Every change Wellknown observed on this MCP server, newest first, with what it was before and what it became. Tool-surface changes carry the definition diff. Nothing here is edited after the fact.
Changed the definition of "ledger_start"
⟨159 unchanged words⟩ no human and buys 24h of Pro (unlimitedagentagentsallowance per the live pass tier — see /pricing.md).
Changed the definition of "ledger_start"
⟨159 unchanged words⟩ no human and buys 24h of Pro (unlimitedagentagentsallowance per the live pass tier — see /pricing.md).
Added "ledger_wait_events"; changed the definition of "ledger_api_docs" (17 tools before, 18 now)
⟨18 unchanged words⟩ \"errors\" | \"idempotency\" | \"metering\" | \"events\" | \"all\"\n (default \"\" == \" ⟨14 unchanged words⟩
Wait for Agent Events — Long-poll an agent's event feed — how an agent with no public URL receives alerts. Webhooks (POST /v1/webhooks) push events to a URL you own; an agent on stdio MCP cannot host one, so it waits here instead. Call this in a loop: the call holds open up to `timeout` seconds (max 30) and returns when events arrive or the wait lapses. `consumer_id` names this consumer durably — pick a stable one (e.g. "claude-code-main") and reuse it. Each call returns a `cursor`; pass it back on your next call once you have processed that batch — that is the ack. To get restart redelivery, also pass `client_ins…
Added "ledger_wait_events"; changed the definition of "ledger_api_docs" (17 tools before, 18 now)
⟨18 unchanged words⟩ \"errors\" | \"idempotency\" | \"metering\" | \"events\" | \"all\"\n (default \"\" == \" ⟨14 unchanged words⟩
Wait for Agent Events — Long-poll an agent's event feed — how an agent with no public URL receives alerts. Webhooks (POST /v1/webhooks) push events to a URL you own; an agent on stdio MCP cannot host one, so it waits here instead. Call this in a loop: the call holds open up to `timeout` seconds (max 30) and returns when events arrive or the wait lapses. `consumer_id` names this consumer durably — pick a stable one (e.g. "claude-code-main") and reuse it. Each call returns a `cursor`; pass it back on your next call once you have processed that batch — that is the ack. To get restart redelivery, also pass `client_ins…
Changed the definition of "ledger_set_budget"
⟨71 unchanged words⟩ limit). Overwrites any existing budget for theagent.agent — with one rule: raising or removing an existing cap requires the workspace_key. An agent_secret can tighten its own caps but never loosen them; to grow an allowance the agent asks its owner (see ledger_request_approval). Claiming abrand-newbrand-new agent_id requires your workspace_key; that first call mints ⟨23 unchanged words⟩
Changed the definition of "ledger_set_budget"
⟨71 unchanged words⟩ limit). Overwrites any existing budget for theagent.agent — with one rule: raising or removing an existing cap requires the workspace_key. An agent_secret can tighten its own caps but never loosen them; to grow an allowance the agent asks its owner (see ledger_request_approval). Claiming abrand-newbrand-new agent_id requires your workspace_key; that first call mints ⟨23 unchanged words⟩
Added "ledger_approval_decide", "ledger_approvals" and "ledger_request_approval" (14 tools before, 17 now)
Approve or Deny a Spend Request — Approve or deny a pending spend permit — workspace owner only. The agent's own agent_secret can REQUEST an approval but can never decide one: a credential that can approve its own requests is not a control. decision must be 'approve' or 'deny'; only pending permits can be decided. An approved permit is consumed by the agent's next ledger_track within its amount — it is a one-shot exception, not a raised cap.
List Spend Approvals — List spend-approval permits — yours, or your whole workspace's.
Request Spend Approval — Ask your workspace owner for a one-shot spend exception before a ledger_track that the cap would refuse. Creates a pending permit for exactly amount_cents on the given service. The owner (a human, or a supervisor agent holding the workspace_key) approves or denies it with ledger_approval_decide. An APPROVED permit is consumed by the next ledger_track for this agent whose amount fits inside it — the budget cap itself does not change. Permits expire after 1 hour undecided. Poll with ledger_approvals to see the decision. Claiming a brand-new agent_id requires workspace_key; otherwise pass the …
Added "ledger_approval_decide", "ledger_approvals" and "ledger_request_approval" (14 tools before, 17 now)
Approve or Deny a Spend Request — Approve or deny a pending spend permit — workspace owner only. The agent's own agent_secret can REQUEST an approval but can never decide one: a credential that can approve its own requests is not a control. decision must be 'approve' or 'deny'; only pending permits can be decided. An approved permit is consumed by the agent's next ledger_track within its amount — it is a one-shot exception, not a raised cap.
List Spend Approvals — List spend-approval permits — yours, or your whole workspace's.
Request Spend Approval — Ask your workspace owner for a one-shot spend exception before a ledger_track that the cap would refuse. Creates a pending permit for exactly amount_cents on the given service. The owner (a human, or a supervisor agent holding the workspace_key) approves or denies it with ledger_approval_decide. An APPROVED permit is consumed by the next ledger_track for this agent whose amount fits inside it — the budget cap itself does not change. Permits expire after 1 hour undecided. Poll with ledger_approvals to see the decision. Claiming a brand-new agent_id requires workspace_key; otherwise pass the …
Changed the definition of "ledger_track"
⟨100 unchanged words⟩ monthly/daily cap is blocked, not just logged. Caps here bind the AMOUNT YOU REPORT — a caller that lies to amount_cents lies to the cap. The only enforcement against real spend is routing the provider call through the /proxy/{provider} rail, which prices from the provider's own usage block. Include tokens_in/tokens_out + model on every LLM call ⟨9 unchanged words⟩
Changed the definition of "ledger_track"
⟨100 unchanged words⟩ monthly/daily cap is blocked, not just logged. Caps here bind the AMOUNT YOU REPORT — a caller that lies to amount_cents lies to the cap. The only enforcement against real spend is routing the provider call through the /proxy/{provider} rail, which prices from the provider's own usage block. Include tokens_in/tokens_out + model on every LLM call ⟨9 unchanged words⟩
Recently observed → Live
Live → Recently observed
Certificate changed, valid to 2026-12-26
Added "ledger_price" and "ledger_proxy_attach"; removed "ledger_list_agents" (13 tools before, 14 now)
Price a Call Before You Make It — What will this call cost? Priced from the same table the caps use. Exists because ledger_track requires the CALLER to supply amount_cents, so an agent whose spend is capped could under-report its own cost and stay under the cap. This returns the number the enforcement path would use, so an agent can report honestly (and plan before it spends). Cost = (tokens_in * in_rate + tokens_out * out_rate) / 1_000_000. If the model has cache rates, the standard in-rate is used, which is the conservative direction for a spend cap. Every price carries the source it came from and the date it was read, a…
Attach the Budget-Enforcing Proxy — Point your provider traffic at the proxy so budget caps are enforced BEFORE the provider is contacted, instead of being reported afterwards. This closes the gap where the brake was unreachable from MCP: an agent connected over MCP could record spend (ledger_track) but nothing could refuse a call. With this, the cap is enforced on every LLM call. Returns the base_url to use, the two headers to send, and the exact change for the OpenAI and Anthropic SDKs. Your provider credential is NOT part of this: it stays in Authorization / x-api-key and is only forwarded, never stored.
List Tracked Agents — Owner-only: full cross-tenant listing of every agent ever claimed on this instance, with totals. Requires the operator's admin_secret — this is a portfolio-wide view, not a per-agent report (use ledger_report for that — it requires that agent's agent_secret or its workspace_key).
Added "ledger_price" and "ledger_proxy_attach"; removed "ledger_list_agents" (13 tools before, 14 now)
Price a Call Before You Make It — What will this call cost? Priced from the same table the caps use. Exists because ledger_track requires the CALLER to supply amount_cents, so an agent whose spend is capped could under-report its own cost and stay under the cap. This returns the number the enforcement path would use, so an agent can report honestly (and plan before it spends). Cost = (tokens_in * in_rate + tokens_out * out_rate) / 1_000_000. If the model has cache rates, the standard in-rate is used, which is the conservative direction for a spend cap. Every price carries the source it came from and the date it was read, a…
Attach the Budget-Enforcing Proxy — Point your provider traffic at the proxy so budget caps are enforced BEFORE the provider is contacted, instead of being reported afterwards. This closes the gap where the brake was unreachable from MCP: an agent connected over MCP could record spend (ledger_track) but nothing could refuse a call. With this, the cap is enforced on every LLM call. Returns the base_url to use, the two headers to send, and the exact change for the OpenAI and Anthropic SDKs. Your provider credential is NOT part of this: it stays in Authorization / x-api-key and is only forwarded, never stored.
List Tracked Agents — Owner-only: full cross-tenant listing of every agent ever claimed on this instance, with totals. Requires the operator's admin_secret — this is a portfolio-wide view, not a per-agent report (use ledger_report for that — it requires that agent's agent_secret or its workspace_key).
Added "ledger_check_spend" (12 tools before, 13 now)
Check Before Spending — Ask BEFORE you spend: may this agent spend this much right now? Returns allowed (true/false), a stable reason code (within_budget, over_monthly_cap, over_daily_cap, over_monthly_token_cap, over_daily_token_cap, no_budget_set, unpriced_model), a one-line message, the cost estimate, the price used (with its source and as_of date) and every budget window with cap, spent and remaining. Same decision the /proxy/{provider} gate enforces. Read-only: nothing is recorded or reserved, so record the spend with ledger_track afterwards. Give exactly one spend shape: amount_cents (any rail, e.g. an x402…
Added "ledger_check_spend" (12 tools before, 13 now)
Check Before Spending — Ask BEFORE you spend: may this agent spend this much right now? Returns allowed (true/false), a stable reason code (within_budget, over_monthly_cap, over_daily_cap, over_monthly_token_cap, over_daily_token_cap, no_budget_set, unpriced_model), a one-line message, the cost estimate, the price used (with its source and as_of date) and every budget window with cap, spent and remaining. Same decision the /proxy/{provider} gate enforces. Read-only: nothing is recorded or reserved, so record the spend with ledger_track afterwards. Give exactly one spend shape: amount_cents (any rail, e.g. an x402…
Added "ledger_start" (11 tools before, 12 now)
Start a Workspace — Get a FREE AgentLedger workspace with no credential and no arguments — the MCP equivalent of opening POST /start in a browser. Call this FIRST if you have no credentials yet. Every other tool here (ledger_track, ledger_set_budget, ledger_report, ledger_alerts) needs a workspace_key or an agent_secret, so a caller arriving with neither must start here or it has nowhere to go. Takes NO arguments on purpose: the goal is zero friction. It returns a `workspace_key` (shown exactly once — it cannot be re-revealed, so store it before continuing) which you then send as `workspace_key` on your first …
Added "ledger_start" (11 tools before, 12 now)
Start a Workspace — Get a FREE AgentLedger workspace with no credential and no arguments — the MCP equivalent of opening POST /start in a browser. Call this FIRST if you have no credentials yet. Every other tool here (ledger_track, ledger_set_budget, ledger_report, ledger_alerts) needs a workspace_key or an agent_secret, so a caller arriving with neither must start here or it has nowhere to go. Takes NO arguments on purpose: the goal is zero friction. It returns a `workspace_key` (shown exactly once — it cannot be re-revealed, so store it before continuing) which you then send as `workspace_key` on your first …
Certificate recorded, valid to 2026-12-12
Authorization not required
Certificate recorded, valid to 2026-10-27
Authorization not required
Added "read_skill" and "skills_list_tool" (9 tools before, 11 now)
Read Skill — Read a product skill file by its skill:// URI.
Skills List Tool — List this product's skills. Each entry carries the SKILL.md URI, its name and description, verbatim frontmatter, and a per-file sha256 manifest. Read a body with `read_skill`.
Added "read_skill" and "skills_list_tool" (9 tools before, 11 now)
Read Skill — Read a product skill file by its skill:// URI.
Skills List Tool — List this product's skills. Each entry carries the SKILL.md URI, its name and description, verbatim frontmatter, and a per-file sha256 manifest. Read a body with `read_skill`.
First tool surface recorded: 9 tools (server version 4.0.3)
https://aiagentscity.com/mcp (mcp_streamable_http) — from mcp_registry
Added "ledger_revoke_secret" and "ledger_rotate_secret" (7 tools before, 9 now)
Revoke Agent Secret — Invalidate an agent_id's agent_secret WITHOUT deleting its spend history. Use when a credential may have leaked, or to stop an agent writing. Subsequent writes to that agent fail with agent_secret_mismatch until you rotate a new secret in. The agent_id stays claimed, so no other workspace can claim it and inherit the ledger. Requires the workspace_key that owns agent_id. Returns {"agent_id", "revoked": True, "_note"}, or {"error", "error_code"}.
Rotate Agent Secret — Mint a NEW agent_secret for an agent_id your workspace already owns, invalidating the old one. Use this to RECOVER an agent whose secret was lost: the previous credential stops working immediately. Requires the workspace_key that owns agent_id — an agent's own agent_secret cannot rotate itself, because a leaked agent credential must not be able to lock its real owner out. Unlike ledger_track this never claims a new agent_id: an unknown id returns agent_not_claimed. The new secret is returned ONCE. Store it before you drop the response. Returns {"agent_id", "agent_secret", "_note"}, or {"er…
First tool surface recorded: 7 tools (server version 4.0.3)
Showing the latest 29 events. The API returns up to 500 and filters by kind: ?kind=tool_surface_changed