dev.verimand/mcp-authority-server
Verimand MCP Authority Server
MCP exposes capability. VAGP governs authority.
The Verimand MCP Authority Server gives MCP-compatible clients agent-native access to verifiable VAGP authority. It exposes a small stdio tool surface for asking whether a trusted registered agent currently has authority, inspecting trusted authority state, and verifying VAGP execution permits.
Tool availability does not itself grant authority. This server is not yet the enforcement gateway for protected tool execution.
Package identity
npm package:
@verimand/mcp-authority-serverMCP Registry server name:
dev.verimand/mcp-authority-serverCurrent version:
0.1.0Runtime: Node.js 22 or newer
MCP SDK/runtime:
@modelcontextprotocol/server2.0.0, implementing the MCP 2026-07-28 spec with stdio legacy compatibility
Related MCP server: vantic-mcp
Tools
verimand.resolveresolves whether a trusted registered agent is authorized for an action and returns a VAGP execution permit only when authority is confirmed.verimand.explainexplains deterministic authority decision or permit-derived data. It is informational only.verimand.get_authorityreturns bounded authority relevant to an agent/action.verimand.get_mandateretrieves server-side trusted mandate metadata.verimand.get_agent_dnareturns server-side trusted Agent DNA state and fingerprint information.verimand.verify_permitverifies a VAGP execution permit against current authority evidence.
Install and start
A local MCP client can start the published server with:
npx -y @verimand/mcp-authority-server@0.1.0When running from this public repository:
npm ci
node dist/stdio.jsThe process speaks MCP over stdio. stdout is reserved for MCP protocol messages; diagnostics go to stderr.
MCP client configuration example
{
"mcpServers": {
"verimand-authority": {
"command": "npx",
"args": ["-y", "@verimand/mcp-authority-server@0.1.0"]
}
}
}Do not place secrets, mandates, Agent DNA, revocation state or trusted context in agent-controlled MCP tool arguments. Production Verimand connection material must be supplied by the operator-controlled server environment, not by the agent using the MCP client.
First resolve example
{
"name": "verimand.resolve",
"arguments": {
"agentId": "agent:demo-support",
"action": "ticket.read",
"resourceId": "ticket:123",
"requestId": "req-demo-1"
}
}Expected structured content contains a deterministic authority decision, reason codes, selected mandate/path data and a permit only when VAGP resolves AUTHORITY_CONFIRMED.
Security and trust boundary
All MCP input is untrusted. The server accepts only small closed tool arguments and maps them to server-side trusted VAGP state. An MCP caller cannot self-declare trusted identity, Agent DNA, mandates, attestations, revocation state or trusted context.
The MCP server delegates authority semantics to VAGP 0.3 authority services. It does not execute protected business actions and does not replace an enforcement gateway. Protected tool execution remains outside this package.
VAGP relationship
VAGP 0.3 is the public authority protocol: https://github.com/verimand/vagp. This MCP server is a Verimand interface for authority inspection and permit verification over MCP.
Distribution status
Version 0.1.0 is publicly available on npm and in the MCP Registry. The Verimand VAGP authority runtime required by this MCP server is bundled into dist/stdio.js; the installed package has no runtime dependency on unpublished @verimand/* workspace packages. The initial npm release was bootstrap-published without provenance. Future releases are configured for GitHub OIDC trusted staged publishing; this does not retroactively add provenance to 0.1.0.
Development validation
From a clean clone, with Node.js 22 or newer:
npm ci
npm run build
npm test
npm run smoke:stdioThe public repository contains the audited bundled distribution, not the private TypeScript build source. Here npm run build checks the committed bundle's syntax and presence; it does not rebuild the bundle from source. The node:test suite starts the bundle over stdio, exercises all six public tools, checks a bounded permit and fail-closed cases, and verifies restart. The npm tarball remains restricted to the six published distribution files.
Support and security reporting
Report security issues to verimand.dev@gmail.com.
Available Tools
6 toolsverimand.explainExplain VAGP decisionARead-only
Explain a deterministic VAGP authority decision or permit. Informational only; it cannot create or modify authority.
| Name | Required | Description | Default |
|---|---|---|---|
| permit | No | ||
| decision | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnlyHint=true and destructiveHint=false, but the description adds the 'deterministic' nature of the decision and reiterates that it cannot create or modify authority, providing context beyond the structured annotations. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences, with the core action and resource in the first sentence and a clarifying limitation in the second. No wasted words, and the key constraint is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and zero parameter coverage, the description should provide enough context for correct invocation. It explains the purpose but omits parameter semantics and return value expectations, leaving critical gaps for a tool with two flexible object inputs.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for the two undocumented object parameters. It vaguely mentions 'decision or permit' but does not clarify which parameter maps to which concept or how they relate. This leaves the agent guessing about how to populate the parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Explain) and resource (VAGP authority decision or permit). It clearly distinguishes from siblings like resolve or verify by focusing on explanation, and explicitly notes it is informational only, which separates it from mutation-capable tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage by saying it is informational only and cannot create or modify authority, but it does not explicitly name alternatives or conditions for choosing this tool over siblings. There is no 'when to use' guidance beyond that hint.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verimand.get_agent_dnaGet trusted Agent DNABRead-only
Return trusted Agent DNA state and fingerprint information from server-side trusted state. Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
| agentId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotation already declares readOnlyHint and destructiveHint, and the description redundantly says 'Read-only'. It adds the context that data comes from 'server-side trusted state', which is mildly informative. However, it doesn't disclose any other traits like required permissions, error behavior, or what happens if agentId is invalid.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence plus 'Read-only', which is concise and front-loaded with the primary function. No unnecessary information is included.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter read-only tool, the description is adequate but leaves gaps: no output schema means the return format is unspecified, and the term 'Agent DNA' is not explained. Given the lack of usage guidance and parameter clarification, the description is minimally complete but not thorough.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has no description for agentId, and the tool description also fails to explain what agentId represents or how it should be formatted. With 0% schema description coverage, the description needed to compensate but did not, leaving the parameter ambiguous.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb ('Return') and a specific resource ('trusted Agent DNA state and fingerprint information'), distinguishing it from generic operations. However, it doesn't explicitly differentiate from siblings like get_authority or get_mandate, and 'Agent DNA' is not defined in context.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus its siblings. It only states what it does and that it's read-only, without mentioning conditions, alternatives, or exclusions. The agent must infer usage from the title and resource name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verimand.get_authorityGet bounded authorityCRead-only
Return current bounded authority relevant to a trusted registered agent/action. Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
| action | No | ||
| agentId | Yes | ||
| resourceId | No | ||
| evaluationTime | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and destructiveHint false, and the description reinforces this with 'Read-only.' It adds a small behavioral detail: the authority is 'current' and 'bounded', which gives more context than the annotations alone. However, it does not disclose auth requirements, error behavior, or what 'bounded' means in practice.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short and front-loads the main function. The only redundancy is 'Read-only', which repeats the annotation, but it is harmless and does not bloat the description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With four parameters, no output schema, and sibling tools in a specialized authorization domain, the description is too sparse. It does not explain return shape, the meaning of evaluationTime, or how this tool relates to get_mandate and verify_permit, so an agent may struggle to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries the burden of explaining parameters. It only loosely references 'agent/action', aligning with agentId and action, but says nothing about resourceId or evaluationTime, leaving much of the input semantics unexplained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a clear verb and resource ('Return current bounded authority') and adds a scoping context ('relevant to a trusted registered agent/action'). It does not explicitly differentiate from siblings like get_mandate, but the core purpose is understandable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given for when to use this tool versus alternatives such as get_mandate, explain, or verify_permit. The only contextual hint is 'trusted registered agent/action', which implies a condition but never states it as a usage rule.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verimand.get_mandateGet mandateBRead-only
Retrieve server-side trusted mandate information. Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
| agentId | No | ||
| mandateId | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare readOnlyHint=true and destructiveHint=false, and the description's 'Read-only' line merely repeats that annotation. It adds only minimal context ('server-side trusted'), but does not contradict any annotation and the safety profile is already fully covered.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no filler or redundancy. Every word contributes to the basic purpose or safety framing.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only tool with two self-explanatory parameters, the description is minimally adequate. However, without an output schema or any mention of return shape or edge cases, an agent has limited information about what to expect after invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description needed to explain what agentId and mandateId mean and whether one or both are required. It does not mention either parameter or their relationship, leaving the agent to infer from names alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Retrieve') and resource ('server-side trusted mandate information'), making the core purpose clear. It does not explicitly distinguish itself from sibling tools like get_authority or get_agent_dna, but the resource name is specific enough to be understood.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance about when to use get_mandate versus siblings such as resolve, explain, or verify_permit. The description only states what the tool does, not the conditions that should lead an agent to select it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verimand.resolveResolve VAGP authorityC
Determine whether a trusted registered agent is currently authorized for a specific action. Calling this tool does not execute the protected action.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | ||
| agentId | Yes | ||
| requestId | No | ||
| resourceId | Yes | ||
| evaluationTime | No | ||
| parametersDigest | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description explicitly states that calling this tool does not execute the protected action, which implies a read-only behavior. However, the annotations include readOnlyHint: false, which indicates the tool is not read-only per the annotation. This is a direct contradiction. The description also fails to disclose any other behavioral traits, such as side effects or state changes. The contradiction alone necessitates a score of 1, as per the rules.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, consisting of two sentences with no redundant words. It front-loads the core purpose and adds a safety note. However, it is under-specified for a tool with six parameters and no other documentation. The brevity is acceptable, but it sacrifices necessary detail. It is neither bloated nor elegantly structured; it is simply short.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is drastically incomplete for a tool with six parameters, three required, and no output schema. It provides no information about return values, parameter formats, possible error conditions, or how to construct inputs. The sibling set includes tools that seem related (e.g., verify_permit), yet the description does not clarify the distinction. Additionally, the contradiction with annotations further undermines completeness. The agent would have to rely entirely on parameter names and guesswork.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With a schema description coverage of 0%, the description carries the full burden of explaining the six parameters. Yet it mentions none of them—no explanation of agentId, action, resourceId, requestId, evaluationTime, or parametersDigest. It provides zero semantic context for any parameter, leaving the agent to guess from names alone. This is a significant gap in a tool with three required parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool's purpose: determining whether an agent is currently authorized for a specific action. It uses a specific verb ('Determine') and resource ('authorization'), and the phrase 'does not execute the protected action' adds context. However, it does not explicitly differentiate from sibling tools like verimand.verify_permit or verimand.get_authority, which might have overlapping roles. The clarity is good but lacks a comparative note.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool (when you need to know if an agent is authorized), but it offers no explicit guidance on when not to use it or how it differs from alternatives. It does not mention any prerequisites, contexts, or exclusions. It barely hints that calling this tool is safe (non-executing), which is a mild usage hint, but there is no direct comparison to sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verimand.verify_permitVerify VAGP execution permitB
Verify an existing VAGP execution permit against current authority evidence. Does not execute protected actions.
| Name | Required | Description | Default |
|---|---|---|---|
| permit | Yes | ||
| evaluationTime | No | ||
| idempotencyKey | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=false, so the description cannot rely on the tool being read-only. The explicit statement that it does not execute protected actions adds useful behavioral context, but it does not disclose verification failure behavior, return values, or any side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, with the main purpose front-loaded and a valuable clarification second. Every word earns its place; there is no padding or repetition of the title.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With high parameter complexity (nested required object), zero schema descriptions, no output schema, and sparse annotations, the description is too thin to be complete. It omits permit shape, time semantics, idempotency behavior, and sibling routing, so an agent would need external knowledge to call this tool confidently.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description names no parameters. The required nested 'permit' object has no documented structure, and evaluationTime and idempotencyKey are not explained anywhere, leaving the agent without enough information to construct valid input.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb-resource pair (verify an existing VAGP execution permit) and adds scope ('against current authority evidence'), with a clear negative ('does not execute protected actions'). It does not explicitly contrast itself with siblings such as resolve or explain, so it falls just short of full differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The intended use is implied: call this when you need to check an existing permit rather than perform the protected action. However, there are no explicit when-to-use/when-not-to-use conditions and no mention of alternative sibling tools, so an agent must infer the decision boundary.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
6 tool updates
v0.1.0- First observed
verimand.explain - First observed
verimand.get_agent_dna - First observed
verimand.get_authority - First observed
verimand.get_mandate - First observed
verimand.resolve - First observed
verimand.verify_permit
TDQS
Scored across 6 tools
Each tool has a clearly distinct purpose: resolve checks authorization, explain provides reasoning, get_authority retrieves current bounded authority, get_mandate retrieves mandate info, get_agent_dna retrieves agent state, and verify_permit validates a specific permit. There is minimal overlap; even resolve and verify_permit differ in that resolve is action-based while verify_permit is permit-based, and descriptions make this explicit.
All tool names follow a consistent pattern: lowercase snake_case, starting with a verb (resolve, explain, get_*, verify_*). The get_* prefix is used for all read operations, and verify_* for validation. This consistency makes the tool set predictable and easy to navigate.
With 6 tools, the server is well-scoped for a read-only authority and permit service. Each tool addresses a distinct aspect of authority/verification without redundancy, and the count is within the ideal range for focused MCP servers.
The tool surface covers the core operations for querying authority: resolve, explain, get_authority, get_mandate, get_agent_dna, and verify_permit. It is read-only by design, so no create/update/delete tools are expected. The only minor gap is a lack of a list-type tool to enumerate all authorities or mandates, but this is not critical for the stated purpose.
Maintenance
Related MCP Connectors
Issue Agent Passports and verify agent authority before value moves. Signed verification records.
Discover Agents and MCP capabilities with versions, permissions, and real-work trust context.
Give AI agents identity, scoped access, trusted context, and verifiable actions through MCP.
Remote MCP for A2A caller identity, scope policy, verdict receipts, and audit history.
Related MCP Servers
- AlicenseNot gradedqualityFmaintenanceEnables verification of AI agent identity, authority, and integrity at transaction time, returning signed verdicts for allow, step-up, review, or block.MIT

vantic-mcpofficial
AlicenseNot gradedqualityBmaintenanceEnables MCP hosts to verify agent spending mandates and receipts, providing stateless tools for authorization, chain verification, credential verification, and DID resolution.Apache 2.0- AlicenseAqualityBmaintenanceA neutral authority layer for agent runtimes, providing sovereign verification and vault-governed custody tools via MCP.459 npm1Apache 2.0
- AlicenseNot gradedqualityBmaintenanceEnables governed MCP agent tool invocation with policy-based authorization, short-lived credentials, and audited access control.3 npmMIT