior. The description adds meaningful context about the return value (tamper-evidence, hash chaining, chain integrity, public key), which is valuable beyond the annotations. No contradictions found.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, dense sentence that conveys all essential information without wasted words. It is front-loaded with the verb and resource, making it easy to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple, one-parameter read-only tool with rich annotations, the description is nearly complete. It states what is returned, including key elements (chain integrity, public key). It doesn't include explicit return formatting, but the absence of an output schema and the low complexity make this acceptable.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema fully describes the single parameter (decisionId) as 'Decision id returned by request_payment'. The description repeats 'decision id' but adds no additional meaning beyond the schema, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Return') and the specific resource ('tamper-evident, hash-chained proof for a decision id'), while also detailing what the proof includes (chain intactness and verifying public key). This distinguishes it from sibling tools like request_payment or verify_mandate.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies a use case (obtaining proof for a decision ID from request_payment) but provides no explicit guidance on when to choose this tool over alternatives like explain_decision or verify_mandate. The context is sufficient for simple use but lacks when-not-to-use or alternative comparisons.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_decisionsList Recent Payment DecisionsARead-onlyIdempotent
List recent agent payment decisions, newest first, with payee, amount, the agent's stated reason, and for blocked ones the rule that stopped it. Filter by status to answer 'what got blocked' directly. Read-only, works offline.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | How many decisions to return. Default 20. | |
| status | No | Filter by outcome. Default all. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds significant behavioral context beyond annotations: it reveals the response includes payee, amount, reason, and blocking rule, specifies newest-first ordering, and notes it works offline. This complements the readOnlyHint and idempotentHint annotations without contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact yet information-dense: three short sentences covering purpose, return fields, ordering, filtering use case, and operational traits. No fluff or redundant details, and the main verb+resource appear immediately.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has only two parameters, no output schema, and strong annotations. The description covers the return format (payee, amount, reason, rule), ordering, filtering, and safety traits, making it fully self-contained for an agent to invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% (both parameters are described in the schema), so baseline is 3. The description reinforces the status filter's purpose by linking it to a concrete query ("what got blocked"), adding practical value beyond the schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists recent agent payment decisions, specifies the ordering (newest first), the exact fields returned (payee, amount, reason, blocking rule), and distinguishes it from other tools by focusing on list/query behavior versus explanation or spending summaries.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides a clear use case ("Filter by status to answer 'what got blocked' directly"), which implies when to use the filter. However, it does not explicitly mention alternatives or when not to use this tool, so it stops short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
register_emailRegister operator email (opt-in)AIdempotent
Register the operator's email so their agent's protection history can attach to a real Fidacy account and Fidacy can reach them. ONLY call this when the human operator has explicitly given their email and agreed to be contacted — it is consent-based. Does not create an account or move money.
| Name | Required | Description | Default |
|---|---|---|---|
| Yes | The operator's email, exactly as they gave it. |
Output Schema
| Name | Required | Description |
|---|---|---|
| message | Yes | |
| registered | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond annotations (readOnlyHint=false, idempotentHint=true, etc.), the description adds the critical consent-based nature and the effect of attaching history to a real Fidacy account. It also preemptively clarifies side effects by stating it does not create an account or move money, which is valuable behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with purpose, then a clear consent condition, and final exclusions. Every sentence earns its place with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter, opt-in tool with an output schema and annotations, the description covers purpose, usage conditions, and non-goals. It is fully self-contained and sufficient for an agent to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single parameter, and the schema already explains 'The operator's email, exactly as they gave it.' The description adds no new technical format or constraints beyond reaffirming it is the operator's email, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action: 'Register the operator's email' and explains its purpose (so protection history attaches to a Fidacy account and Fidacy can reach them). It also explicitly distinguishes itself from creating an account or moving money, which differentiates it from siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit when-to-use guidance: 'ONLY call this when the human operator has explicitly given their email and agreed to be contacted.' It also clarifies what it does not do (does not create an account or move money), helping the agent avoid misuse.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
request_paymentRequest Payment AuthorizationAIdempotent
Authorize a payment action against the active Fidacy mandate. Returns an ALLOW with a signed grant, or a DENY with the violated rule. The downstream executor MUST require the grant. Call this before any payment; never pay without it.
| Name | Required | Description | Default |
|---|---|---|---|
| payee | Yes | Payee identifier | |
| amount | Yes | Amount in the mandate currency | |
| purpose | Yes | Your stated reason for this payment, in your own words. It is persisted readably on the tamper-evident audit record (ALLOW and DENY alike) and becomes part of the after-the-fact proof, so write the real reason. | |
| category | Yes | Purpose category (must be allowed by the mandate) | |
| currency | Yes | ISO 4217 currency code | |
| invoiceRef | No | Optional invoice identity. When set, Fidacy enforces one payment per invoice: a second request for the same invoiceRef is DENIED, at any amount. | |
| idempotencyKey | No | Optional. Your own key for this payment, if you have one (an order id, a job id). Leave it out and Fidacy derives one from the payment itself, which is the safer default: a retry of the SAME payment produces the SAME key, where an invented one would not. |
Output Schema
| Name | Required | Description |
|---|---|---|
| grant | No | |
| status | Yes | |
| message | Yes | |
| decisionId | Yes | |
| violatedRule | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With annotations providing safety hints (readOnlyHint=false, destructiveHint=false, idempotentHint=true), the description adds behavioral context: returns a signed grant or violated rule, and requires downstream verification. This goes beyond annotations by explaining the ALLOW/DENY outcome and the mandatory grant check. It does not contradict annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, front-loaded with the core action, then return behavior, then usage directive. No filler; each sentence adds distinct information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the essential behavioral contract (authorize, return ALLOW/DENY, require grant, use before payment) for a 7-parameter tool with an output schema and annotations. It doesn't cover failure modes beyond the DENY rule, but output schema likely covers return specifics, so completeness is good.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All 7 parameters have 100% schema description coverage, so the schema already documents each parameter. The tool description itself does not add parameter-level meaning beyond the schema, so a baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('authorize') and resource ('payment action against the active Fidacy mandate'), and clarifies it returns ALLOW/DENY. It distinguishes from sibling tools like verify_mandate or assess_action by focusing on payment authorization.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to call it ('before any payment; never pay without it') and imposes a downstream requirement (MUST require the grant). It does not discuss exclusions or alternative tools when not applicable, but the context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sentinel_alertsSentinel Alerts (allowed, but outside this agent's pattern)ARead-onlyIdempotent
Predictive pattern alerts from the local audit chain: first-ever payee, amount spikes vs this agent's own history, velocity bursts, payments riding the mandate ceiling, and retries after a denial (the behavior our Model Watch benchmark measures). Deterministic and explainable, no model. Use to answer 'has anything unusual happened' before it becomes a loss.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | How many flagged decisions to return. Default 20. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide read-only, idempotent, and non-destructive hints. The description adds value by stating the tool is deterministic, explainable, model-free, and based on the local audit chain, plus mentions the benchmark behavior. This goes beyond the structured annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the core purpose, and then provides a concrete use case. The enumeration of alert types is informative without being verbose. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only tool with one parameter and no output schema, the description is complete: it explains what it does, the specific pattern types, its deterministic and explainable nature, and when to use it. Annotations cover safety, and the schema covers parameters, so no gaps remain.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already describes the only parameter 'limit' with full coverage (default 20, maximum 100, exclusive minimum 0). The description does not add additional parameter semantics, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool provides predictive pattern alerts from the local audit chain, enumerating specific alert types (first-ever payee, amount spikes, velocity bursts, etc.). It distinguishes itself from siblings by focusing on unusual-pattern detection and is clearly separate from summary, proof, or decision tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a clear use case: 'Use to answer has anything unusual happened before it becomes a loss.' It establishes context but does not explicitly name alternatives or state when not to use it. The title hint 'allowed, but outside this agent's pattern' provides some exclusions but remains implicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
spend_summarySpend Summary (what my agents spent and what was blocked)ARead-onlyIdempotent
Operator report over a time window: how many payment decisions were made, how much was paid and to whom, how much was blocked before executing, and which mandate rules did the blocking. Read-only, works offline against the local audit chain. Use this to answer questions like 'what did my agents spend this week' or 'has anything been blocked'.
| Name | Required | Description | Default |
|---|---|---|---|
| days | No | Window in days, counting back from now. Default 7. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, and the description adds valuable context: it works offline against the local audit chain and clarifies that blocking occurs before execution. This goes beyond the annotation hints and enriches the behavioral understanding without contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and front-loaded: it states what the report contains, then adds read-only/offline context, and concludes with example questions. Every sentence contributes meaning, with no fluff or redundant phrasing.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given a simple 1-param tool with no output schema, the description fully conveys what the report includes (payment decisions, paid amounts, recipients, blocked amounts, and mandate rules). It also provides example usage and notes offline capability. This is complete context for an AI agent to understand and correctly invoke the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter 'days' is fully described in the schema (window in days, default 7, max 365), and the description's mention of 'time window' aligns but adds no additional technical detail. With 100% schema coverage, a baseline score of 3 is appropriate; the description doesn't need to compensate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: an operator report over a time window with specific metrics (number of payment decisions, amounts paid, recipients, blocked amounts, and mandate rules). This specific verb+resource+scope distinguishes it from siblings like list_decisions, which would provide detailed decisions rather than an aggregate summary. The example questions further reinforce its purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use the tool ('Use this to answer questions like...'), with concrete example queries. However, it does not explicitly mention when not to use it or name alternative sibling tools, so it stops short of full when/when-not/alternatives guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
upgradeUpgrade to a Fidacy accountARead-onlyIdempotent
Start upgrading this local install to a real Fidacy account (server-backed signed verdicts, anchored proof, higher volume). Returns a link to open; your anonymous usage is preserved and migrated to the new account.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations (readOnlyHint, idempotentHint, non-destructive) already provide a safety profile. The description adds valuable behavioral context: it 'Returns a link to open' and notes 'your anonymous usage is preserved and migrated to the new account'. This goes beyond the structured annotations to explain the outcome and state preservation, with no contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long, front-loaded with the core purpose, and every clause adds meaningful information (upgrade target, benefits, return link, migration behavior). No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity (0 params, no output schema) and rich annotations, the description is fully complete. It explains what the tool does, what it returns, and the migration behavior, so an agent can invoke it correctly without further missing context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so there is nothing to explain. Per the baseline rule for 0-parameter tools, a score of 4 is appropriate—the description appropriately avoids any irrelevant param details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool 'Start upgrading this local install to a real Fidacy account', specifying the verb and resource. It differentiates from siblings by mentioning the unique purpose of migrating a local install to a server-backed account, which none of the sibling tools address.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use the tool ('Start upgrading this local install to a real Fidacy account') and explains what the tool does. It does not explicitly mention exclusions or alternatives, but given the distinct nature of the tool among siblings, the usage context is sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verify_mandateVerify Active MandateARead-onlyIdempotent
Return the active mandate envelope (caps, allowed payees/categories, window, revocation) and Fidacy's Ed25519 public key for grant verification.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, covering safety. The description adds content detail (caps, allowed payees, window, revocation, public key), which is useful. However, it does not disclose behavior when no active mandate exists or any edge cases, so the added behavioral context is moderate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that front-loads the main action and resource, then lists the returned components. Every word contributes meaning, with no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given there is no output schema and no parameters, the description carries the responsibility of explaining return values. It enumerates the envelope contents and the public key, giving a solid overview. However, it omits details about formatting, revocation semantics, or the absence of an active mandate, leaving minor gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the schema provides complete coverage. The description does not need to add parameter semantics, and the baseline of 4 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool as returning the active mandate envelope and Fidacy's Ed25519 public key for grant verification. It uses the specific verb 'Return' and details the resource contents, distinguishing it from sibling tools like spend_summary or get_audit_proof.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context by stating the purpose is 'for grant verification', which implicitly indicates when to use it. It does not explicitly mention alternatives or exclusions, but for a no-parameter read-only tool, the intended usage is evident.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
12 tool updates
v0.1.0- First observed
anchor_artifact - First observed
assess_action - First observed
check_artifact - First observed
explain_decision - First observed
get_audit_proof - First observed
list_decisions - First observed
register_email - First observed
request_payment - First observed
sentinel_alerts - First observed
spend_summary - First observed
upgrade - First observed
verify_mandate
TDQS
Most tools have clearly distinct purposes (e.g., request_payment vs assess_action vs anchor_artifact), but the read-only audit/reporting tools (spend_summary, list_decisions, explain_decision) overlap somewhat. Descriptions help differentiate them, but an agent could still mis-select between spend_summary and list_decisions.
The dominant pattern is verb_noun (request_payment, verify_mandate, get_audit_proof, etc.). However, 'sentinel_alerts' is a noun phrase and 'upgrade' is a bare verb, breaking the otherwise consistent style.
12 tools is well within the optimal 3-15 range. Each tool targets a specific aspect of the payment authorization, audit, artifact proofing, or account lifecycle, and none feel redundant or superfluous.
The main workflows are covered: payment authorization with mandates, audit trails, decision explanations, alerts, artifact anchoring/checking, and account upgrade/email registration. Slight gaps like no way to list all anchored artifacts or revoke an anchor are minor and likely beyond the server's intended scope.
Maintenance
Related MCP Connectors
Pre-spend firewall for AI agents. Approves, blocks, flags transactions against policy rules.
Pay-per-call safety checks for AI agents: screen a crypto address or URL before you transact.
Check if a counterparty is safe to pay: trust/risk score for AI agents. Scam/phishing screen.
Payment infrastructure for AI agents: spending rules, approval flows, single-use virtual cards.
Related MCP Servers
- AlicenseAqualityCmaintenanceCryptographic proof of consent for AI agents. Sign before you act. Policy engine enforces spending caps, action whitelists, and escalation rules. Independently verifiable by anyone.102Apache 2.0
- AlicenseNot gradedqualityBmaintenanceStop AI agents leaking your card or making hallucinated purchases. No SaaS, No login, Fully local. A runtime security layer that protects AI agents during online purchases. It sits between the agent and payment forms1421MIT
- AlicenseAqualityBmaintenanceNon-custodial agent wallet with a transaction preflight that decodes an unsigned EVM tx and flags drain patterns (unlimited/large approval, approve-all, token & NFT transferFrom, proxy upgrade, on-chain permit, approvals hidden in multicall) before signing.91MIT

emilia-mcp-serverofficial
AlicenseAqualityAmaintenanceThe accountability layer for AI agents — a named human's signed yes before an agent does anything irreversible (payment, record change, deploy), then an offline-verifiable Trust Receipt. Apache-2.0, formally verified.17649Apache 2.0
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/lucaslubi/fidacy-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server