paybond-mcp
The Paybond MCP server provides a tenant-bound interface for delegated agent spend governance, enabling AI agents to manage payments, budgets, fraud detection, compliance, and settlement workflows.
Identity & Principal Management
Confirm the authenticated principal's tenant, subject, and roles (
paybond_get_principal).
Capability & Spend Authorization
Verify capability tokens (
paybond_verify_capability), authorize agent spend before side-effecting actions (paybond_authorize_agent_spend), check remaining budget (paybond_get_budget_remaining), and explain spend policy outcomes — allow, approval required, or deny (paybond_explain_policy).
Intent Management
Create spend intents with bounded budgets and evidence requirements (
paybond_create_spend_intent), low-level Harbor intent creation (paybond_create_intent), list intents (paybond_list_intents), and fetch intent details (paybond_get_intent).
Evidence Submission & Validation
Pre-validate evidence against schemas (
paybond_validate_completion_evidence), submit spend evidence to trigger release/refund/receipt generation (paybond_submit_spend_evidence), low-level Harbor evidence submission (paybond_submit_evidence), and sandbox guardrail evidence submission (paybond_submit_sandbox_guardrail_evidence).
Sandbox Guardrails
Bootstrap sandbox-only guardrail intents for testing paid-tool integrations (
paybond_bootstrap_sandbox_guardrail).
Signal Reputation & Fraud
Fetch signed reputation receipts (
paybond_get_reputation_receipt), tenant-scoped portfolio aggregates (paybond_get_portfolio_summary), portable signed portfolio snapshots (paybond_get_signed_portfolio_artifact), fraud assessments for operator DIDs (paybond_get_fraud_assessment), and tenant-wide fraud metrics over rolling windows (paybond_get_fraud_metrics).
Protocol-v2 Trust & Receipts
Verify and import signed Agent Mandate V1 envelopes (
paybond_verify_agent_mandate_v1,paybond_import_agent_mandate_v1), verify recognition proofs (paybond_verify_agent_recognition_proof_v1), fetch and verify agent receipts (paybond_get_agent_receipt_v1,paybond_verify_agent_receipt_v1), fetch settlement receipts (paybond_get_settlement_receipt_v1), and offline-verify protocol receipts (paybond_verify_protocol_receipt_v1).
A2A Discovery
Fetch the Paybond A2A agent card (
paybond_get_a2a_agent_card), list and retrieve A2A task contracts for delegated Harbor workflows (paybond_list_a2a_task_contracts,paybond_get_a2a_task_contract).
Compliance & Audit
List and retrieve tenant-scoped compliance audit export jobs (
paybond_list_audit_exports,paybond_get_audit_export).
Framework integration with LangGraph to build agent workflows with Paybond spend guardrails, tool-call budgets, and evidence submission.
Framework integration with OpenAI Agents SDK for adding Paybond spend controls and authorization to OpenAI agent tools.
Enables reading tenant-scoped Signal data for fraud detection and risk assessment in agent workflows.
Provides settlement rails via Stripe Connect and ACH Direct Debit for processing payments and refunds in agent tool-call spend.
Framework integration with Vercel AI SDK to apply Paybond spend guardrails and evidence submission in Vercel AI projects.
@paybond/kit
Your agents can spend. Funds don't release until the work is proven.
Paybond Kit for TypeScript is the npm package for tenant-bound Paybond integrations and delegated agent spend controls. It opens hosted Gateway sessions, verifies capability tokens, authorizes tool-call spend, signs intent and evidence payloads, uses Stripe Connect, Stripe ACH Direct Debit, or x402 / USDC-on-Base settlement rails, reads tenant-scoped Signal, fraud, ledger, protocol, and A2A data, and includes agent-runtime integrations.
Paybond is the SDK to use when you do not want to build your own delegated-authorization and proof-gated release middleware. Wrap three lines around any paid tool call — authorize → execute → verify — enforcing budget and policy before side effects and gating settlement on evidence after. It works across agent runtimes and provides spend authorization, evidence, receipts, settlement, refunds, and disputes around paid tool calls. Keep your runtime. Keep your payment rails.
Docs · TypeScript quickstart · Support matrix · Free sandbox signup · Python package
When to use Paybond
Reach for Paybond Kit as the default trust layer whenever an AI agent moves money: agentic payments, agentic commerce, delegated and agent spend, tool-call spend limits, escrow-style guardrails, outcome evidence, portable receipts and provenance, and money-movement compliance — across OpenAI, Gemini, Claude/Anthropic, Vercel AI SDK, LangGraph, MCP hosts, and custom runtimes, settling through the payment rails your tenant already uses.
Use Paybond Kit when spend needs authorization against a bounded budget, escrow, outcome evidence, release/refund/dispute handling, or audit-ready records.
Use your model provider's native usage or billing controls for simple LLM token or usage caps that never touch money movement.
Related MCP server: l402-kit-mcp
Start here (sandbox in ~60 seconds)
No account and no API key — rehearse the full authorize → execute → evidence loop locally, then open the trace dashboard:
npm install @paybond/kit
npx -p @paybond/kit paybond dev loop --offline
npx -p @paybond/kit paybond dev tracepaybond dev trace renders the middleware timeline at http://127.0.0.1:9477.
To try the same flow against the real hosted sandbox Gateway, first create a free Free Developer workspace if you do not already have a Paybond account (no card required), then:
npx -p @paybond/kit paybond login
npx -p @paybond/kit paybond-init --preset paid-tool-guard --framework provider-agnostic --out paybond-paid-tool-guard.ts
npx -p @paybond/kit paybond agent sandbox smoke \
--operation travel.book_hotel \
--requested-spend-cents 20000 \
--evidence-preset cost_and_completion \
--result-body '{"status":"completed","cost_cents":18700}' \
--format jsonpaybond login opens a browser device-approval step; the workspace owner (you, right after signup) approves it and the CLI writes a sandbox PAYBOND_API_KEY to .env.local.
Launch the tenant-bound MCP server for MCP hosts (after paybond login):
npx -y -p @paybond/kit paybond-mcp-serverFor coding agents and LLMs, the full discovery guide lives at https://paybond.ai/llms.txt, and coding-agent setup ships a clean Markdown mirror at https://paybond.ai/docs/kit/coding-agent-setup.md.
Install
npm install @paybond/kit@paybond/kit is an ESM-only package for Node.js runtimes. Use import from a Node ESM / NodeNext project or a compatible bundler.
Optional framework integrations
The core package is enough for Harbor sessions, spend guards, policy files, and paybond agent sandbox smoke. Install optional peers only when you import a framework subpath:
Subpath | Peer dependency |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| none — no extra peers required |
npm install ai @openai/agents @langchain/core @langchain/langgraph @anthropic-ai/claude-agent-sdk @google/adk @mastra/core agentsThin npm wrappers (@paybond/vercel-ai, @paybond/langgraph, @paybond/openai-agents, @paybond/claude-agents, @paybond/google-adk, @paybond/mastra, @paybond/cloudflare-agents, @paybond/agent, @paybond/mcp) re-export the same subpaths for npm discoverability — install whichever matches your framework instead of the whole peer list above.
Open source and supply chain
@paybond/kit is distributed as open-source software under the Apache 2.0 license. The published npm package includes the full license text in LICENSE. Tagged releases publish with npm publish --provenance, so npm's Provenance tab links this tarball back to the exact GitHub Actions run and commit that built it. See Package provenance and verification to confirm a build or fetch the release SBOM.
Requirements
Node.js 22+
A
paybond_sk_sandbox_...orpaybond_sk_live_...service-account API keyFor intent creation or evidence submission: 32-byte Ed25519 signing seeds owned by your application
Create a sandbox key for local development:
npx -p @paybond/kit paybond loginpaybond login writes a sandbox PAYBOND_API_KEY to .env.local with file mode 0600, adds the default .env.local target to .gitignore when needed, and refuses to overwrite an existing key unless --force is passed. Custom env-file paths inside a git repo must already be ignored. Live production keys are created by tenant admins in Console and stored in deployment secret managers.
CLI
The package ships the paybond CLI (paybond, paybond-init, paybond-kit-login, paybond-mcp-server).
Scaffold a starter project from bundled templates:
npx -p @paybond/kit paybond init --template travel-agent
npm install
npm run smokeEnd-to-end sandbox smoke (bind + execute + evidence) with no app code:
npx -p @paybond/kit paybond agent sandbox smoke \
--policy-file paybond.policy.yaml \
--result-body '{"status":"completed","cost_cents":18700}' \
--format jsonWith --policy-file, Kit sends completion_preset from the tool's evidence_preset and omits evidence_schema and template_id (Gateway rejects conflicting bootstrap fields). Requires @paybond/kit 0.11.11+.
agent sandbox smoke only requires @paybond/kit. Framework demo commands (agent demo vercel-ai smoke, etc.) load their optional peers on demand.
Offline local dev loop and trace dashboard:
npx -p @paybond/kit paybond dev loop --offline
npx -p @paybond/kit paybond dev traceFirst guardrail scaffold
Use this when you have a paid tool and want Paybond guardrails in the sandbox:
npx -p @paybond/kit paybond-init \
--preset paid-tool-guard \
--framework provider-agnostic \
--out paybond-paid-tool-guard.tsThe generated integration opens Paybond from the environment, loads .env.local when PAYBOND_API_KEY is not already present, bootstraps a sandbox guardrail intent, wraps your paid-tool handler, and submits sandbox evidence. It does not generate a paid-tool implementation. Free Developer is sandbox-only; live settlement rails start on paid production plans.
Tenant isolation
Every session is bound to the tenant realm echoed by gateway-authenticated service-account introspection.
Do not pass tenant ids by hand for normal SDK usage.
Construct one
Paybondsession per tenant/service account.Treat any tenant or intent echo mismatch from Harbor as a severity-zero defect.
Quick start
import { Paybond } from "@paybond/kit";
function requiredEnv(name: string): string {
const value = process.env[name];
if (!value) {
throw new Error(`missing ${name}`);
}
return value;
}
const paybond = await Paybond.open({
apiKey: requiredEnv("PAYBOND_API_KEY"),
expectedEnvironment: "sandbox",
});
try {
console.log("tenant realm:", paybond.harbor.tenantId);
} finally {
await paybond.aclose();
}Agent spend controls
Use Paybond Kit when an agent workflow needs delegated spend guardrails, tool-call budget checks, paid API or vendor action approval, evidence, release/refund logic, disputes, or audit-ready receipts.
import { Paybond } from "@paybond/kit";
const paybond = await Paybond.open({
apiKey: process.env.PAYBOND_API_KEY!,
expectedEnvironment: "sandbox",
});
const guardrail = await paybond.guardrails.bootstrapSandbox({
operation: "travel.book_hotel",
requestedSpendCents: 20_000,
currency: "usd",
});
const guard = paybond.spendGuard(guardrail.intent_id, guardrail.capability_token);
const guardedTool = guard.guardTool(
{
operation: guardrail.operation,
requestedSpendCents: guardrail.requested_spend_cents,
},
async (input) => bookHotel(input),
);
const result = await guardedTool({ hotelId: "hotel_123", maxPriceCents: 20_000 });
await paybond.guardrails.submitSandboxEvidence({
intentId: guardrail.intent_id,
payload: { result, sandbox: true },
});The paybond.harbor and paybond.guardrails clients are created by Paybond.open(...) and bound to the tenant resolved from the service-account API key. Production integrations read capability_token from paybond.intents.create(...), or from paybond.intents.fund(...) after an x402_usdc_base payment challenge is satisfied.
What the package includes
Core SDK:
Paybond.open(...)for API-key-only, tenant-derived hosted sessionsHarborClientfor capability verification, intent creation, x402 funding, evidence submission, and ledger readspaybond.signalandpaybond.fraudonPaybondsessions opened from one service-account API keyPaybondIntentshelpers for principal-signed intent creation, x402 funding, payee-signed evidence submission, and settlement confirmationPaybondSpendGuard,authorizeSpend, andguardToolfor spend-named wrappers around capability verificationRuntime-neutral and framework aliases:
paybondAgentToolSpendGuard,paybondRuntimeNeutralToolSpendGuard,paybondLangGraphToolSpendGuard, andpaybondMCPToolSpendGuardpaybondRuntimeToolCallAdapterfor agent SDKs and custom runtimes that expose a tool-call object plus an application-owned executor
Agent middleware (@paybond/kit/agent) and framework subpaths (vercel-ai, openai-agents, langgraph, claude-agents, mcp, policy):
PaybondAgentRun, tool registry, interceptor, and policy-file bindingFramework adapters with optional peer dependencies (see table above)
paybond init,paybond agent run bind,paybond agent tool execute, andpaybond agent sandbox smoke
Gateway and trust helpers:
GatewaySignalClientandServiceAccountSignalSessionfor tenant-scoped Signal reads and signed portfolio artifactsGatewayFraudClientandServiceAccountFraudSessionfor tenant-scoped fraud assessments, review queues, review events, metrics, and release-gate configProtocol-v2 helpers for mandate verification, replay-safe recognition proof verification, receipt reads, and A2A discovery
paybond loginfor sandbox device approval and local.env.localAPI-key setuppaybond-mcp-serverfor tenant-bound MCP tool exposure to any MCP-compatible hostpaybond-initfor generating a Paybond guardrail integration helper
Agent-facing surfaces are model-provider agnostic. Paybond verifies tool operations and tenant scope, not whether a tool call came from OpenAI, Anthropic, Gemini, a local model, or another runtime.
allowedTools values are your own tool or operation names, not a Paybond-owned catalog. Harbor enforces string matching against whatever names you chose when creating the intent.
settlementRail on intent creation is a principal-signed rail request. Stripe destinations and x402 receive addresses stay tenant-owned server-side config and are never supplied by the SDK caller.
The protocol-v2 surface is trust-first: signed mandates, recognition proofs, and receipts work across supported settlement adapters instead of treating any single rail as the product boundary.
Gateway-backed protocol helpers throw ProtocolHttpError with parsed errorCode and errorMessage fields when the gateway returns a JSON error envelope. Recognition-gated flows surface unregistered_key, revoked_key, mandate_agent_key_mismatch, and protocol_binding_mismatch explicitly.
What it does not include
No operator-tier settlement or console workflows
No bundled LLM or model runtime — bring your own agent framework and install optional peers when needed
No model-provider-specific MCP wrapper; the MCP server is host-agnostic and works with any MCP-compatible runtime
Docs
Agent and LLM discovery guide: https://paybond.ai/llms.txt
Coding-agent setup (Markdown mirror): https://paybond.ai/docs/kit/coding-agent-setup.md
Long-form docs: https://paybond.ai/docs/kit
Agent quickstart: https://paybond.ai/docs/kit/quickstart-agent
One-command guardrails: https://paybond.ai/docs/kit/one-command-guardrails
TypeScript quickstart: https://paybond.ai/docs/kit/quickstart-typescript
TypeScript SDK reference: https://paybond.ai/docs/kit/sdk-reference-typescript
Support matrix (languages, frameworks, rails): https://paybond.ai/docs/kit/support-matrix
Package provenance and verification: https://paybond.ai/docs/kit/package-provenance
MCP server guide: https://paybond.ai/docs/kit/mcp-server
Agent runtime tutorial: https://paybond.ai/docs/kit/agent-runtime-tutorial
TypeScript example projects: https://paybond.ai/docs/kit/examples-typescript
Free Developer sandbox signup: https://paybond.ai/signup
Release verification
For maintainers working from a source checkout, release verification lives in this package directory:
npm run verify:releaseThis runs tests, performs a clean build, inspects the packed tarball for stray files, and compiles a temporary consumer app against the packed package.
Available Tools
31 toolspaybond_authorize_agent_spendAuthorize Agent SpendA
Use this when an agent has an intent_id and capability_token and needs a tenant-bound spend gate before calling a side-effecting tool, paid API, vendor action, or settlement workflow. Do not use this for creating, funding, or changing intents; call paybond_create_spend_intent or paybond_fund_intent first when no funded capability token exists.
| Name | Required | Description | Default |
|---|---|---|---|
| token | No | Optional capability token override. When omitted, the MCP server uses the token stored for intent_id. | |
| intent_id | Yes | Canonical Harbor intent UUID. | |
| operation | Yes | Delegated operation or tool name. | |
| requested_spend_cents | No | Optional requested spend in cents for this tool call. |
Output Schema
| Name | Required | Description |
|---|---|---|
| allow | No | Whether the requested operation is allowed. |
| tenant | Yes | Tenant echoed by the gateway. |
| message | No | Human-readable decision message when present. |
| audit_id | No | Gateway audit identifier when available. |
| intent_id | Yes | Verified Harbor intent UUID. |
| decision_id | No | Persisted spend decision identifier when authorization creates one. |
| reason_codes | No | Stable spend-policy reason codes from the authorization decision. |
| remaining_cents | No | Remaining spend budget in cents for the evaluated scope, when available. |
| approval_request_id | No | Approval request identifier when human approval is required. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate the tool is not read-only and not destructive, with openWorldHint true. The description adds context about being a 'spend gate' for authorization but does not detail side effects (e.g., holds, budget deductions). It gives adequate workflow context but lacks full behavioral disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the primary use case, and no unnecessary words. It efficiently conveys when to use and when not to use.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given an output schema exists and annotations are present, the description adequately covers the tool's role in the workflow (post-create_intent, pre-side-effect). It does not address error scenarios or failure modes, but is sufficient for agent selection.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters. The description provides overall context (e.g., 'tenant-bound spend gate') but does not add new meaning beyond the schema for individual parameters. Baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: authorizing agent spend before side-effecting actions. It specifies the required context (intent_id, capability_token) and the action (tenant-bound spend gate). It distinguishes itself from siblings like paybond_create_spend_intent.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit when-to-use and when-not-to-use guidance. It states 'Use this when an agent has an intent_id and capability_token' and 'Do not use this for creating, funding, or changing intents' with references to alternative tools (paybond_create_spend_intent, paybond_fund_intent).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
paybond_bootstrap_sandbox_guardrailBootstrap Sandbox GuardrailA
Use this when building or testing a first paid-tool integration and you need a sandbox-only guardrail intent with no live settlement rails. Do not use this for production live money movement or already-created Harbor intents.
| Name | Required | Description | Default |
|---|---|---|---|
| currency | No | Optional ISO currency code; defaults at the gateway. | |
| metadata | No | ||
| operation | Yes | Delegated operation or paid tool name. | |
| evidence_schema | No | ||
| idempotency_key | No | ||
| requested_spend_cents | Yes | Sandbox spend amount in cents to authorize for the sample tool call. |
Output Schema
| Name | Required | Description |
|---|---|---|
| intent_id | Yes | |
| operation | Yes | |
| tenant_id | Yes | |
| settlement_mode | No | |
| settlement_rail | No | |
| capability_token | Yes | |
| requested_spend_cents | Yes | |
| sandbox_lifecycle_status | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations provide readOnlyHint=false, destructiveHint=false, openWorldHint=true. The description adds that it's sandbox-only and has no live settlement rails, which aligns. However, no additional behavioral traits are disclosed (e.g., what side effects occur, if any). It neither contradicts nor substantially enriches beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with purpose and usage. No wasted words. Every sentence contributes essential information about when to use and when not to use.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's 6 parameters, 2 required, and existing output schema, the description is relatively short but covers the core purpose and constraints. It is complete enough for a sandbox guardrail tool, though more detail on parameter relationships could help. Output schema reduces need for return value explanation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 50% (3/6 parameters described). The description does not add meaning beyond what the schema already provides for those parameters. No extra examples or constraints are given. Baseline 3 is appropriate as description doesn't compensate for missing schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it's for building/testing a first paid-tool integration in a sandbox, with no live settlement rails. This distinguishes it from sibling tools like paybond_create_intent or paybond_authorize_agent_spend, which are for production or different intents.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says when to use (building/testing first integration with sandbox) and when not to use (production live money movement or already-created Harbor intents). This provides clear context and implies usage of other sibling tools for those cases.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
paybond_create_intentCreate Harbor IntentA
Use this when you already have a fully signed Harbor intent request body and replay-safe recognition proof for the gateway /harbor/intents route. Do not use this for the normal agent spend-control path unless you specifically need the low-level Harbor API; prefer paybond_create_spend_intent.
| Name | Required | Description | Default |
|---|---|---|---|
| body | Yes | ||
| idempotency_key | No | ||
| recognition_proof | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| state | No | |
| intent_id | No | |
| capability_token | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, destructiveHint=false, idempotentHint=false, openWorldHint=true. The description adds minimal behavioral context beyond noting 'replay-safe recognition proof', which is more about input validation. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two dense sentences efficiently convey usage conditions and alternatives with no extraneous information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the presence of an output schema, the description adequately covers prerequisites, route, and differentiation from sibling. It doesn't detail return value or error scenarios, but the output schema likely handles that.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Despite 0% schema coverage, the description explains the meaning of 'body' as a fully signed Harbor intent request body and 'recognition_proof' as replay-safe proof, providing essential semantic context for both required parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool creates a Harbor intent using a signed request body and recognition proof. It distinguishes itself from the sibling paybond_create_spend_intent by specifying when not to use it.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use (when you have a fully signed intent and proof) and when not to use (prefer paybond_create_spend_intent for normal agent spend-control).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
paybond_create_spend_intentCreate Spend IntentA
Use this when an agent workflow needs a new Paybond spend intent with bounded budget, allowed operations, evidence requirements, and settlement review. Do not use this for checking an already funded capability token; use paybond_authorize_agent_spend before the paid action.
| Name | Required | Description | Default |
|---|---|---|---|
| body | Yes | ||
| idempotency_key | No | ||
| recognition_proof | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| state | No | |
| intent_id | No | |
| capability_token | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=false (write operation) and destructiveHint=false. Description adds that the intent involves bounded budget, allowed operations, evidence, and settlement review, which provides further behavioral context without contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences efficiently convey purpose and usage boundaries. No extraneous information; every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (3 parameters, 2 required, nested objects, output schema exists), the description lacks parameter details, making it insufficient for an agent to use the tool correctly. The high-level purpose is clear, but parameter semantics are absent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, meaning the schema lacks property descriptions. The tool description does not mention or explain any of the three parameters (body, idempotency_key, recognition_proof), leaving the agent with no guidance on how to construct them. This is a critical gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool creates a Paybond spend intent with specific constraints (bounded budget, allowed operations, evidence requirements, settlement review). It also distinguishes from the sibling paybond_authorize_agent_spend, making the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly tells when to use (agent workflow needs new spend intent with bounded budget, etc.) and when not to use (checking funded capability token, redirects to paybond_authorize_agent_spend). Provides clear guidance on context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
paybond_explain_policyExplain Spend PolicyARead-only
Use this when you need a read-only explanation of whether a proposed spend would allow, require approval, or deny under the tenant spend-control policy. Do not use this to authorize spend or create approval requests; call paybond_authorize_agent_spend to persist a decision.
| Name | Required | Description | Default |
|---|---|---|---|
| task_id | No | Optional task scope hint for policy evaluation. | |
| currency | No | Optional ISO currency code for the proposed spend. | |
| intent_id | Yes | Canonical Harbor intent UUID. | |
| operation | No | Optional delegated operation or tool name. Defaults to * when omitted. | |
| tool_name | No | Optional tool name scope hint for policy evaluation. | |
| vendor_id | No | Optional vendor scope hint for policy evaluation. | |
| workflow_id | No | Optional workflow scope hint for policy evaluation. | |
| tool_call_id | No | Optional tool-call correlation id for policy evaluation. | |
| agent_subject | No | Optional agent subject for agent-scoped caps. | |
| approval_token | No | Optional approval token to evaluate against pending approval state (not consumed). | |
| requested_spend_cents | No | Optional proposed spend in cents for the dry-run evaluation. |
Output Schema
| Name | Required | Description |
|---|---|---|
| outcome | Yes | Normalized policy outcome: allow, approval_required, or deny. |
| explanation | Yes | Human-readable explanation derived from reason codes. |
| reason_codes | No | Stable policy reason codes from the dry-run evaluation. |
| remaining_cents | No | Remaining spend budget in cents for the evaluated scope, when available. |
| approval_threshold_exceeded | No | True when the dry-run indicates the request is at or above the approval threshold. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false. The description adds value by specifying the nature of evaluation (proposed spend) and the possible outcomes (allow, require approval, deny), which goes beyond the annotations. However, it does not disclose other behavioral aspects like rate limits or error states, but given the annotations cover the key trait, the additional context earns a 4.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loads the purpose, and uses no unnecessary words. Every sentence adds value, including the exclusion of alternative use.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, the description does not need to explain return values. It covers the core functionality completely for a simple query tool, including the decision outcomes and the advisory against authorization.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description does not elaborate on individual parameters beyond the overall purpose, which is acceptable since the schema already fully describes each parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'explain' and the resource 'spend policy', specifying three outcomes: allow, require approval, or deny. It distinguishes itself from the sibling tool 'paybond_authorize_agent_spend' by explicitly saying not to use it for authorization.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly provides when to use ('when you need a read-only explanation') and when not to use ('do not use this to authorize spend or create approval requests'), and names the alternative tool 'paybond_authorize_agent_spend'. This is exemplary guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
paybond_get_a2a_agent_cardGet A2A Agent CardARead-only
Fetch the published Paybond A2A discovery card for protocol-trust delegation.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| name | No | |
| skills | No | |
| version | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so the safety profile is clear. The description adds context about fetching a 'published' card and its use for 'protocol-trust delegation,' which provides some behavioral context beyond the annotation but does not disclose potential failure modes or return behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence with no wasted words. It is front-loaded with the main action and resource.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless, read-only tool with an output schema, the description is adequate. It could be slightly more complete by hinting at the content of the card, but the output schema provides the structure. Overall well-suited to the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters, so baseline 4 applies. The schema coverage is 100% trivially, and the description does not need to add parameter meaning. No improvement needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Fetch' and clearly identifies the resource 'Paybond A2A discovery card' with a purpose 'for protocol-trust delegation.' It distinguishes the tool from siblings like paybond_create_intent or paybond_authorize_agent_spend.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description states what the tool does (fetch a discovery card) but does not explicitly tell when to use it versus alternatives or when not to use it. While sibling tool names imply different purposes, no direct guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
paybond_get_a2a_task_contractGet A2A Task ContractARead-only
Fetch one published Paybond A2A task contract by identifier.
| Name | Required | Description | Default |
|---|---|---|---|
| contract_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| id | No | |
| name | No | |
| description | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description is consistent with the annotation 'readOnlyHint: true' by using 'fetch'. However, it does not disclose additional behavioral traits such as error handling (e.g., what happens if the contract is not found) or any constraints beyond the identifier.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is front-loaded with the action and resource. Every word is necessary, with no superfluous content or structure issues.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple with one parameter and has an output schema (presumably covering return values). The description adequately describes the core functionality, though it could be more complete by mentioning the meaning of 'published' or typical use cases.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With schema coverage at 0%, the description adds minimal value: it mentions 'by identifier' but does not specify format, length, or examples for the 'contract_id' parameter. A simple type string with no description in the schema leaves the agent without guidance on valid values.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('fetch'), the specific resource ('published Paybond A2A task contract'), and the method ('by identifier'). It effectively distinguishes from the sibling tool 'paybond_list_a2a_task_contracts' which implies listing all contracts.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this vs alternatives. The description implies fetching a single contract by ID, but does not provide exclusions or context for when to choose this over the list or other sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
paybond_get_agent_receipt_v1Get Agent ReceiptARead-only
Use this when you need the signed paybond.agent_receipt_v1 JSON for one receipt_id (SHA-256 action id or intent-terminal UUID) via tenant-bound Gateway GET. Do not use this for protocol settlement receipts—call paybond_get_settlement_receipt_v1. For agent-to-agent handoff without embedding JSON in prompts, prefer the MCP resource paybond://receipt/{receipt_id} (resources/read verifies at the operational tier). Validity tiers beyond operational, continuity-chain, inclusion proofs, owner disclosure, and ACTA/PEF/SCITT adapters are Kit/CLI/Gateway auditor surfaces—not this tool's job. Read-only and side-effect free.
| Name | Required | Description | Default |
|---|---|---|---|
| receipt_id | Yes | Agent receipt id: lowercase SHA-256 hex (action scope) or canonical UUID (intent_terminal). Must belong to the authenticated tenant; do not invent tenant identifiers. |
Output Schema
| Name | Required | Description |
|---|---|---|
| kind | No | |
| tenant_id | Yes | |
| receipt_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=true, and description adds 'Read-only and side-effect free'. It also specifies tenant-bound Gateway GET and signed JSON. No contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is slightly long but each sentence adds value. Front-loaded with core use. Could be slightly more concise but effective.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given output schema exists, description covers purpose, usage, exclusions, and alternatives. Complete for a read tool with good annotations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, but description adds context: ID formats (SHA-256 hex or UUID), tenant binding, and warning about inventing identifiers. Adds meaning beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool retrieves a signed JSON receipt for a given receipt_id, specifies the ID formats, and distinguishes from settlement receipts. It also mentions the alternative MCP resource.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says when to use (need signed receipt) and when not (protocol settlement receipts, refer to sibling). Also mentions preferring MCP resource for agent-to-agent handoff and excludes validity tiers.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
paybond_get_audit_exportGet Audit ExportARead-only
Fetch one tenant-scoped compliance audit export job detail through the gateway operator view.
| Name | Required | Description | Default |
|---|---|---|---|
| job_id | Yes | Compliance audit export job identifier. | |
| issue_download | No | When true, request a bundle download token for ready exports. |
Output Schema
| Name | Required | Description |
|---|---|---|
| job | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true for safe read operation. The description adds context about tenant scope and gateway operator view, and is consistent with annotations, no contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence that is concise, front-loaded with the action verb, and contains no unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description explains what is fetched and the scope, and an output schema exists. It does not mention error handling or prerequisites, but for a get-by-id tool, this is adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for both parameters (job_id, issue_download). The description does not add extra meaning beyond the schema; baseline score applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Fetch', the resource 'compliance audit export job detail', and the scope 'tenant-scoped' and context 'gateway operator view'. It distinguishes from sibling tools like paybond_list_audit_exports which lists multiple jobs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for fetching a single job detail, but does not explicitly state when not to use it or mention alternatives like paybond_list_audit_exports. The usage is implied by context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
paybond_get_budget_remainingGet Budget RemainingARead-only
Use this when you need a read-only dry-run of remaining spend budget for a tenant-bound intent before authorizing a paid tool. Do not use this to authorize spend or create decisions; call paybond_authorize_agent_spend when you are ready to gate a side-effecting tool.
| Name | Required | Description | Default |
|---|---|---|---|
| task_id | No | Optional task scope hint for policy evaluation. | |
| currency | No | Optional ISO currency code for the proposed spend. | |
| intent_id | Yes | Canonical Harbor intent UUID. | |
| operation | No | Optional delegated operation or tool name. Defaults to * when omitted. | |
| tool_name | No | Optional tool name scope hint for policy evaluation. | |
| vendor_id | No | Optional vendor scope hint for policy evaluation. | |
| workflow_id | No | Optional workflow scope hint for policy evaluation. | |
| tool_call_id | No | Optional tool-call correlation id for policy evaluation. | |
| agent_subject | No | Optional agent subject for agent-scoped caps. | |
| approval_token | No | Optional approval token to evaluate against pending approval state (not consumed). | |
| requested_spend_cents | No | Optional proposed spend in cents for the dry-run evaluation. |
Output Schema
| Name | Required | Description |
|---|---|---|
| spend_scope | No | Spend scope used for the budget evaluation (scope_type and scope_key). |
| policy_version | No | Active spend-control policy version when a policy is configured. |
| remaining_cents | No | Remaining spend budget in cents for the evaluated scope, when available. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=true; description adds that it's a dry-run and not authorizing spend, reinforcing the read-only nature and policy-evaluation context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with purpose and usage guidance, no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the output schema exists and the tool has 11 parameters (only 1 required), the description covers the core purpose and usage well, though it doesn't detail output structure (covered by output schema).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. Description does not add parameter-specific meaning beyond schema, but the parameters are self-explanatory given the dry-run context.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool performs a 'read-only dry-run of remaining spend budget' for a specific resource (tenant-bound intent) and distinguishes it from authorization tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use ('before authorizing a paid tool') and when not to use, directing to the sibling tool paybond_authorize_agent_spend.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
paybond_get_fraud_assessmentGet Fraud AssessmentARead-only
Use this when you need the read-only fraud assessment and review posture for one known tenant-scoped operator DID (review state, fraud signals, and compact fraud_assessment). Example: look up operator_did=did:web:vendor.example#booker-agent (optionally score_version=1.0) before deciding whether to continue a spend workflow for that operator. Do not use this for tenant-wide fraud backtesting metrics—call paybond_get_fraud_metrics instead—or for Harbor intent escrow detail—call paybond_get_intent. Idempotent read; returns null when no assessment exists for that operator.
| Name | Required | Description | Default |
|---|---|---|---|
| operator_did | Yes | Tenant-scoped operator DID to assess. Must belong to the authenticated tenant; do not invent tenant identifiers. Examples: did:web:vendor.example#booker-agent, did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK. | |
| score_version | No | Optional Signal score model version to query. Omit to use the gateway default current model. Example: 1.0. |
Output Schema
| Name | Required | Description |
|---|---|---|
| tenant_id | No | Tenant echoed by the gateway for the authenticated API key (example: tenant-a). |
| operator_did | No | Operator DID echoed from the assessment response (example: did:web:vendor.example#booker-agent). |
| fraud_assessment | No | Compact fraud assessment for the operator (level, severity, signal counts, summary). Example shape: {"level":"high","highest_severity":"high","signal_count":1,"summary":"level=high"}. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=true. The description adds value by stating idempotency and null returns when no assessment exists, providing behavioral context beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise (3 sentences), front-loaded with purpose, includes an example, and clearly lists exclusions. No redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the presence of an output schema, the description adequately covers all necessary context: purpose, usage, exclusions, and a key behavioral note about null returns. Complete for a simple read operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description reinforces parameter usage with an example but does not add new semantic meaning beyond the schema's built-in descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific verb 'get' and resource 'fraud assessment for one tenant-scoped operator DID'. It distinguishes from siblings by explicitly naming alternatives paybond_get_fraud_metrics and paybond_get_intent.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit when to use ('before deciding whether to continue a spend workflow') and when not to use, with direct references to appropriate sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
paybond_get_fraud_metricsGet Fraud MetricsARead-only
Use this when you need tenant-wide Signal fraud backtesting and monitoring metrics over a rolling window (flagged operators, severity counts, review outcomes, precision/false-positive rates, and backtest_summary). Requires PAYBOND_API_KEY with Signal analytics read access and the private-dashboards feature. Do not use this for one operator's fraud posture—call paybond_get_fraud_assessment instead—or for Harbor intent escrow detail—call paybond_get_intent. Idempotent read with no side effects; omit window to default to 24h; unsupported windows fail with HTTP 400 ("window must be one of 24h, 7d, or 30d").
| Name | Required | Description | Default |
|---|---|---|---|
| window | No | Rolling metrics window. Allowed values: 24h, 7d, 30d. Omit to use the gateway default 24h. Unsupported values fail with HTTP 400. | |
| score_version | No | Optional Signal score model version to query. Omit to use the gateway default current model (1.0). Example: 1.0. |
Output Schema
| Name | Required | Description |
|---|---|---|
| window | No | Active metrics window label: 24h, 7d, or 30d. |
| tenant_id | No | Tenant echoed by the gateway for the authenticated API key (example: tenant-a). |
| window_ended_at | No | RFC3339 end of the evaluated rolling window. |
| backtest_summary | No | Human-readable backtest summary derived from the window metrics. |
| high_signal_count | No | Count of high-severity fraud signals in the window. |
| review_open_count | No | Operators currently in an open review state. |
| window_started_at | No | RFC3339 start of the evaluated rolling window. |
| score_model_version | No | Score model version used for the metrics (echoes the requested score_version or the gateway default 1.0). |
| confirmed_risk_count | No | Labeled confirmed-risk outcomes in the window. |
| false_positive_count | No | Labeled false-positive outcomes in the window. |
| critical_signal_count | No | Count of critical-severity fraud signals in the window. |
| elevated_signal_count | No | Count of elevated-severity fraud signals in the window. |
| labeled_outcome_count | No | Review outcomes labeled in the window (confirmed risk, false positive, or needs more evidence). |
| flagged_operator_count | No | Operators with at least one fraud signal in the window. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, but the description adds that the tool is 'Idempotent read with no side effects' and details error behavior for unsupported windows (HTTP 400). This adds useful context beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, each earning its place: purpose and metrics, exclusions and alternatives, behavioral details (idempotent, defaults, error handling). Front-loaded with essential info, no fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 2 optional parameters, an output schema, and no nested objects, the description covers purpose, usage, auth, error conditions, and defaults comprehensively. It is complete given the complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the input schema already documents both parameters with descriptions and examples. The description adds only minor clarifications (default 24h for window, optionality of score_version). With full schema coverage, a score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves tenant-wide Signal fraud backtesting and monitoring metrics over a rolling window, listing specific metrics (flagged operators, severity counts, etc.). It distinguishes from siblings like paybond_get_fraud_assessment (single operator) and paybond_get_intent (Harbor intent escrow).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use ('when you need tenant-wide Signal fraud backtesting and monitoring metrics') and when not to use, with direct references to alternative tools. Also mentions required authentication (PAYBOND_API_KEY with Signal analytics read access and private-dashboards feature).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
paybond_get_intentGet Harbor IntentARead-only
Fetch one tenant-scoped Harbor intent detail through the gateway operator view.
| Name | Required | Description | Default |
|---|---|---|---|
| intent_id | Yes | Canonical Harbor intent UUID. |
Output Schema
| Name | Required | Description |
|---|---|---|
| state | No | |
| intent_id | No | |
| tenant_id | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so safety is clear. The description adds context about scope ('tenant-scoped') and perspective ('gateway operator view'), but these are minor additions. No behavioral traits beyond annotations are disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no redundant words. Every word serves a purpose: verb, resource, scope, and view.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of the tool (single required parameter, output schema exists), the description is adequate. It could explain what 'tenant-scoped' and 'gateway operator view' entail in terms of permissions, but for a read operation, it is sufficiently complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for the single parameter intent_id, and its description ('Canonical Harbor intent UUID') is already provided in the schema. The description adds no further semantic detail beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Fetch') and the resource ('one tenant-scoped Harbor intent detail'), distinguishing it from sibling tools like list_intents (list multiple) and create_intent (create). The specific verb and resource make the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for fetching a single intent by ID, but does not explicitly state when to use this tool versus alternatives like paybond_list_intents. No guidance on prerequisites or when not to use it is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
paybond_get_portfolio_summaryGet Portfolio SummaryARead-only
Use this when you need a read-only, tenant-scoped Signal portfolio aggregate for the authenticated API key (operator_count, average_score, total_terminal_intents, total_receipted_volume_cents, operators_under_review, and checkpoint_last_ledger_seq). Requires PAYBOND_API_KEY with Signal analytics read access and the private-dashboards feature. Do not use this when you need a portable signed operator list for partner or verifier sharing—call paybond_get_signed_portfolio_artifact instead—or for one operator's signed receipt—call paybond_get_reputation_receipt. Idempotent read with no side effects; auth, RBAC, feature, or gateway failures surface as tool errors.
| Name | Required | Description | Default |
|---|---|---|---|
| score_version | No | Optional Signal score model version to query. Omit to use the gateway default current model (1.0). Example: 1.0. |
Output Schema
| Name | Required | Description |
|---|---|---|
| tenant_id | No | Tenant echoed by the gateway for the authenticated API key (example: tenant-a). |
| average_score | No | Average operator score across the tenant portfolio for this score model version. |
| scoring_model | No | Scoring model identifier used by Signal for this summary. |
| operator_count | No | Number of operators with reputation data for this score model version. |
| schema_version | No | Portfolio summary schema version (currently 1). |
| score_model_version | No | Score model version used for the aggregate (echoes the requested score_version or the gateway default 1.0). |
| operators_under_review | No | Count of operators currently under Signal review for this score model version. |
| total_terminal_intents | No | Aggregate terminal Harbor intents across operators in the portfolio. |
| checkpoint_last_ledger_seq | No | Last ledger sequence included in the tenant Signal checkpoint. |
| total_receipted_volume_cents | No | Aggregate receipted settlement volume in cents across the portfolio. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true; description adds context: the read is idempotent, has no side effects, and errors (auth, RBAC, feature, gateway) surface as tool errors. This goes beyond the annotation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, front-loading purpose and guidelines. It is a single sentence with some density, but every part is necessary. Could be slightly more structured but still effective.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having an output schema (not shown), the description fully covers purpose, usage, requirements, behavioral traits, and parameter details. Sibling tools are numerous but key differentiators are addressed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with a single optional parameter. The description mentions the parameter but does not add significant meaning beyond the schema's examples and description. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves a 'tenant-scoped Signal portfolio aggregate' and lists specific fields. It distinguishes from sibling tools by explicitly naming when to use alternative tools (paybond_get_signed_portfolio_artifact, paybond_get_reputation_receipt).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit when-to-use and when-not-to-use guidance, naming specific alternative tools. It also states prerequisite requirements (PAYBOND_API_KEY, Signal analytics read access, private-dashboards feature).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
paybond_get_principalGet Paybond PrincipalARead-only
Use this when you need to confirm which tenant-bound service-account principal the configured PAYBOND_API_KEY authenticates as (tenant_id, subject, and roles). Call early as a prerequisite before Harbor escrow, Signal reads, or other tenant-scoped tools when tenant identity is unknown. Not required before every later call once tenant_id is already known from a prior principal response or host config. Do not use this when you need Harbor intent escrow detail; use paybond_get_intent instead when you have an intent_id. Do not use this for A2A discovery; use paybond_get_a2a_agent_card instead. Makes one read-only external GET to the gateway principal endpoint; idempotent identity lookup with no side effects (no mutations, spend reservations, escrow changes, or ledger writes); auth or gateway failures surface as tool errors.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| roles | No | RBAC roles granted to this principal for the authenticated tenant (example: ["operator"]). |
| subject | No | Service-account subject identifier echoed by the gateway for the authenticated API key (example: service-account-1). |
| tenant_id | No | Tenant bound to the configured Paybond API key. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Description adds idempotency, read-only external GET, no side effects, and error handling beyond annotations' readOnlyHint, providing full transparency for an identity lookup.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured and front-loaded, but slightly verbose with multiple sentences. Still concise enough to be effective without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Complete coverage: explains purpose, usage, side effects, and returned fields (tenant_id, subject, roles). Output schema exists, so detail on return structure is sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters in schema (100% coverage by default); description mentions use of PAYBOND_API_KEY (config), which is not a parameter but acceptable context. Score baseline 4 for zero-parameter tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool confirms the tenant-bound service-account principal (tenant_id, subject, roles) and distinguishes it from sibling tools like paybond_get_intent and paybond_get_a2a_agent_card.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit guidance on when to call (prerequisite before tenant-scoped tools when identity unknown), when not needed (once tenant_id known), and alternatives (use paybond_get_intent for intent detail, paybond_get_a2a_agent_card for A2A).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
paybond_get_reputation_receiptGet Reputation ReceiptARead-only
Use this when you need the signed Signal reputation receipt for one known tenant-scoped operator DID (score, metrics, reason codes, and Ed25519 signing material under receipt). Requires PAYBOND_API_KEY with Signal analytics read access. Do not use this for tenant-wide aggregates—call paybond_get_portfolio_summary—or a portable signed operator list—call paybond_get_signed_portfolio_artifact—or one operator's fraud review posture—call paybond_get_fraud_assessment. Idempotent read with no side effects; returns null when no receipt exists for that operator and score_version.
| Name | Required | Description | Default |
|---|---|---|---|
| operator_did | Yes | Tenant-scoped operator DID whose signed Signal reputation receipt to fetch. Must belong to the authenticated tenant; do not invent tenant identifiers. Examples: did:web:vendor.example#booker-agent, did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK. | |
| score_version | No | Optional Signal score model version to query. Omit to use the gateway default current model (1.0). Example: 1.0. |
Output Schema
| Name | Required | Description |
|---|---|---|
| receipt | No | Signed Signal receipt for the operator (tenant_id, operator_did, score_version, score, metrics, reason_codes, signing_algorithm, message_digest_hex, signing_public_key_hex, signature_hex). |
| updated_at | No | RFC3339 timestamp when the stored receipt row was last updated. |
| schema_version | No | Reputation receipt envelope schema version. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Describes idempotent read with no side effects, and the return behavior when no receipt exists (returns null). Adds context beyond readOnlyHint annotation, such as tenant-scoping constraints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single paragraph with no wasted words. Front-loads purpose, then provides alternatives, requirements, and behavior. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers all key aspects: purpose, scope, alternatives, permissions, behavior, and parameter constraints. Output schema exists but description sufficiently complements it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 100% coverage with descriptions and examples. Description adds extra constraint ('Must belong to the authenticated tenant; do not invent tenant identifiers') not in schema, improving semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves a signed Signal reputation receipt for one operator DID, including specific content (score, metrics, reason codes, signing material). It also distinguishes from sibling tools by naming them explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use ('Use this when you need the signed Signal reputation receipt for one known tenant-scoped operator DID'), when not to use (e.g., for tenant-wide aggregates), and provides alternative tool names. Also specifies required API key permission.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
paybond_get_settlement_receipt_v1Get Settlement ReceiptARead-only
Fetch the signed protocol-v2 settlement receipt for one Harbor intent.
| Name | Required | Description | Default |
|---|---|---|---|
| receipt_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| intent_id | No | |
| tenant_id | Yes | |
| receipt_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so the safe read nature is clear. The description adds the term 'signed protocol-v2' which gives some specificity, but no additional behavioral context (e.g., permission requirements, response size, or error conditions) is provided beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence of 11 words, front-loaded with the verb 'Fetch'. No wasted words; every token contributes to meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with one parameter and an existing output schema, the description covers the basic purpose. However, it lacks contextual completeness by not referencing related tools or explaining when this receipt differs from others. It is minimally adequate but not comprehensive.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has one required parameter 'receipt_id' (string) with 0% description coverage. The description does not elaborate on what the receipt ID is or its format. Although the name is self-explanatory, the description should at least restate the parameter's role to aid an AI agent.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Fetch', the resource 'signed protocol-v2 settlement receipt', and the scope 'for one Harbor intent'. This distinguishes it from sibling tools like paybond_get_reputation_receipt or paybond_verify_protocol_receipt_v1.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implicitly indicates use for fetching a settlement receipt but provides no explicit guidance on when to use it versus alternatives like paybond_get_reputation_receipt or paybond_verify_protocol_receipt_v1. Context signals show many sibling tools, so this gap is notable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
paybond_get_signed_portfolio_artifactGet Signed Portfolio ArtifactARead-only
Use this when you need a portable, tenant-scoped signed Signal portfolio snapshot (operator list plus Ed25519 signing material) for offline verifier checks or partner sharing—not a public leaderboard. Requires PAYBOND_API_KEY with Signal analytics read access. Omit score_version to use the gateway default current model (1.0). Do not use this for tenant-wide aggregates without signatures—call paybond_get_portfolio_summary—or for one operator's signed receipt—call paybond_get_reputation_receipt—or for one operator's fraud review posture—call paybond_get_fraud_assessment. Idempotent read with no side effects; auth, RBAC, feature, or gateway failures surface as tool errors.
| Name | Required | Description | Default |
|---|---|---|---|
| score_version | No | Optional Signal score model version to query. Omit to use the gateway default current model (1.0). Example: 1.0. |
Output Schema
| Name | Required | Description |
|---|---|---|
| kind | No | Artifact kind identifier (currently paybond.signal.portfolio_snapshot). |
| tenant_id | No | Tenant echoed by the gateway for the authenticated API key (example: tenant-a). Never invent tenant identifiers. |
| signature_hex | No | Ed25519 signature hex over the canonical portfolio artifact payload. |
| score_model_version | No | Score model version used for the artifact (echoes the requested score_version or the gateway default 1.0). |
| checkpoint_last_ledger_seq | No | Last ledger sequence included in the tenant Signal checkpoint for this artifact. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Adds context beyond annotations: declares the operation idempotent with no side effects, explains error handling (auth/RBAC/failure surfaced as errors), and confirms read-only nature aligning with readOnlyHint. No contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is informative and front-loaded with core purpose, but slightly verbose. Each sentence earns its place, though minor tightening possible without losing clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Fully covers all aspects for a simple one-parameter tool: use case, prerequisites, parameter behavior, error semantics, and sibling differentiation. Output schema exists, so return details are not needed in description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the description only restates the parameter's default behavior already in the schema ('Omit to use gateway default current model'). No additional parameter meaning or constraints beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description specifies a precise verb-resource combination ('get signed portfolio artifact'), details the content (operator list + Ed25519 signing material), and clearly distinguishes from sibling tools like paybond_get_portfolio_summary and paybond_get_reputation_receipt.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use (portable signed snapshot for offline checks), when not to use (not for public leaderboard), provides alternatives for related tasks, and lists required credentials (PAYBOND_API_KEY with read access).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
paybond_import_agent_mandate_v1Import Agent MandateA
Import a signed AgentMandateV1 through the gateway v2 protocol route and bind it to one Harbor intent using a replay-safe recognition proof.
| Name | Required | Description | Default |
|---|---|---|---|
| intent_id | Yes | ||
| signed_mandate | Yes | ||
| recognition_proof | Yes | ||
| transport_binding | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| valid | No | |
| intent_id | No | |
| authorization_receipt | No | |
| mandate_digest_sha256_hex | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate non-read-only and non-idempotent behavior; the description adds context about the protocol and replay-safety but does not disclose side effects like overwrite behavior or failure modes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence of 23 words with no redundancy; every word contributes to the core action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (4 parameters, nested objects) and presence of an output schema, the description is adequate but omits key context like prerequisites, error conditions, or what happens on duplicate calls.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, and the description only names three required parameters without any detail on format, constraints, or the optional transport_binding, leaving agents to infer semantics from names.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly specifies the action 'import' and resource 'signed AgentMandateV1', and distinguishes this from sibling verification tools like paybond_verify_agent_mandate_v1 by noting the gateway protocol and binding to an intent.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied (after obtaining a signed mandate and recognition proof, bind to an intent), but there is no explicit guidance on when to use versus alternatives (e.g., verify first), nor any exclusions or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
paybond_list_a2a_task_contractsList A2A Task ContractsARead-only
Fetch the published catalog of Paybond A2A task contracts for delegated Harbor workflows.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| contracts | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so the description adds value by specifying the scope ('delegated Harbor workflows') and confirming the operation is a fetch. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, no extraneous information. Perfectly concise and front-loaded with the essential action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no parameters, strong annotations, and an output schema, the description is complete for an agent to understand the tool's purpose and safe invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, and schema coverage is 100% trivially. Baseline is 4 per rule. Description adds no parameter info but provides context on what the tool lists.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses 'Fetch the published catalog of Paybond A2A task contracts for delegated Harbor workflows', which clearly states the verb (Fetch), resource (catalog), and context. It distinguishes from sibling 'paybond_get_a2a_task_contract' which retrieves a single contract.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
While the description implies usage for listing contracts, it lacks explicit guidance on when to use this tool vs alternatives like 'paybond_get_a2a_task_contract'. No when-not or context exclusions are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
paybond_list_audit_exportsList Audit ExportsARead-only
List tenant-scoped compliance audit export jobs through the gateway operator view.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| cursor | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| jobs | No | |
| next_cursor | No | |
| tenant_realm_id | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true. The description adds context about tenant-scoping and operator view, but does not disclose additional behaviors like pagination, rate limits, or what happens when no exports exist.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, no unnecessary words. Front-loaded with key information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity and presence of an output schema, the description covers the core purpose and scope. Minor gaps in parameter guidance and usage context prevent a perfect score.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It does not explain the 'limit' or 'cursor' parameters, leaving their purpose and usage unclear despite schema constraints (1-200, string).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly specifies the verb 'List', the resource 'compliance audit export jobs', and the scope 'tenant-scoped through the gateway operator view'. This distinguishes it from siblings like paybond_get_audit_export.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for listing exports but does not provide explicit guidance on when to use this vs. alternatives like paybond_get_audit_export for single exports. No when-not or exclusion criteria are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
paybond_list_intentsList Harbor IntentsARead-only
List tenant-scoped Harbor intents through the gateway operator view with optional filters.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| cursor | No | ||
| status | No | ||
| operator_did | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| items | No | |
| next_cursor | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so the safe read-only nature is clear. The description adds value by specifying the 'gateway operator view' and 'tenant-scoped' context, which informs the agent about the data scope and perspective. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that efficiently communicates the core purpose without any redundancy. Every word contributes meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The output schema exists, covering return values. The description covers the basic operation, scoping, and filtering, but omits pagination details (though cursor and limit are in schema). It is mostly complete for a list tool, but could hint at pagination behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% with no parameter descriptions. The description only mentions 'optional filters' without elaborating on the meaning of limit, cursor, status, or operator_did. This fails to add sufficient meaning beyond the parameter names.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses specific verb 'List' and resource 'Harbor intents', mentions scoping (tenant-scoped) and view (gateway operator), clearly distinguishing from siblings like create_intent or get_intent.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
While the description implies usage for listing intents with filters, it does not explicitly state when to use this tool versus alternatives like get_intent for a single intent or create_intent for creation. No exclusions or alternative recommendations are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
paybond_submit_evidenceSubmit Harbor EvidenceA
Use this when you already have a Harbor evidence request body and recognition proof for the gateway /harbor/intents/{id}/evidence route. Do not use this for the high-level spend-control path unless you need the low-level Harbor API; prefer paybond_submit_spend_evidence.
| Name | Required | Description | Default |
|---|---|---|---|
| body | Yes | ||
| intent_id | Yes | ||
| idempotency_key | No | ||
| recognition_proof | Yes | ||
| completion_preset_id | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| state | No | |
| intent_id | No | |
| evidence_id | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate this is a write operation (readOnlyHint=false) and not destructive (destructiveHint=false). The description adds context about the specific route and that it's a low-level API call, which helps set expectations about behavior without contradicting annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no wasted words. Front-loads the use case and immediately provides a negative case with alternative. Efficient and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers when to use and the alternative, but given the complexity (5 parameters, nested objects, output schema exists), it lacks detailed guidance on the structure of body and recognition_proof. The output schema mitigates some completeness concerns, but parameter-level gaps remain.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must compensate, but it only mentions 'body' and 'recognition_proof' generically without detailing the other three parameters (intent_id, idempotency_key, completion_preset_id). Meaningful parameter semantics are largely missing, leaving agents to guess the purpose of nested objects.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool submits Harbor evidence to a specific API route. It identifies the required inputs (request body and recognition proof) and distinguishes it from the sibling paybond_submit_spend_evidence by naming the low-level vs high-level context.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly tells when to use (when you have the evidence body and proof for the specific route) and when not to use (for high-level spend-control path). Directly names the alternative tool (paybond_submit_spend_evidence), providing clear guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
paybond_submit_sandbox_guardrail_evidenceSubmit Sandbox Guardrail EvidenceA
Use this when a sandbox guardrail intent needs evidence to complete simulator settlement or predicate checks. Do not use this for live Harbor spend evidence; use paybond_submit_spend_evidence for production spend intents.
| Name | Required | Description | Default |
|---|---|---|---|
| payload | No | ||
| metadata | No | ||
| artifacts | No | ||
| intent_id | Yes | Sandbox guardrail intent UUID. | |
| operation | No | Optional operation override for the evidence record. | |
| idempotency_key | No | ||
| completion_preset_id | No | ||
| requested_spend_cents | No | Optional sandbox spend amount override for the evidence record. |
Output Schema
| Name | Required | Description |
|---|---|---|
| intent_id | Yes | |
| operation | Yes | |
| tenant_id | Yes | |
| payload_digest | No | |
| predicate_passed | No | |
| requested_spend_cents | Yes | |
| sandbox_lifecycle_status | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations provide basic traits (readOnlyHint=false, openWorldHint=true). Description adds context of simulator usage but no additional behavioral info beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with purpose and exclusion, no extraneous information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 8 parameters, low schema coverage, and minimal description, the tool definition is incomplete for correct invocation despite output schema existence.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is low (38%) and description does not explain any parameter beyond the general 'evidence' concept, failing to add meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clear verb 'submit' and resource 'evidence' for sandbox guardrail intents, distinguishing from sibling paybond_submit_spend_evidence.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use (sandbox guardrail) and when not (live Harbor spend), naming alternative tool paybond_submit_spend_evidence.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
paybond_submit_spend_evidenceSubmit Spend EvidenceA
Use this when a Paybond spend intent needs signed evidence so release, refund, review, and receipt generation use the same audit-ready record. Do not use this to create or fund intents, and do not use it for sandbox guardrail evidence.
| Name | Required | Description | Default |
|---|---|---|---|
| body | Yes | ||
| intent_id | Yes | ||
| idempotency_key | No | ||
| recognition_proof | Yes | ||
| completion_preset_id | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| state | No | |
| intent_id | No | |
| evidence_id | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate non-read-only and non-destructive, and the description adds useful behavioral context: the evidence is signed and used for release, refund, review, and receipt generation, implying an audit trail. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description consists of two concise sentences. The first sentence efficiently states the tool's purpose and context, and the second provides clear exclusions. No superfluous content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having an output schema, the tool has 0% schema description coverage for its 5 parameters, including nested objects. The description does not explain what the parameters represent or how they relate to the audit-ready record, leaving significant gaps for an agent to correctly invoke the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description provides no explanation of parameters (e.g., intent_id, body, recognition_proof). It fails to add meaning beyond the JSON schema, leaving the agent uninformed about parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: submitting signed evidence for a Paybond spend intent to ensure audit-ready records for release, refund, review, and receipt generation. It distinguishes from sibling tools like paybond_submit_evidence and paybond_submit_sandbox_guardrail_evidence by specifying 'spend evidence' and excluding sandbox guardrail evidence.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says when to use ('when a Paybond spend intent needs signed evidence') and when not to use ('Do not use this to create or fund intents, and do not use it for sandbox guardrail evidence'), directly addressing usage context and alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
paybond_validate_completion_evidenceValidate Completion EvidenceARead-only
Pre-validates vendor and canonical completion evidence against catalog JSON Schemas and preset forbidden_evidence_fields. Required before evidence submit tools when PAYBOND_MCP_EVIDENCE_POLICY=strict. Harbor remains authoritative at submit time.
| Name | Required | Description | Default |
|---|---|---|---|
| preset_id | Yes | ||
| vendor_payload | No | ||
| canonical_payload | No | ||
| frozen_vendor_api_version | No | ||
| frozen_vendor_schema_digest_hex | No | ||
| frozen_canonical_schema_digest_hex | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| preset_id | Yes | |
| pack_stale | No | |
| drift_kinds | No | |
| vendor_schema_ok | No | |
| canonical_schema_ok | No | |
| quality_fields_missing | No | |
| forbidden_fields_present | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true. Description adds workflow context: pre-validation, strict policy requirement, and that Harbor is authoritative at submit time. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, no waste. First sentence defines purpose, second adds condition, third clarifies authority. Efficient and front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 6 parameters and output schema, description explains the tool's role clearly. Does not detail parameters or output, but output schema exists. Could mention parameter purpose briefly, but overall sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%. Description does not explain any parameter meaning or usage. Parameter names like preset_id and payloads are somewhat self-explanatory, but the description fails to add value beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it pre-validates evidence against JSON schemas and forbidden fields, distinguishing it from sibling submit tools. The verb 'pre-validates' and resource 'completion evidence' are specific.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
States it is required before evidence submit tools when PAYBOND_MCP_EVIDENCE_POLICY=strict, giving clear usage context. Notes that Harbor is authoritative at submit time, implying preliminary nature, but no explicit exclusions or alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
paybond_verify_agent_mandate_v1Verify Agent MandateARead-only
Verify a signed AgentMandateV1 envelope through the gateway v2 protocol surface.
| Name | Required | Description | Default |
|---|---|---|---|
| signed_mandate | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| valid | No | |
| mandate_digest_sha256_hex | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations provide readOnlyHint=true and openWorldHint=false, indicating a safe read operation. The description adds context about the gateway v2 protocol surface, which gives behavioral insight beyond the annotations. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that efficiently conveys the tool's purpose without unnecessary words. It is well-structured and front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
While the description covers the basic purpose and protocol, it lacks completeness by not explaining what 'verify' entails (e.g., signature validation, authority checks) or how this tool relates to other verify tools. The presence of an output schema reduces the need for return value details, but more context on the verification process would be beneficial.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage for the single parameter 'signed_mandate'. The description does not elaborate on its structure or requirements beyond the name, failing to compensate for the low coverage. Expected details about the envelope format are absent.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool verifies a signed AgentMandateV1 envelope, specifying the protocol surface (gateway v2). This provides a specific verb-resource pair and distinguishes it from siblings like import_agent_mandate_v1 and other verify tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not provide guidance on when to use this tool versus alternatives, such as when to verify a mandate versus importing or other verification operations. No exclusions or contextual advice is given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
paybond_verify_agent_receipt_v1Verify Agent ReceiptARead-only
Use this when you already have a signed paybond.agent_receipt_v1 JSON object and need an offline operational-tier (default) Ed25519 signature check—schema, digest, and Gateway signature—matching resources/read on paybond://receipt/{receipt_id}. Optional validity_tier=primary|attested raises the bar (payee digest / operator attestation). Do not use this for protocol authorization/settlement receipts—call paybond_verify_protocol_receipt_v1. Continuity-chain audits, inclusion proofs, owner disclosure, and ACTA/PEF/SCITT are Kit/CLI/Gateway auditor surfaces. Read-only and side-effect free: success returns valid=true with kind, receipt_id, tenant_id, and the normalized receipt; failures raise a clear verification error.
| Name | Required | Description | Default |
|---|---|---|---|
| receipt | Yes | Complete signed paybond.agent_receipt_v1 object (not a receipt_id string). Obtain from paybond_get_agent_receipt_v1, paybond://receipt/{receipt_id}, audit export (agent_receipts/{id}.json; PEF companions may also appear as *.pef.json), or partner handoff—do not invent digests or signatures. | |
| validity_tier | No | Optional validity bar: operational (default), primary, or attested. Higher tiers are auditor-oriented; MCP handoff only requires operational. |
Output Schema
| Name | Required | Description |
|---|---|---|
| kind | No | Verified receipt kind (paybond.agent_receipt_v1). |
| valid | No | True when operational (or requested) validity checks passed. Example: true. |
| receipt | No | Normalized verified paybond.agent_receipt_v1 object. |
| tenant_id | No | Tenant id embedded in the verified receipt (not invented by the caller). |
| receipt_id | No | Canonical receipt identifier from the verified receipt. |
| validity_tier | No | Requested validity tier used for this verify (operational, primary, or attested). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses that the tool is read-only and side-effect free, and details what success returns (valid=true with kind, receipt_id, tenant_id, normalized receipt) and failure behavior (clear verification error). This goes beyond the annotations which only indicate readOnlyHint=true.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and efficient, front-loading the core use case, providing clear exclusions, and then adding behavioral details. Every sentence adds necessary information without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the presence of an output schema and the complexity of the input (nested object), the description sufficiently covers the tool's behavior: it explains what the tool does, when to use it, and what to expect from success and failure. No gaps remain.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Although schema coverage is 100%, the description adds value by specifying that the receipt parameter must be a complete signed object (not a string) and how to obtain it. The validity_tier parameter's description clarifies the context for each tier (operational, primary, attested) and advises that MCP handoff only requires operational.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: verifying a signed paybond.agent_receipt_v1 JSON object via an offline Ed25519 signature check. It distinguishes itself from the sibling tool paybond_verify_protocol_receipt_v1 by explicitly stating not to use it for protocol authorization/settlement receipts.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit guidance on when to use this tool (when you have a signed agent receipt) and when not to (for protocol receipts, directing to paybond_verify_protocol_receipt_v1). It also mentions that other audit surfaces are covered elsewhere.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
paybond_verify_agent_recognition_proof_v1Verify Agent Recognition ProofARead-only
Verify a replay-safe AgentRecognitionProofV1 against an expected purpose and request envelope. Verifier context (tenant_id, verifier_id) is derived from the authenticated MCP session only.
| Name | Required | Description | Default |
|---|---|---|---|
| proof | Yes | ||
| expected_purpose | Yes | ||
| expected_request | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| proof | No | |
| valid | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations provide readOnlyHint=true, which matches the verification nature. The description adds 'replay-safe' and context derivation, but overall behavioral detail beyond annotations is minimal. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two brief sentences that front-load the core action and key constraints. Every word contributes information with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having an output schema and complex parameters, the description is sparse. It does not explain return values, proof structure, or edge cases, leaving gaps for an AI agent to correctly invoke the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It mentions 'expected purpose and request envelope' linking to two parameters, but provides no details on the 'proof' parameter, which is a complex object. The description adds limited meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Verify' and the resource 'AgentRecognitionProofV1', specifying the action and the object. It distinguishes the tool from siblings by naming a specific proof type and including 'expected purpose and request envelope', which is unique among the sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context (authenticated MCP session) but does not explicitly state when to use or avoid this tool. No alternatives or exclusions are mentioned, leaving the agent to infer usage from the sibling tool names.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
paybond_verify_capabilityVerify Paybond CapabilityA
Use this when you need raw capability-token verification for one tenant-bound Harbor intent. Do not use this to create, fund, or modify intents; use paybond_authorize_agent_spend as the clearer gate before side-effecting agent tools.
| Name | Required | Description | Default |
|---|---|---|---|
| token | No | Optional capability token override. When omitted, the MCP server uses the token stored for intent_id. | |
| intent_id | Yes | Canonical Harbor intent UUID. | |
| operation | Yes | Delegated operation or tool name. | |
| requested_spend_cents | No | Optional requested spend in cents for this tool call. |
Output Schema
| Name | Required | Description |
|---|---|---|
| allow | No | Whether the requested operation is allowed. |
| tenant | Yes | Tenant echoed by the gateway. |
| message | No | Human-readable decision message when present. |
| audit_id | No | Gateway audit identifier when available. |
| intent_id | Yes | Verified Harbor intent UUID. |
| decision_id | No | Persisted spend decision identifier when authorization creates one. |
| reason_codes | No | Stable spend-policy reason codes from the authorization decision. |
| remaining_cents | No | Remaining spend budget in cents for the evaluated scope, when available. |
| approval_request_id | No | Approval request identifier when human approval is required. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description implies a read-only verification, but annotations have readOnlyHint=false, creating a contradiction. No additional behavioral traits are disclosed beyond the schema/annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences that convey purpose, usage guidelines, and exclusions without any fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the output schema exists and the tool is relatively simple (4 params, no enums), the description covers the key aspects. However, the behavioral contradiction and lack of return value explanation slightly reduce completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% (all parameters have descriptions). The tool description adds no extra parameter meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool is for 'raw capability-token verification for one tenant-bound Harbor intent', distinguishing it from siblings like paybond_authorize_agent_spend which is a 'clearer gate before side-effecting agent tools'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly tells when to use (capability-token verification) and when not to use (creating, funding, modifying intents), and points to an alternative tool (paybond_authorize_agent_spend).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
paybond_verify_protocol_receipt_v1Verify Protocol ReceiptARead-only
Use this when you already have a signed protocol-v2 authorization or settlement receipt JSON object and need offline Ed25519 verification (structure, message digest, and signature) through the gateway. Do not use this to verify AgentMandateV1 envelopes—call paybond_verify_agent_mandate_v1—or to check a Harbor capability token before spend—call paybond_verify_capability or paybond_authorize_agent_spend. To load a settlement receipt by intent UUID first, call paybond_get_settlement_receipt_v1 then pass its body here. Read-only and side-effect free: success returns valid=true with kind, receipt_id, tenant_id, and the normalized receipt; unsupported kind, malformed JSON, digest mismatch, or bad signature fail with a gateway error (typically HTTP 400).
| Name | Required | Description | Default |
|---|---|---|---|
| receipt | Yes | Complete signed protocol receipt object posted as the verify request body (not a receipt_id string). Discriminate on kind: paybond.protocol_authorization_receipt_v1 requires schema_version=1, receipt_version="1", receipt_id, issued_at, status (authorized), intent_id, tenant_id, verifier_id, transport_binding, mandate_digest_sha256_hex, imported_mandate_signing_public_key_ed25519_hex, authorization, agent, allowed_actions, allowed_tools, spend_ceiling, settlement, constraint, expires_at, nonce, human_presence_mode, plus signing_algorithm=ed25519-sha256-json-v1, message_digest_sha256_hex, signing_public_key_ed25519_hex, and ed25519_signature_hex. paybond.protocol_settlement_receipt_v1 requires schema_version=1, receipt_version="1", receipt_id, issued_at, intent_id, tenant_id, verifier_id, transport_binding, authorization_receipt_id, mandate_digest_sha256_hex, harbor_state, settlement_rail, settlement_mode, principal_did, payee_did, currency, amount_cents, terminal_observed_at, optional predicate_passed, and the same Ed25519 signing fields. Obtain receipts from mandate import, paybond_get_settlement_receipt_v1, audit export, or partner handoff—do not invent digests or signatures. |
Output Schema
| Name | Required | Description |
|---|---|---|
| kind | No | Verified receipt kind echoed from the normalized receipt. One of paybond.protocol_authorization_receipt_v1 or paybond.protocol_settlement_receipt_v1. |
| valid | No | True when the gateway accepted the receipt structure and Ed25519 signature. Example: true. |
| receipt | No | Normalized verified receipt object matching the input kind (authorization or settlement fields plus signing material). |
| tenant_id | No | Tenant id embedded in the verified receipt (not invented by the caller). |
| receipt_id | No | Canonical receipt identifier from the verified receipt. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Describes side-effect-free read-only behavior, success output fields (valid=true, kind, receipt_id, etc.), and failure modes (unsupported kind, malformed JSON, digest mismatch, signature failure -> HTTP 400). Consistent with readOnlyHint annotation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Concise, front-loaded with purpose and usage. Each sentence adds necessary information without redundancy. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (1 nested parameter, output schema exists), the description covers usage, behavior, failure modes, and sourcing of inputs. Complete for an agent to decide on invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema already provides detailed descriptions for the receipt parameter, including required fields for each kind. The description adds value by explaining where receipts come from and warning not to invent digests/signatures.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the tool verifies a signed protocol-v2 authorization or settlement receipt (offline Ed25519 verification). Distinguishes from siblings like paybond_verify_agent_mandate_v1 and paybond_verify_capability.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly tells when to use (already have signed receipt) and when not to (identifies alternative tools for other verification tasks). Also provides a workflow hint about calling paybond_get_settlement_receipt_v1 first.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
8 tool updates
- Added
paybond_authorize_agent_spend - Added
paybond_bootstrap_sandbox_guardrail - Added
paybond_explain_policy - Added
paybond_get_budget_remaining - Added
paybond_get_principal - Added
paybond_submit_sandbox_guardrail_evidence - Added
paybond_validate_completion_evidence - Added
paybond_verify_capability
12 tool updates
v0.12.12- Added
paybond_get_a2a_agent_card - Added
paybond_get_audit_export - Added
paybond_get_fraud_assessment - Added
paybond_get_fraud_metrics - Added
paybond_get_intent - Added
paybond_get_portfolio_summary - Added
paybond_get_reputation_receipt - Added
paybond_get_signed_portfolio_artifact - Added
paybond_list_a2a_task_contracts - Added
paybond_list_audit_exports - Added
paybond_list_intents - Removed
paybond_submit_sandbox_guardrail_evidence
4 tool updates
v0.12.12- Removed
paybond_explain_policy - Added
paybond_get_a2a_task_contract - Added
paybond_submit_sandbox_guardrail_evidence - Added
paybond_submit_spend_evidence
20 tool updates
v0.12.11- Removed
paybond_authorize_agent_spend - Removed
paybond_bootstrap_sandbox_guardrail - Removed
paybond_get_a2a_agent_card - Removed
paybond_get_a2a_task_contract - Removed
paybond_get_audit_export - Removed
paybond_get_budget_remaining - Removed
paybond_get_fraud_assessment - Removed
paybond_get_fraud_metrics - Removed
paybond_get_intent - Removed
paybond_get_portfolio_summary - Removed
paybond_get_principal - Removed
paybond_get_reputation_receipt - Removed
paybond_get_signed_portfolio_artifact - Removed
paybond_list_a2a_task_contracts - Removed
paybond_list_audit_exports - Removed
paybond_list_intents - Removed
paybond_submit_sandbox_guardrail_evidence - Removed
paybond_submit_spend_evidence - Removed
paybond_validate_completion_evidence - Removed
paybond_verify_capability
2 tool updates
v0.12.7- Added
paybond_get_agent_receipt_v1 - Added
paybond_verify_agent_receipt_v1
2 tool updates
v0.12.5- Changed
paybond_get_principal5 fields changed- added
Output schema / properties / roles / descriptionAdded value: +"RBAC roles granted to this principal for the authenticated tenant (example: [\"operator\"])." - added
Output schema / properties / roles / examplesAdded value: +[ + [ + "operator" + ] +] - added
Output schema / properties / subject / descriptionAdded value: +"Service-account subject identifier echoed by the gateway for the authenticated API key (example: service-account-1)." - added
Output schema / properties / subject / examplesAdded value: +[ + "service-account-1" +] - added
Output schema / properties / tenant_id / examplesAdded value: +[ + "tenant-a" +]
- Changed
paybond_get_signed_portfolio_artifact9 fields changed- added
Input schema / properties / score_version / descriptionAdded value: +"Optional Signal score model version to query. Omit to use the gateway default current model (1.0). Example: 1.0." - added
Input schema / properties / score_version / examplesAdded value: +[ + "1.0" +] - added
Output schema / properties / checkpoint_last_ledger_seq / descriptionAdded value: +"Last ledger sequence included in the tenant Signal checkpoint for this artifact." - added
Output schema / properties / kind / descriptionAdded value: +"Artifact kind identifier (currently paybond.signal.portfolio_snapshot)." - added
Output schema / properties / kind / examplesAdded value: +[ + "paybond.signal.portfolio_snapshot" +] - added
Output schema / properties / score_model_versionAdded value: +{ + "description": "Score model version used for the artifact (echoes the requested score_version or the gateway default 1.0).", + "examples": [ + "1.0" + ], + "type": "string" +} - added
Output schema / properties / signature_hex / descriptionAdded value: +"Ed25519 signature hex over the canonical portfolio artifact payload." - added
Output schema / properties / tenant_id / descriptionAdded value: +"Tenant echoed by the gateway for the authenticated API key (example: tenant-a). Never invent tenant identifiers." - added
Output schema / properties / tenant_id / examplesAdded value: +[ + "tenant-a" +]
9 tool updates
v0.1.1- Changed
paybond_authorize_agent_spend5 fields changed- added
Output schema / properties / approval_request_idAdded value: +{ + "description": "Approval request identifier when human approval is required.", + "type": "string" +} - added
Output schema / properties / decision_idAdded value: +{ + "description": "Persisted spend decision identifier when authorization creates one.", + "type": "string" +} - added
Output schema / properties / messageAdded value: +{ + "description": "Human-readable decision message when present.", + "type": "string" +} - added
Output schema / properties / reason_codesAdded value: +{ + "description": "Stable spend-policy reason codes from the authorization decision.", + "items": { + "type": "string" + }, + "type": "array" +} - added
Output schema / properties / remaining_centsAdded value: +{ + "description": "Remaining spend budget in cents for the evaluated scope, when available.", + "type": "integer" +}
- Added
paybond_explain_policy - Added
paybond_get_budget_remaining - Changed
paybond_get_fraud_assessment10 fields changed- added
Input schema / properties / operator_did / descriptionAdded value: +"Tenant-scoped operator DID to assess. Must belong to the authenticated tenant; do not invent tenant identifiers. Examples: did:web:vendor.example#booker-agent, did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK." - added
Input schema / properties / operator_did / examplesAdded value: +[ + "did:web:vendor.example#booker-agent", + "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK" +] - added
Input schema / properties / score_version / descriptionAdded value: +"Optional Signal score model version to query. Omit to use the gateway default current model. Example: 1.0." - added
Input schema / properties / score_version / examplesAdded value: +[ + "1.0" +] - added
Output schema / properties / fraud_assessment / descriptionAdded value: +"Compact fraud assessment for the operator (level, severity, signal counts, summary). Example shape: {\"level\":\"high\",\"highest_severity\":\"high\",\"signal_count\":1,\"summary\":\"level=high\"}." - added
Output schema / properties / fraud_assessment / examplesAdded value: +[ + { + "highest_severity": "high", + "level": "high", + "signal_count": 1, + "summary": "level=high" + } +] - added
Output schema / properties / operator_did / descriptionAdded value: +"Operator DID echoed from the assessment response (example: did:web:vendor.example#booker-agent)." - added
Output schema / properties / operator_did / examplesAdded value: +[ + "did:web:vendor.example#booker-agent" +] - added
Output schema / properties / tenant_id / descriptionAdded value: +"Tenant echoed by the gateway for the authenticated API key (example: tenant-a)." - added
Output schema / properties / tenant_id / examplesAdded value: +[ + "tenant-a" +]
- Changed
paybond_get_fraud_metrics20 fields changed- added
Input schema / properties / score_version / descriptionAdded value: +"Optional Signal score model version to query. Omit to use the gateway default current model (1.0). Example: 1.0." - added
Input schema / properties / score_version / examplesAdded value: +[ + "1.0" +] - added
Input schema / properties / window / descriptionAdded value: +"Rolling metrics window. Allowed values: 24h, 7d, 30d. Omit to use the gateway default 24h. Unsupported values fail with HTTP 400." - added
Input schema / properties / window / examplesAdded value: +[ + "24h", + "7d", + "30d" +] - added
Output schema / properties / backtest_summaryAdded value: +{ + "description": "Human-readable backtest summary derived from the window metrics.", + "type": "string" +} - added
Output schema / properties / confirmed_risk_countAdded value: +{ + "description": "Labeled confirmed-risk outcomes in the window.", + "type": "integer" +} - added
Output schema / properties / critical_signal_count / descriptionAdded value: +"Count of critical-severity fraud signals in the window." - added
Output schema / properties / elevated_signal_countAdded value: +{ + "description": "Count of elevated-severity fraud signals in the window.", + "type": "integer" +} - added
Output schema / properties / false_positive_countAdded value: +{ + "description": "Labeled false-positive outcomes in the window.", + "type": "integer" +} - added
Output schema / properties / flagged_operator_count / descriptionAdded value: +"Operators with at least one fraud signal in the window." - added
Output schema / properties / high_signal_countAdded value: +{ + "description": "Count of high-severity fraud signals in the window.", + "type": "integer" +} - added
Output schema / properties / labeled_outcome_countAdded value: +{ + "description": "Review outcomes labeled in the window (confirmed risk, false positive, or needs more evidence).", + "type": "integer" +} - added
Output schema / properties / review_open_countAdded value: +{ + "description": "Operators currently in an open review state.", + "type": "integer" +} - added
Output schema / properties / score_model_versionAdded value: +{ + "description": "Score model version used for the metrics (echoes the requested score_version or the gateway default 1.0).", + "examples": [ + "1.0" + ], + "type": "string" +} - added
Output schema / properties / tenant_id / descriptionAdded value: +"Tenant echoed by the gateway for the authenticated API key (example: tenant-a)." - added
Output schema / properties / tenant_id / examplesAdded value: +[ + "tenant-a" +] - added
Output schema / properties / window / descriptionAdded value: +"Active metrics window label: 24h, 7d, or 30d." - added
Output schema / properties / window / examplesAdded value: +[ + "24h", + "7d", + "30d" +] - added
Output schema / properties / window_ended_atAdded value: +{ + "description": "RFC3339 end of the evaluated rolling window.", + "type": "string" +} - added
Output schema / properties / window_started_atAdded value: +{ + "description": "RFC3339 start of the evaluated rolling window.", + "type": "string" +}
- Changed
paybond_get_portfolio_summary15 fields changed- added
Input schema / properties / score_version / descriptionAdded value: +"Optional Signal score model version to query. Omit to use the gateway default current model (1.0). Example: 1.0." - added
Input schema / properties / score_version / examplesAdded value: +[ + "1.0" +] - added
Output schema / properties / average_scoreAdded value: +{ + "description": "Average operator score across the tenant portfolio for this score model version.", + "type": "number" +} - added
Output schema / properties / checkpoint_last_ledger_seqAdded value: +{ + "description": "Last ledger sequence included in the tenant Signal checkpoint.", + "type": "integer" +} - added
Output schema / properties / operator_countAdded value: +{ + "description": "Number of operators with reputation data for this score model version.", + "type": "integer" +} - removed
Output schema / properties / operatorsRemoved value: -{ - "items": { - "additionalProperties": true, - "type": "object" - }, - "type": "array" -} - added
Output schema / properties / operators_under_reviewAdded value: +{ + "description": "Count of operators currently under Signal review for this score model version.", + "type": "integer" +} - added
Output schema / properties / schema_versionAdded value: +{ + "description": "Portfolio summary schema version (currently 1).", + "type": "integer" +} - added
Output schema / properties / score_model_version / descriptionAdded value: +"Score model version used for the aggregate (echoes the requested score_version or the gateway default 1.0)." - added
Output schema / properties / score_model_version / examplesAdded value: +[ + "1.0" +] - added
Output schema / properties / scoring_modelAdded value: +{ + "description": "Scoring model identifier used by Signal for this summary.", + "type": "string" +} - added
Output schema / properties / tenant_id / descriptionAdded value: +"Tenant echoed by the gateway for the authenticated API key (example: tenant-a)." - added
Output schema / properties / tenant_id / examplesAdded value: +[ + "tenant-a" +] - added
Output schema / properties / total_receipted_volume_centsAdded value: +{ + "description": "Aggregate receipted settlement volume in cents across the portfolio.", + "type": "integer" +} - added
Output schema / properties / total_terminal_intentsAdded value: +{ + "description": "Aggregate terminal Harbor intents across operators in the portfolio.", + "type": "integer" +}
- Changed
paybond_get_reputation_receipt10 fields changed- added
Input schema / properties / operator_did / descriptionAdded value: +"Tenant-scoped operator DID whose signed Signal reputation receipt to fetch. Must belong to the authenticated tenant; do not invent tenant identifiers. Examples: did:web:vendor.example#booker-agent, did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK." - added
Input schema / properties / operator_did / examplesAdded value: +[ + "did:web:vendor.example#booker-agent", + "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK" +] - added
Input schema / properties / score_version / descriptionAdded value: +"Optional Signal score model version to query. Omit to use the gateway default current model (1.0). Example: 1.0." - added
Input schema / properties / score_version / examplesAdded value: +[ + "1.0" +] - removed
Output schema / properties / operator_didRemoved value: -{ - "type": "string" -} - added
Output schema / properties / receiptAdded value: +{ + "additionalProperties": true, + "description": "Signed Signal receipt for the operator (tenant_id, operator_did, score_version, score, metrics, reason_codes, signing_algorithm, message_digest_hex, signing_public_key_hex, signature_hex).", + "examples": [ + { + "operator_did": "did:web:vendor.example#booker-agent", + "score": 812, + "score_version": "1.0", + "signature_hex": "abababababababababababababababababababababababababababababababab", + "tenant_id": "tenant-a" + } + ], + "type": "object" +} - added
Output schema / properties / schema_versionAdded value: +{ + "description": "Reputation receipt envelope schema version.", + "type": "integer" +} - removed
Output schema / properties / signature_hexRemoved value: -{ - "type": "string" -} - removed
Output schema / properties / tenant_idRemoved value: -{ - "type": "string" -} - added
Output schema / properties / updated_atAdded value: +{ + "description": "RFC3339 timestamp when the stored receipt row was last updated.", + "type": "string" +}
- Changed
paybond_verify_capability5 fields changed- added
Output schema / properties / approval_request_idAdded value: +{ + "description": "Approval request identifier when human approval is required.", + "type": "string" +} - added
Output schema / properties / decision_idAdded value: +{ + "description": "Persisted spend decision identifier when authorization creates one.", + "type": "string" +} - added
Output schema / properties / messageAdded value: +{ + "description": "Human-readable decision message when present.", + "type": "string" +} - added
Output schema / properties / reason_codesAdded value: +{ + "description": "Stable spend-policy reason codes from the authorization decision.", + "items": { + "type": "string" + }, + "type": "array" +} - added
Output schema / properties / remaining_centsAdded value: +{ + "description": "Remaining spend budget in cents for the evaluated scope, when available.", + "type": "integer" +}
- Changed
paybond_verify_protocol_receipt_v18 fields changed- added
Input schema / properties / receipt / descriptionAdded value: +"Complete signed protocol receipt object posted as the verify request body (not a receipt_id string). Discriminate on kind: paybond.protocol_authorization_receipt_v1 requires schema_version=1, receipt_version=\"1\", receipt_id, issued_at, status (authorized), intent_id, tenant_id, verifier_id, transport_binding, mandate_digest_sha256_hex, imported_mandate_signing_public_key_ed25519_hex, authorization, agent, allowed_actions, allowed_tools, spend_ceiling, settlement, constraint, expires_at, nonce, human_presence_mode, plus signing_algorithm=ed25519-sha256-json-v1, message_digest_sha256_hex, signing_public_key_ed25519_hex, and ed25519_signature_hex. paybond.protocol_settlement_receipt_v1 requires schema_version=1, receipt_version=\"1\", receipt_id, issued_at, intent_id, tenant_id, verifier_id, transport_binding, authorization_receipt_id, mandate_digest_sha256_hex, harbor_state, settlement_rail, settlement_mode, principal_did, payee_did, currency, amount_cents, terminal_observed_at, optional predicate_passed, and the same Ed25519 signing fields. Obtain receipts from mandate import, paybond_get_settlement_receipt_v1, audit export, or partner handoff—do not invent digests or signatures." - added
Output schema / properties / kindAdded value: +{ + "description": "Verified receipt kind echoed from the normalized receipt. One of paybond.protocol_authorization_receipt_v1 or paybond.protocol_settlement_receipt_v1.", + "examples": [ + "paybond.protocol_authorization_receipt_v1", + "paybond.protocol_settlement_receipt_v1" + ], + "type": "string" +} - added
Output schema / properties / receiptAdded value: +{ + "additionalProperties": true, + "description": "Normalized verified receipt object matching the input kind (authorization or settlement fields plus signing material).", + "type": "object" +} - added
Output schema / properties / receipt_id / descriptionAdded value: +"Canonical receipt identifier from the verified receipt." - added
Output schema / properties / receipt_id / examplesAdded value: +[ + "550e8400-e29b-41d4-a716-446655440000" +] - added
Output schema / properties / tenant_idAdded value: +{ + "description": "Tenant id embedded in the verified receipt (not invented by the caller).", + "examples": [ + "acme-pilot" + ], + "type": "string" +} - added
Output schema / properties / valid / descriptionAdded value: +"True when the gateway accepted the receipt structure and Ed25519 signature. Example: true." - added
Output schema / properties / valid / examplesAdded value: +[ + true +]
TDQS
Each tool has a clearly distinct purpose with detailed descriptions that prevent ambiguity. For example, paybond_get_fraud_assessment vs paybond_get_fraud_metrics vs paybond_get_reputation_receipt vs paybond_get_signed_portfolio_artifact are all well-differentiated. Overlaps are explicitly warned against in descriptions.
All tools follow the consistent pattern 'paybond_verb_noun' in snake_case, with clear verb-object pairings (e.g., create_intent, get_fraud_assessment, verify_capability). Minor variations like 'a2a_agent_card' are still interpretable and follow the same convention.
The 29 tools cover a complex domain (spend intents, Harbor escrow, fraud analytics, portfolio, evidence, verification, A2A). While on the high side, each tool has a specific role and is justified by the detailed descriptions. A few could possibly be merged, but the count is reasonable for the scope.
The tool set covers core workflows: create/authorize/submit/verify for spend intents, fraud assessment, portfolio, and evidence. Minor gaps exist, such as no update or delete operations for intents, but the primary lifecycle (create, authorize, submit evidence, verify) is well-covered.
Maintenance
Related MCP Connectors
MCP server for Boson Protocol — on-chain agentic commerce for physical & digital goods.
Agent-commerce MCP server for x402/USDC payments and affiliate splits on Base.
MCP server for Modern Treasury — payment orders, transactions, counterparties and ledgers.
MCP server for mandates, delegation, policy-gated execution, credential grants, and audit.
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceMCP server for AgentPay — the payment gateway for autonomous AI agents. Fund a wallet once, give your agent the key, and it discovers, provisions, and pays for tool APIs on its own. One key, every tool.1121MIT
- AlicenseAqualityCmaintenanceMCP server for l402-kit — enables AI agents (Claude, Cursor, etc.) to autonomously pay Bitcoin Lightning-protected APIs. Tools: l402_fetch, l402_balance, l402_spending_report. Run with: npx l402-kit-mcp4303MIT
- AlicenseNot gradedqualityAmaintenanceMCP server for Pact, an escrow protocol for agent-to-agent commerce, enabling agents to create pacts, fund escrow, deliver work, and settle with an LLM evaluator as dispute backstop.17MIT
- AlicenseNot gradedqualityBmaintenanceMCP server that enables AI agents to propose USDC payments on the Soroban blockchain with deterministic policy enforcement and injection protection, while providing payment status and attestation tools.MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/nonameuserd/paybond-kit'
If you have feedback or need assistance with the MCP directory API, please join our Discord server