Every change Wellknown observed on this MCP server, newest first, with what it was before and what it became. Tool-surface changes carry the definition diff. Nothing here is edited after the fact.
Added "check_egress", "gate_decision" and "run_exit_drill"; changed the definition of "audit_my_agent_inventory", "mint_action_receipt", "mint_receipt_for_record_change" and 1 more (4 tools before, 7 now)
Rank a CALLER-PROVIDED list of MCP tools by worst-regret if they act,with(a name-based heuristic that weights asignedname's first word most). Read-only: it mints no receipt. Cannot auto-discover the inventory -- MCP does ⟨9 unchanged words⟩
Mint apost-quantumsigned receipt (Ed25519, plus ML-DSA-65 when the post-quantum backend is available) for an arbitrary consequential agent action. Optional attestation: triggered_by_type (human/agent/script), triggered_by_source (api/cli/cron), decision_model (the LLM model used). Attestation values are caller claims: allowlisted to safe characters, signed, not verified. Decisions that contain a gate verdict word are reserved for gate_decision.
⟨11 unchanged words⟩ ":"Decision","type":"string"},"decision_model":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Decision Model"},"inputs":{"anyOf":[{"type":"string ⟨21 unchanged words⟩ :{"title":"Target","type":"string"},"triggered_by_source":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Triggered By Source"},"triggered_by_type":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Triggered By Type"}},"required":["agent_id","operation" ⟨5 unchanged words⟩
Mint apost-quantumsigned receipt (Ed25519, plus ML-DSA-65 when the post-quantum backend is available) for one CRM record change. Old/new values are ⟨13 unchanged words⟩
Verify a Trust Gate receipt from the certificate alone (offline).require_pq=Trueok=true means unchanged since signing, signed, kid consistent with the embedded key, and (defaultrequire_pqviadefaultOAO_REQUIRE_PQon)FAILSatifleast one post-quantum leg verified; unsigned receipts fail. It does not prove who signed: pass expected_kid to pin theML-DSA-65signer'sorEd25519SLH-DSAkey;legsaarepin
Egress classification check. Scans a data sample for a finite list of sensitivity markers and classifies as NO_MARKERS_FOUND / INTERNAL / CONFIDENTIAL / RESTRICTED. RESTRICTED sets blocked=true; this tool cannot block anything itself, and NO_MARKERS_FOUND is not clearance to send. Returns classification, retention info, and a tamper-evident receipt.
Two-phase decision gate with a real verdict. PREVIEW returns ALLOW, DENY or ESCALATE with the risk tier and reasons, plus a preview_id, without acting. COMMIT re-evaluates the same inputs and mints a signed receipt for the verdict. Only ALLOW returns a GRANTED permit; DENY returns DENIED; ESCALATE returns WITHHELD_PENDING_HUMAN and a human must decide outside this tool. Applies only to actions the caller routes through it: it does not observe or block what an agent does. Verb-tier heuristic on the action name and resource, not a proof. Stateless. Optional attestation: triggered_by_type, trigg…
Vendor exit readiness drill. Checks local signing key, local model access (Ollama). Returns step-by-step results and a tamper-evident receipt. Informational; it signs one receipt, which creates the signing key on a host that has none yet.
Certificate changed, valid to 2026-12-20
Certificate recorded, valid to 2026-10-22
Authorization not required
First tool surface recorded: 4 tools (server version 1.28.0)
Showing the latest 5 events. The API returns up to 500 and filters by kind: ?kind=tool_surface_changed
{"properties":{"expected_kid":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"title":"Expected Kid"},"receipt":{"additionalProperties":true,"title":"Receipt ⟨19 unchanged words⟩