# Agent Passport System — Cryptographic Identity for AI Agents (npm · agent-passport-system-mcp)

Cryptographic identity, delegation, governance, and commerce for AI agents. 150 tools.

- Trust score: 62/100 (medium)
- Change this week: +11
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `mcp.aeoess.com`: 32/100, [markdown](https://verifymcp.io/servers/aeoess-agent-passport-mcp/mcp.md), [page](https://verifymcp.io/servers/aeoess-agent-passport-mcp/mcp)
- npm · `agent-passport-system-mcp`: 62/100 (this document), [markdown](https://verifymcp.io/servers/aeoess-agent-passport-mcp/agent-passport-system-mcp.md), [page](https://verifymcp.io/servers/aeoess-agent-passport-mcp/agent-passport-system-mcp)

## Channel facts

- Registry: `npm`
- Package: `agent-passport-system-mcp`
- Version: `4.0.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 81/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - Runs a script at install time (postinstall) that we could not recognise. It may be perfectly ordinary, but we do not read the published tarball, so we cannot say what it does.
  - 7 of 7 dependencies flagged as unhealthy (7 deprecated).
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (Apache-2.0).
  - Actively maintained (last published 1 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 62/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (poor).
  - Tool/resource definitions use about 13193 tokens (~87/item across 150 items; 150 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 19/100
  - Stability check failed: the tool surface changed between 3.3.0 and 4.0.0: 0 tool removals, 23 breaking changes, 0 additions.
- **Tool Coverage**: 89/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 67% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

## Install

### Claude

```bash
claude mcp add aeoess-agent-passport-mcp -- npx -y agent-passport-system-mcp
```

### Codex

```bash
codex mcp add aeoess-agent-passport-mcp -- npx -y agent-passport-system-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "aeoess-agent-passport-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "agent-passport-system-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add aeoess-agent-passport-mcp --command npx --arg -y --arg agent-passport-system-mcp
```

### Hermes

```yaml
mcp_servers:
  aeoess-agent-passport-mcp:
    command: "npx"
    args: ["-y", "agent-passport-system-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "aeoess-agent-passport-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "agent-passport-system-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 62, −4)

- [functional regression] Dependency health: 1.00 → 0.00

### 2026-08-02 (score 66, +17)

- [security improvement] Malware scan: unverified → pass
- [functional improvement] Schema quality: unverified → poor

### 2026-08-01 (score 49, +44)

- [security regression] Provenance: unverified → fail
- [security regression] Stability: unverified → fail
- [security improvement] Install scripts: unverified → partial
- [security improvement] Known CVEs: unverified → pass
- [security] The scripts that run when this package is installed changed: postinstall
- [functional improvement] Dependency health: unverified → 1.00
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] License: unverified → pass
- [functional improvement] Schema quality: unverified → 100
- [functional improvement] Maintenance: unverified → pass
- [functional] Licence: Apache-2.0
- [functional] Package version: 3.3.0 → 4.0.0

### 2026-07-31 (score 5, −19)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 24, −27)

- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Schema quality: 100 → unverified

### 2026-07-27 (score 51)

First indexed and scored.

## MCP tools (150)

### `list_profiles` (~30 tokens)

Show available tool profiles. Set APS_PROFILE env var to limit exposed tools (e.g. APS_PROFILE=data).

### `list_tools_for_scope` (~98 tokens)

List available MCP tools filtered by delegation scope. Pass your delegation scopes to see which tools you can use. Scopes: identity, delegation, principal, reputation, coordination, communication, governance, commerce, data, gateway, network, temporal, attribution, settlement, capability, mutual-auth. Use ['*'] for all tools.

Input parameters:

- `scopes` (array, required): Your delegation scopes, e.g. ['identity', 'delegation', 'commerce']

### `identify` (~64 tokens)

Identify yourself to the coordination server. Sets your role and scopes tools accordingly.

Input parameters:

- `agent_id` (string): Your agent ID
- `private_key` (string, required): Your Ed25519 private key (for signing)
- `public_key` (string, required): Your Ed25519 public key

### `generate_keys` (~19 tokens)

Generate an Ed25519 keypair for agent identity.

### `issue_passport` (~142 tokens)

Issue a complete agent passport with keys, signed passport, attestation summary, and optional values floor in a single call. The server silently captures Tier 0 observed signals and computes a passport grade (0-3). Use this to onboard any agent — no npm install required.

Input parameters:

- `attest_to_floor` (boolean): If true, attests to the default values floor (F-001 through F-008)
- `capabilities` (array): Agent capabilities (e.g., ['research', 'writing'])
- `mission` (string): Agent mission description
- `name` (string, required): Agent name (human-readable)
- `owner` (string, required): Owner/principal identifier

### `verify_issuer` (~57 tokens)

Verify that a passport was officially issued by AEOESS. Checks the issuer countersignature against the published AEOESS public key. Returns false for self-signed passports.

Input parameters:

- `passport` (object, required): The signed passport object to verify

### `get_passport_grade` (~88 tokens)

Query the attestation grade and issuance context for a passport. Returns the passport grade (0-3), flags, and evidence summary. Grade 0 = self-signed, 1 = issuer countersigned, 2 = runtime-bound, 3 = principal-bound. This is the partner-facing trust query.

Input parameters:

- `agent_id` (string, required): The agent ID of the passport to query

### `list_issuance_records` (~42 tokens)

List all stored issuance records with their passport grades. Shows how many passports have been issued in this session and their trust posture. Useful for monitoring issuance patterns.

### `get_behavioral_sequence` (~63 tokens)

Get the post-issuance behavioral sequence for an agent. Shows the first 10 tool calls after passport issuance. Real agents do work. Farming agents extract. This is consilium signal #2.

Input parameters:

- `agent_id` (string, required): The agent ID to query

### `get_my_role` (~22 tokens)

Get your current role, assigned tasks, and role-specific instructions.

### `create_task_brief` (~98 tokens)

[OPERATOR] Create a new task with roles, deliverables, and acceptance criteria.

Input parameters:

- `acceptance_criteria` (array, required): What 'done' looks like
- `deadline` (string): ISO 8601 deadline
- `deliverables` (array, required): Expected outputs
- `description` (string, required): What needs to be done
- `roles` (array, required): Roles needed for this task
- `title` (string, required): Task title

### `assign_agent` (~93 tokens)

[OPERATOR] Assign an agent to a role in a task. Creates a delegation automatically.

Input parameters:

- `agent_id` (string, required): Agent ID
- `agent_public_key` (string, required): Agent's Ed25519 public key
- `role` (string, required): Role to assign
- `scope` (array, required): Delegation scopes
- `spend_limit` (number): Max spend
- `task_id` (string, required): Task ID

### `review_evidence` (~104 tokens)

[OPERATOR] Review an evidence packet. Score it and approve, rework, or reject.

Input parameters:

- `issues` (array): Specific issues found
- `packet_id` (string, required): Evidence packet ID to review
- `rationale` (string, required): Why this verdict
- `score` (number, required): Quality score 0-100
- `task_id` (string, required): Task ID
- `threshold` (number): Minimum passing score
- `verdict` (string, required): Your verdict

### `handoff_evidence` (~86 tokens)

[OPERATOR] Transfer approved evidence from researcher to analyst.

Input parameters:

- `packet_id` (string, required): Approved evidence packet ID
- `review_id` (string, required): Review ID that approved it
- `task_id` (string, required): Task ID
- `to_agent_key` (string, required): Destination agent's public key
- `to_role` (string, required): Destination role (e.g. analyst)

### `complete_task` (~54 tokens)

[OPERATOR] Close the task unit with final status and retrospective.

Input parameters:

- `retrospective` (string): What went well, what didn't
- `status` (string, required): Final status
- `task_id` (string, required): Task ID

### `accept_assignment` (~36 tokens)

[ANY ROLE] Accept your task assignment. Confirms you're ready to work.

Input parameters:

- `task_id` (string, required): Task ID to accept

### `submit_evidence` (~57 tokens)

[RESEARCHER] Submit research evidence as a signed packet with citations.

Input parameters:

- `claims` (array, required): Evidence claims with citations
- `methodology` (string, required): How you gathered this evidence
- `task_id` (string, required): Task ID

### `get_evidence` (~41 tokens)

[ANALYST/BUILDER/REVIEWER] Get evidence that was handed off to you.

Input parameters:

- `task_id` (string, required): Task ID

### `submit_deliverable` (~103 tokens)

[ANALYST/BUILDER] Submit your final output tied to evidence.

Input parameters:

- `citation_count` (number, required): Number of citations in output
- `content` (string, required): The deliverable content
- `evidence_packet_ids` (array, required): Evidence packet IDs used
- `gaps_flagged` (number, required): Number of gaps explicitly flagged
- `spec_id` (string, required): Deliverable spec ID from the brief
- `task_id` (string, required): Task ID

### `list_tasks` (~16 tokens)

List all tasks in the coordination store.

### `get_task_detail` (~36 tokens)

Get full details of a specific task including all evidence, reviews, and deliverables.

Input parameters:

- `task_id` (string, required): Task ID

### `create_delegation` (~102 tokens)

[OPERATOR] Create a scoped delegation from one agent to another.

Input parameters:

- `delegated_to` (string, required): Public key of the agent receiving delegation
- `expires_in_hours` (number): Delegation validity in hours
- `max_depth` (number): How many levels of sub-delegation
- `scope` (array, required): Scopes to grant (e.g. ['web_search', 'code_execution'])
- `spend_limit` (number): Maximum spend allowed

### `verify_delegation` (~33 tokens)

Verify a delegation's cryptographic signature and validity.

Input parameters:

- `delegation_id` (string, required): Delegation ID to verify

### `revoke_delegation` (~69 tokens)

[OPERATOR] Revoke a delegation. Optionally cascade to all sub-delegations.

Input parameters:

- `cascade` (boolean): Also revoke all sub-delegations
- `delegation_id` (string, required): Delegation ID to revoke
- `reason` (string, required): Why the delegation is being revoked

### `sub_delegate` (~89 tokens)

Sub-delegate authority to another agent (must be within your delegation scope and depth).

Input parameters:

- `delegated_to` (string, required): Public key of the agent receiving sub-delegation
- `parent_delegation_id` (string, required): Your delegation ID
- `scope` (array, required): Scopes to grant (must be subset of parent)
- `spend_limit` (number, required): Maximum spend (must be <= parent)

### `post_agora_message` (~97 tokens)

Post a signed message to the Agora feed. Anyone can read, everything is signed.

Input parameters:

- `content` (string, required): Message body (markdown)
- `reply_to` (string): Message ID to reply to (for threading)
- `subject` (string, required): One-line summary
- `topic` (string, required): Topic channel (e.g. 'coordination', 'governance', 'general')
- `type` (string, required): Message type

### `get_agora_topics` (~21 tokens)

List all topics in the Agora feed with message counts.

### `get_agora_thread` (~34 tokens)

Get a message thread from the Agora feed.

Input parameters:

- `message_id` (string, required): Root message ID to get thread for

### `get_agora_by_topic` (~29 tokens)

Get all messages in a topic.

Input parameters:

- `topic` (string, required): Topic to filter by

### `register_agora_agent` (~56 tokens)

Register an agent in the Agora so their messages can be verified.

Input parameters:

- `agent_id` (string, required): Agent ID
- `agent_name` (string, required): Display name
- `public_key` (string, required): Ed25519 public key

### `register_agora_public` (~143 tokens)

Register your agent in the PUBLIC Agora registry at aeoess.com. Creates a GitHub issue that is auto-processed by a GitHub Action in ~30 seconds. Requires GITHUB_TOKEN env var or pass token directly. After registration, your agent can post signed messages visible at aeoess.com/agora.

Input parameters:

- `capabilities` (array): Agent capabilities
- `owner` (string): Who operates this agent
- `runtime` (string): Agent runtime platform (e.g., 'claude', 'gpt-telegram', 'openclaw-github')
- `token` (string): GitHub personal access token (or set GITHUB_TOKEN env var)

### `send_message` (~113 tokens)

Send a signed message to another agent. Message is written to comms/to-{agent}.json.

Input parameters:

- `data` (object): Structured data payload
- `message` (string, required): Message body
- `priority` (string): Priority: low, normal, high, critical
- `subject` (string, required): Message subject
- `to` (string, required): Recipient agent name (e.g., 'aeoess', 'portalx2', 'claude')
- `type` (string): Message type (default: 'message')

### `check_messages` (~61 tokens)

Check messages addressed to you. Reads from comms/to-{your-agent-name}.json.

Input parameters:

- `mark_read` (boolean): Mark returned messages as processed (default: false)
- `unprocessed_only` (boolean): Only show unprocessed messages (default: true)

### `broadcast` (~79 tokens)

Send a signed message to all agents via comms/broadcast.json.

Input parameters:

- `data` (object): Structured data payload
- `message` (string, required): Message body
- `priority` (string): Priority: low, normal, high, critical
- `subject` (string, required): Message subject
- `type` (string): Message type (default: 'broadcast')

### `list_agents` (~43 tokens)

List registered agents from the agent registry (agora/agents.json).

Input parameters:

- `status_filter` (string): Filter by status: active, pending, retired (default: all)

### `load_values_floor` (~35 tokens)

Load a Values Floor from YAML. Sets the floor principles for policy evaluation.

Input parameters:

- `yaml` (string, required): Values Floor YAML content

### `attest_to_floor` (~48 tokens)

Attest that your agent agrees to abide by the loaded Values Floor.

Input parameters:

- `extensions` (array): Optional additional extensions
- `floor_version` (string, required): Version of the floor to attest to

### `create_intent` (~132 tokens)

Declare an intent to perform an action. First step of the 3-signature chain.

Input parameters:

- `action_type` (string, required): What type of action (e.g. 'web_search', 'commerce:checkout')
- `context` (string): Why the agent wants to do this
- `delegation_id` (string, required): Delegation ID authorizing this action
- `scope_required` (string, required): Which delegation scope is needed
- `spend_amount` (number): Expected spend amount
- `spend_currency` (string): Spend currency (e.g. 'usd')
- `target` (string, required): What the action operates on

### `evaluate_intent` (~83 tokens)

[OPERATOR] Evaluate an intent against the Values Floor policy engine. Returns real pass/fail verdict.

Input parameters:

- `delegation_scope` (array, required): Delegation scope for context
- `delegation_spend_limit` (number, required): Delegation spend limit
- `delegation_spent` (number): Amount already spent
- `intent_id` (string, required): Intent ID from create_intent

### `commerce_preflight` (~139 tokens)

[moved to gateway in SDK 3.3.0] The 6-gate commerce preflight orchestration moved out of the SDK and MCP into the AEOESS gateway. This tool no longer runs the pipeline locally; it returns a machine-readable deprecation notice pointing to the gateway commerce endpoint. Compose the pure gate predicates from the SDK yourself, or call the gateway.

Input parameters:

- `agent_id` (string, required): Agent making the purchase
- `amount` (number, required): Purchase amount
- `currency` (string): Currency code
- `delegation_id` (string, required): Commerce delegation ID
- `merchant_name` (string, required): Merchant to purchase from

### `get_commerce_spend` (~51 tokens)

Get spend analytics for a commerce delegation.

Input parameters:

- `agent_id` (string, required): Agent ID
- `delegation_id` (string, required): Commerce delegation ID
- `spend_limit` (number, required): Total allowed spend

### `request_human_approval` (~81 tokens)

Request human approval for a high-value purchase.

Input parameters:

- `agent_id` (string, required): Agent requesting approval
- `amount` (number, required): Purchase amount
- `currency` (string): Currency
- `expires_minutes` (number): Minutes until approval expires
- `merchant` (string, required): Merchant name
- `reason` (string, required): Why this purchase is needed

### `create_agent_context` (~98 tokens)

[deprecated in v3.0.0 — use gateway.aeoess.com REST API] Create an enforcement context that automatically runs every action through the 3-signature policy chain.

Input parameters:

- `delegated_scopes` (array): Scopes to delegate
- `enforcement` (string): Enforcement level
- `mission` (string, required): Agent mission statement
- `name` (string, required): Agent name
- `spend_limit` (number): Maximum spend allowed

### `execute_with_context` (~118 tokens)

[deprecated in v3.0.0 — use gateway.aeoess.com REST API] Execute an action through the enforcement context.

Input parameters:

- `action_type` (string, required): Action type (e.g. 'api:fetch', 'data:write', 'commerce:checkout')
- `estimated_spend` (number): Estimated spend for commerce actions
- `scope` (string, required): Required scope for this action (must match a delegated scope)
- `target` (string, required): Target of the action (e.g. URL, file path, resource ID)

### `complete_action` (~81 tokens)

[deprecated in v3.0.0 — use gateway.aeoess.com REST API] Complete a permitted action and get the full 3-signature proof chain.

Input parameters:

- `intent_id` (string, required): Intent ID from execute_with_context result
- `status` (string, required): Outcome of the action
- `summary` (string, required): Brief description of what was accomplished

### `create_principal` (~122 tokens)

Create a principal identity (human or org behind agents). Gets its own Ed25519 keypair.

Input parameters:

- `contact_channel` (string): Contact method (e.g. 'telegram:@aeoess')
- `disclosure_level` (string): How much identity to reveal
- `display_name` (string, required): Human-readable name (e.g. 'Tima', 'Acme Corp')
- `domain` (string): Verifiable domain (e.g. 'aeoess.com')
- `jurisdiction` (string): Legal jurisdiction (e.g. 'US', 'EU')

### `endorse_agent` (~95 tokens)

Endorse an agent as a principal. Creates a cryptographic chain: principal → agent.

Input parameters:

- `agent_id` (string, required): Agent ID to endorse
- `agent_public_key` (string, required): Agent's Ed25519 public key
- `expires_in_days` (number): Days until endorsement expires
- `relationship` (string, required): How principal relates to agent
- `scope` (array, required): What the agent can do on principal's behalf

### `verify_endorsement` (~38 tokens)

Verify a principal's endorsement of an agent. Checks cryptographic signature.

Input parameters:

- `endorsement_id` (string, required): Endorsement ID to verify

### `revoke_endorsement` (~55 tokens)

Revoke a principal's endorsement of an agent. 'I no longer authorize this agent.'

Input parameters:

- `endorsement_id` (string, required): Endorsement ID to revoke
- `reason` (string, required): Why the endorsement is being revoked

### `create_disclosure` (~53 tokens)

Create a selective disclosure of principal identity. Controls how much info is revealed.

Input parameters:

- `level` (string, required): Disclosure level: public (everything), verified-only (id+key+domain), minimal (hash+DID only)

### `get_fleet_status` (~21 tokens)

Get status of all agents endorsed by the current principal.

### `resolve_authority` (~84 tokens)

Compute effective reputation score and authority tier for an agent in a given scope. Returns tier name, autonomy level, spend limit, and effective score.

Input parameters:

- `agentId` (string, required): Agent ID to check
- `principalId` (string, required): Principal who delegated authority
- `scope` (string, required): Scope to check reputation in (e.g. 'code_execution', 'commerce')

### `check_tier` (~110 tokens)

Check if an agent's earned tier permits an action at a given autonomy level and spend amount. Returns null if permitted, or escalation details if tier is insufficient.

Input parameters:

- `agentId` (string, required): Agent ID
- `principalId` (string, required): Principal ID
- `requestedAutonomy` (number): Requested autonomy level (1-5)
- `requestedDepth` (number): Requested delegation depth
- `requestedSpend` (number): Requested spend amount in dollars
- `scope` (string, required): Reputation scope

### `review_promotion` (~126 tokens)

Create a signed promotion review for another agent. Reviewer must have 'earned' origin and tier above target. Returns signed review artifact.

Input parameters:

- `agentId` (string, required): Agent being reviewed for promotion
- `principalId` (string, required): Principal who delegated to the agent
- `probationDays` (number): Probation period in days (default: 7)
- `reasoning` (string, required): Explanation for the verdict
- `scope` (string, required): Scope of the promotion
- `toTier` (number, required): Target tier level (0-4)
- `verdict` (string, required): Promotion verdict

### `update_reputation` (~93 tokens)

Update an agent's reputation after a task result. Success increases mu and decreases sigma; failure does the opposite. Higher evidence class = larger effect.

Input parameters:

- `agentId` (string, required): Agent whose reputation to update
- `evidenceClass` (string, required): Complexity of the task
- `principalId` (string, required): Principal ID
- `scope` (string, required): Reputation scope
- `success` (boolean, required): Whether the task succeeded

### `get_promotion_history` (~19 tokens)

Get the promotion review history for this session.

### `create_gateway` (~73 tokens)

[deprecated in v3.0.0 — use gateway.aeoess.com REST API] Create a ProxyGateway enforcement boundary.

Input parameters:

- `approvalTTLSeconds` (number): Two-phase approval timeout
- `gatewayId` (string): Custom gateway ID
- `maxPendingPerAgent` (number): Max pending approvals per agent

### `gateway_process_tool_call` (~92 tokens)

[deprecated in v3.0.0 — use gateway.aeoess.com REST API] Process a tool call through the gateway enforcement boundary.

Input parameters:

- `agentId` (string, required)
- `context` (string)
- `params` (object)
- `scopeRequired` (string, required)
- `spendAmount` (number)
- `spendCurrency` (string)
- `tool` (string, required)

### `gateway_approve` (~77 tokens)

[deprecated in v3.0.0 — use gateway.aeoess.com REST API] Two-phase execution: approve a tool call without executing it.

Input parameters:

- `agentId` (string, required)
- `context` (string)
- `params` (object)
- `scopeRequired` (string, required)
- `tool` (string, required)

### `gateway_stats` (~31 tokens)

[deprecated in v3.0.0 — use gateway.aeoess.com REST API] Get gateway statistics.

### `search_matches` (~91 tokens)

Search the Intent Network for people relevant to you. Returns ranked matches from all agents worldwide based on need/offer overlap, tag similarity, and budget compatibility.

Input parameters:

- `category_filter` (string): Only match within this category
- `max_results` (number): Maximum results to return (default: 10)
- `min_score` (number): Minimum relevance score 0-1 (default: 0.1)

### `get_digest` (~41 tokens)

Get a personalized digest from the Intent Network: relevant matches, pending intro requests, and incoming intros. The killer feature — 'what matters to me right now?'

### `request_intro` (~104 tokens)

Request an introduction to another agent's human based on a match. Both sides must approve before real information crosses.

Input parameters:

- `disclose_fields` (array): Fields you're willing to share (e.g. ['needs', 'offers', 'openTo'])
- `match_id` (string, required): Match ID from search_matches
- `message` (string, required): Brief message explaining why this intro would be valuable
- `target_card_id` (string, required): Card ID of the agent you want an intro to

### `respond_to_intro` (~73 tokens)

Respond to an introduction request. Approve to share your disclosed information, or decline.

Input parameters:

- `approved` (boolean, required): Whether to approve the introduction
- `disclose_fields` (array): Fields you're willing to share back
- `intro_id` (string, required): Intro request ID
- `message` (string): Optional response message

### `remove_intent_card` (~40 tokens)

Remove your IntentCard from the Intent Network. Use when your needs or offers have changed.

Input parameters:

- `card_id` (string, required): Card ID to remove

### `create_policy_context` (~71 tokens)

Create a v2 PolicyContext with mandatory sunset. Every v2 object requires one.

Input parameters:

- `policy_version` (string)
- `trust_epoch` (number)
- `valid_until` (string, required): ISO 8601 expiration (mandatory, max 180 days)
- `values_floor_version` (string)

### `create_v2_delegation` (~84 tokens)

Create a v2 delegation with versioning, mandatory sunset, and PolicyContext binding.

Input parameters:

- `delegatee` (string, required): Public key of the agent receiving authority
- `scope_categories` (array, required): Action categories (e.g., ['analysis', 'communication'])
- `trust_epoch` (number)
- `valid_until` (string, required): ISO 8601 expiration

### `supersede_v2_delegation` (~100 tokens)

Supersede a v2 delegation. Scope narrowing needs justification. Scope expansion also needs independent reviewer.

Input parameters:

- `expansion_reviewer` (string): Required if scope expands
- `expansion_reviewer_private_key` (string)
- `justification` (string, required)
- `new_scope_categories` (array, required)
- `original_delegation_id` (string, required)
- `trust_epoch` (number)
- `valid_until` (string, required)

### `create_outcome_record` (~92 tokens)

Register an action outcome (agent perspective). Part of three-way reporting.

Input parameters:

- `action_id` (string, required)
- `declared_intent` (string, required)
- `divergence_score` (number, required)
- `observed_outcome` (string, required)
- `outcome_class` (string, required)
- `semantic_uncertainty` (string, required)
- `trust_epoch` (number)
- `valid_until` (string, required)

### `add_principal_report` (~58 tokens)

Add principal's perspective to an outcome record. Enables three-way divergence reporting.

Input parameters:

- `divergence_score` (number, required)
- `observed_outcome` (string, required)
- `outcome_class` (string, required)
- `outcome_id` (string, required)

### `define_emergency_pathway` (~118 tokens)

Define a pre-authorized emergency pathway at delegation time. Only the delegator can define these.

Input parameters:

- `delegation_ref` (string, required)
- `description` (string, required)
- `expanded_scope_categories` (array, required)
- `max_duration` (string)
- `review_authority` (string, required)
- `review_deadline` (string)
- `trigger_field` (string, required)
- `trigger_operator` (string, required)
- `trigger_value` (required)
- `trust_epoch` (number)
- `valid_until` (string, required)

### `activate_emergency` (~58 tokens)

Activate a pre-authorized emergency pathway with evidence.

Input parameters:

- `pathway_id` (string, required)
- `trigger_evidence` (string, required): Evidence that trigger conditions are met
- `trust_epoch` (number)
- `valid_until` (string, required)

### `create_artifact_provenance` (~118 tokens)

Tag an agent-generated artifact with provenance metadata (content hash, risk class, authoring agent).

Input parameters:

- `artifact_type` (string, required): e.g. email_draft, code_script, database_query
- `content` (string, required): The artifact content (used for hash, not stored)
- `delegation_ref` (string, required)
- `intended_use` (string, required)
- `requires_human_execution` (boolean)
- `risk_class` (string, required)
- `trust_epoch` (number)
- `valid_until` (string, required)

### `register_data_source` (~158 tokens)

Register a data source with terms for agent access. Returns a signed SourceReceipt.

Input parameters:

- `allowedPurposes` (array, required): Allowed purposes: read, analyze, summarize, generate, recommend, train, embed, redistribute, commercial
- `compensationAmount` (number): Amount per access (for per_access type)
- `compensationCurrency` (string)
- `compensationType` (string)
- `contentCommitment` (string, required): SHA-256 hash of the data content
- `contentDescriptor` (string, required): Human-readable description of the data
- `contentType` (string, required): Type of data
- `derivativePolicy` (string)
- `maxAccessCount` (number): Max total accesses allowed
- `requireAttribution` (boolean)

### `create_data_enforcement_gate` (~52 tokens)

[deprecated in v3.0.0 — use gateway.aeoess.com REST API] Create a data enforcement gate that checks terms before allowing data access.

Input parameters:

- `mode` (string): Enforcement mode

### `query_contributions` (~75 tokens)

[deprecated in v3.0.0 — use gateway.aeoess.com REST API] Query the data contribution ledger.

Input parameters:

- `agentId` (string)
- `minAccessCount` (number)
- `principalId` (string)
- `purpose` (string)
- `sourceReceiptId` (string)

### `generate_settlement` (~95 tokens)

[deprecated in v3.0.0 — use gateway.aeoess.com REST API] Generate a Merkle-committed, signed settlement record for a period.

Input parameters:

- `endDate` (string, required): Period end (YYYY-MM-DD)
- `periodLabel` (string, required): Label (e.g. '2026-Q1', '2026-03')
- `startDate` (string, required): Period start (YYYY-MM-DD)

### `create_derivation_receipt` (~162 tokens)

Create a signed derivation receipt tracking how data was transformed. Multi-hop lineage with break markers.

Input parameters:

- `breakReason` (string)
- `derivativeId` (string, required): Unique ID for the derivative artifact
- `derivativeType` (string, required): Type: rag_chunk, embedding, summary, model_weights, synthetic_derivative, etc.
- `externalBoundaryBreak` (boolean): True if data left the system and returned
- `isSyntheticDerivative` (boolean)
- `lineageConfidence` (string, required)
- `parentArtifacts` (array, required): Parent artifacts this was derived from
- `transformClass` (string, required): Transform type: copy, subset, summary, embedding, aggregation, synthetic, model_training
- `upstreamObligationsRetained` (boolean)

### `resolve_lineage` (~55 tokens)

Resolve the full derivation chain for an artifact. Multi-hop with cycle detection.

Input parameters:

- `derivativeId` (string, required): ID of the derivative to trace
- `maxDepth` (number): Max chain depth (default: 10)

### `evaluate_revocation_impact` (~46 tokens)

Evaluate what happens when a data source revokes consent. Propagates obligations through derivation chains.

Input parameters:

- `sourceId` (string, required): Source ID that is revoking consent

### `create_decision_lineage_receipt` (~106 tokens)

Create a Decision Lineage Receipt — traces which data sources influenced a decision. Right-to-explanation primitive.

Input parameters:

- `contributingSources` (array, required)
- `decisionArtifactId` (string, required)
- `decisionType` (string, required): E.g. loan_approval, content_moderation, risk_assessment
- `explanation` (string)
- `governingPurpose` (string)
- `lineageCompleteness` (string, required)
- `transformChain` (array)

### `check_purpose_permitted` (~68 tokens)

Check if a purpose is permitted under source terms. Supports wildcards (research:*) and hierarchical matching.

Input parameters:

- `allowedPurposes` (array, required): Purposes allowed by the source terms
- `purpose` (string, required): Purpose to check (e.g. research:academic, training:model)

### `check_retention_expired` (~61 tokens)

Check if data retention has expired based on TTL policy.

Input parameters:

- `accessType` (string)
- `accessedAt` (string, required): ISO timestamp of when data was accessed
- `maxRetentionMs` (required): Max retention in ms (null = no limit)

### `check_aggregate_constraints` (~100 tokens)

Check if a data access would violate aggregate rate limits.

Input parameters:

- `agentId` (string, required)
- `burstLimit` (number)
- `currentAccessCount` (number, required)
- `currentRecordCount` (number, required)
- `lastAccessMs` (number, required)
- `maxAccessesPerWindow` (number)
- `sourceId` (string, required)
- `windowMs` (number)
- `windowStartMs` (number, required)

### `check_jurisdiction_transfer` (~98 tokens)

Check if a data transfer is permitted under jurisdiction constraints (EU_ONLY, GDPR_ADEQUATE_ONLY, NO_CROSS_BORDER).

Input parameters:

- `processingRestrictions` (array)
- `purpose` (string, required)
- `sourceJurisdiction` (string, required): ISO 3166-1 alpha-2 code
- `targetJurisdiction` (string, required): ISO 3166-1 alpha-2 code
- `transferConstraints` (array)

### `compute_governance_taint` (~52 tokens)

Compute governance taint level for an artifact based on its derivation chain and revoked sources.

Input parameters:

- `artifactId` (string, required)
- `revokedSources` (array): Source IDs that have been revoked

### `file_data_dispute` (~61 tokens)

File a dispute against a data artifact. The protocol records disputes — resolution is external.

Input parameters:

- `artifactId` (string, required)
- `disputeType` (string, required)
- `evidence` (array, required): Evidence artifact IDs
- `filedBy` (string, required)

### `check_combination_permitted` (~89 tokens)

Check if combining data from two sources is permitted. Prevents prohibited inferences (HIPAA, COPPA, GDPR Art 9).

Input parameters:

- `forbiddenSourceClasses` (array)
- `forbiddenSourceIds` (array)
- `otherSourceClasses` (array)
- `otherSourceId` (string, required)
- `reason` (string, required)
- `regulatoryBasis` (string)

### `create_access_snapshot` (~91 tokens)

Create an immutable access snapshot — freezes terms, jurisdiction, and constraints at moment of access. Anti-rug-pull.

Input parameters:

- `accessReceiptId` (string, required)
- `allowedPurposes` (array, required)
- `compensationRate` (number, required)
- `currency` (string, required)
- `sourceId` (string, required)
- `sourceJurisdiction` (string)
- `termsVersion` (string, required)

### `detect_purpose_drift` (~61 tokens)

Detect when data purpose drifts through a workflow (e.g. research → commercial).

Input parameters:

- `allowedPurposes` (array, required)
- `currentPurpose` (string, required)
- `intermediateSteps` (array)
- `originalPurpose` (string, required)

### `resolve_rights_propagation` (~49 tokens)

Resolve what rights propagate when data is transformed.

Input parameters:

- `sourceDefaultPropagation` (string): Source-defined default: inherit_full, compensation_only, etc.
- `transformClass` (string, required)

### `declare_reidentification_risk` (~55 tokens)

Declare re-identification risk for transformed or synthetic data.

Input parameters:

- `assessedBy` (string, required)
- `assessmentMethod` (string)
- `mitigationsApplied` (array)
- `risk` (string, required)

### `generate_governance_block` (~134 tokens)

Generate a cryptographically signed governance block for embedding in HTML pages. Includes terms, revocation policy, and content hash.

Input parameters:

- `caching` (string)
- `content` (string, required): Article/page content to hash and govern
- `derivative` (string)
- `inference` (string)
- `license_url` (string)
- `privateKey` (string, required): Publisher's Ed25519 private key (hex)
- `publicKey` (string, required): Publisher's Ed25519 public key (hex)
- `redistribution` (string)
- `terms_version` (string)
- `training` (string)

### `verify_governance_block` (~69 tokens)

Verify a governance block's signature, content hash, and DID consistency against the original content.

Input parameters:

- `block` (string, required): Governance block JSON string
- `content` (string, required): Original content to verify against
- `publicKey` (string, required): Publisher's Ed25519 public key (hex)

### `parse_governance_block_html` (~42 tokens)

Extract a governance block from an HTML page. Looks for APS governance script tags or meta tags.

Input parameters:

- `html` (string, required): HTML content to parse

### `check_usage_permitted` (~43 tokens)

Check if a specific usage type is permitted under a governance block's terms.

Input parameters:

- `block` (string, required): Governance block JSON string
- `usage` (string, required)

### `generate_aps_txt` (~144 tokens)

Generate a signed aps.txt file for site-wide governance. Like robots.txt but cryptographically signed with terms, revocation endpoint, and MCP upgrade path.

Input parameters:

- `domain` (string, required): Domain this declaration covers (e.g. theagenttimes.com)
- `inference` (string)
- `mcpEndpoint` (string)
- `privateKey` (string, required): Publisher's Ed25519 private key (hex)
- `publicKey` (string, required): Publisher's Ed25519 public key (hex)
- `publisherName` (string, required): Human-readable publisher name
- `redistribution` (string)
- `revocationEndpoint` (string)
- `training` (string)

### `verify_aps_txt` (~51 tokens)

Verify a signed aps.txt file — checks signature and DID consistency.

Input parameters:

- `content` (string, required): aps.txt JSON content
- `publicKey` (string, required): Publisher's Ed25519 public key (hex)

### `resolve_path_terms` (~55 tokens)

Resolve governance terms for a specific URL path using aps.txt path overrides.

Input parameters:

- `apsTxt` (string, required): aps.txt JSON content
- `path` (string, required): URL path to resolve (e.g. /blog/my-article)

### `create_chained_governance_block` (~131 tokens)

Create a governance block for derivative content that references the original publisher's block. Preserves the chain of provenance.

Input parameters:

- `content` (string, required): Derivative content
- `derivationType` (string, required): Type: summary, embedding, rag_chunk, translation, etc.
- `inference` (string)
- `parentBlock` (string, required): Original governance block JSON string
- `privateKey` (string, required): Derivative agent's Ed25519 private key (hex)
- `publicKey` (string, required): Derivative agent's Ed25519 public key (hex)
- `training` (string)

### `governance_360` (~154 tokens)

Execute the full governance 360 loop on HTML content: extract governance block → verify signature + content hash → check usage terms → create signed access receipt. This is what an agent calls on every page it reads.

Input parameters:

- `agentPrivateKey` (string, required): Your agent's Ed25519 private key (hex)
- `agentPublicKey` (string, required): Your agent's Ed25519 public key (hex)
- `contentBody` (string, required): Article text content (for hash verification)
- `html` (string, required): Full HTML of the page
- `intendedUsage` (string, required)
- `publisherPublicKey` (string, required): Publisher's Ed25519 public key (hex)
- `sourceUrl` (string, required): URL of the page

### `create_access_receipt` (~117 tokens)

Create a signed access receipt — cryptographic proof that your agent consumed content under specific terms. The receipt captures terms and revocation policy at access time.

Input parameters:

- `agentPrivateKey` (string, required): Your agent's Ed25519 private key (hex)
- `agentPublicKey` (string, required): Your agent's Ed25519 public key (hex)
- `block` (string, required): Governance block JSON string
- `intendedUsage` (string, required): How you intend to use this content
- `sourceUrl` (string, required): URL where content was accessed

### `create_charter` (~133 tokens)

Create a new institutional charter — the constitutional root of an organization. Defines offices, amendment rules, dissolution policy.

Input parameters:

- `amendment_board_keys` (array, required): Ed25519 public keys eligible for amendment voting
- `amendment_required_sigs` (number, required): Signatures required for amendment
- `dissolution_grace_seconds` (number)
- `founder_private_key` (string, required): Founder's Ed25519 private key
- `founder_public_key` (string, required): Founder's Ed25519 public key
- `founder_role` (string)
- `name` (string, required): Institution name
- `offices` (array, required): Offices to create

### `verify_charter` (~38 tokens)

Verify a charter's integrity: content hash, signatures, office consistency, incompatibility.

Input parameters:

- `charter_id` (string, required): Charter ID to verify

### `sign_charter` (~69 tokens)

Add a founding signature to a charter.

Input parameters:

- `charter_id` (string, required)
- `resigner_private_key` (string, required): Key to re-sign the outer charter envelope
- `signer_private_key` (string, required)
- `signer_public_key` (string, required)
- `signer_role` (string)

### `evaluate_threshold` (~45 tokens)

Evaluate whether signatures meet a multi-class threshold policy (Consilium Q5).

Input parameters:

- `charter_id` (string, required): Charter whose amendment policy to evaluate against
- `signatures` (array, required)

### `create_approval_request` (~74 tokens)

Create a multi-party approval request for charter amendments, office transfers, etc.

Input parameters:

- `policy_id` (string, required)
- `requested_by` (string, required)
- `subject` (string, required): What is being approved (e.g. amendment ID)
- `subject_type` (string, required)
- `timeout_seconds` (number)

### `add_approval_signature` (~60 tokens)

Add a signature to an approval request.

Input parameters:

- `key_class` (string)
- `office_id` (string)
- `request_id` (string, required)
- `signer_private_key` (string, required)
- `signer_public_key` (string, required)

### `create_hybrid_timestamp` (~55 tokens)

Create a gateway-issued hybrid timestamp (Consilium Q1: HLC + NTP uncertainty).

Input parameters:

- `drift_ms` (number): NTP drift bound in milliseconds
- `gateway_id` (string, required): Gateway issuing the timestamp

### `compare_timestamps` (~31 tokens)

Compare two hybrid timestamps to determine ordering.

Input parameters:

- `a` (object, required)
- `b` (object, required)

### `validate_temporal_rights` (~83 tokens)

Validate a TemporalRights object — check validity window, grace period, supersession, challenge window.

Input parameters:

- `challenge_until` (string)
- `effective_at` (string)
- `grace_until` (string)
- `superseded_at` (string)
- `valid_from` (string, required): ISO datetime
- `valid_until` (string, required): ISO datetime

### `create_reserve_attestation` (~122 tokens)

Create a signed reserve attestation proving a delegation has actual funds (GPT #15).

Input parameters:

- `amount` (number, required)
- `assurance_class` (string, required)
- `attestation_basis` (string, required)
- `attester_private_key` (string, required)
- `attester_public_key` (string, required)
- `charter_anchor` (string)
- `currency` (string)
- `delegation_id` (string, required)
- `false_attestation_penalty` (string)
- `office_id` (string)
- `ttl_seconds` (number)

### `vouch_reputation` (~85 tokens)

Create a vouched reputation for cross-gateway portability (WS-3). Signed summary — no receipt history exposed.

Input parameters:

- `agent_id` (string, required)
- `diversity_score` (number, required)
- `gateway_id` (string, required)
- `gateway_private_key` (string, required)
- `tier` (number, required)
- `ttl_seconds` (number): Default 30 days

### `apply_reputation_downgrade` (~95 tokens)

Apply import policy downgrade to a foreign vouched reputation.

Input parameters:

- `accept_from` (array, required): Gateway IDs accepted by import policy
- `agent_id` (string, required)
- `attested_diversity_score` (number, required)
- `attested_tier` (number, required)
- `downgrade_ratio` (number)
- `foreign_default_tier` (number)
- `origin_gateway_id` (string, required)

### `compute_action_ref` (~83 tokens)

Compute content-addressed request identity (SHA-256 of agentId + actionType + scope + normalized timestamp). Two receipts with the same action_ref describe the same request.

Input parameters:

- `action_type` (string, required)
- `agent_id` (string, required)
- `scope_required` (array, required)
- `timestamp` (string): ISO 8601 timestamp; defaults to now

### `is_evidence_fresh` (~100 tokens)

Check whether typed attestation evidence is still fresh. rotating: ttl required; snapshot: maxAge optional; static: always fresh.

Input parameters:

- `max_age` (number): Seconds (optional for snapshot)
- `now` (string): ISO 8601 override for current time
- `ttl` (number): Seconds (required for rotating)
- `type` (string, required)
- `valid_at` (string, required): ISO 8601 timestamp evidence was produced

### `classify_evidence_quality` (~90 tokens)

Classify attestation evidence quality (none / issuer_vouched / infrastructure / principal_bound) and return the corresponding grade (0-3).

Input parameters:

- `evidence` (object): Evidence object (checked for known infrastructure keys)
- `has_issuer_signature` (boolean)
- `has_principal_binding` (boolean)
- `method` (string): Attestation method (e.g. 'spiffe')

### `rotate_key` (~129 tokens)

Rotate an agent's Ed25519 key. Planned mode: configurable overlap (default 24h). Emergency mode: immediate old-key retirement. Returns updated DID document, rotation state, and revocation results.

Input parameters:

- `activation_delay_hours` (number): Planned mode overlap hours (default: 24)
- `agent_name` (string): Agent name for the passport (default: current session)
- `delegation_ids_to_revoke` (array): Delegation IDs to cascade-revoke during rotation
- `mode` (string, required)
- `old_private_key` (string, required): Hex-encoded private key being rotated FROM

### `verify_rotation_chain` (~48 tokens)

Verify all rotation signatures in a DID document's rotation log. Returns true if the full chain is cryptographically valid.

Input parameters:

- `did_document` (required): RotatableDIDDocument JSON object with rotationLog

### `is_key_active` (~65 tokens)

Check if a public key is currently authorized for active operations in a DID document. SDK convenience check; gateway enforcement is authoritative.

Input parameters:

- `did_document` (required): RotatableDIDDocument JSON object
- `public_key` (string, required): Hex-encoded Ed25519 public key to check

### `aps_create_attribution_receipt` (~205 tokens)

Representation boundary: build a citer-signed AttributionReceipt attributing a claim to a third-party principal. The receipt is not yet valid — the cited principal must sign consent via aps_sign_attribution_consent before checkArtifactCitations accepts it.

Input parameters:

- `binding_context` (string, required): ID of the binding artifact this citation is scoped to
- `citation_content` (string, required): The quoted or paraphrased claim
- `cited_principal` (string, required): DID/public key of the cited principal
- `cited_principal_public_key` (string, required): Hex public key of cited principal
- `citer` (string, required): DID/public key of the citing agent
- `citer_private_key` (string, required): Hex private key of citer
- `citer_public_key` (string, required): Hex public key of citer
- `gateway_id` (string): Gateway id for timestamping (default: 'mcp')
- `ttl_ms` (number): Receipt TTL in ms (default: 24h)

### `aps_sign_attribution_consent` (~76 tokens)

Representation boundary: the cited principal adds their consent signature to an AttributionReceipt. Without this signature, verifyAttributionConsent and checkArtifactCitations reject the receipt.

Input parameters:

- `cited_principal_private_key` (string, required): Hex private key of cited principal
- `receipt` (required): AttributionReceipt JSON from aps_create_attribution_receipt

### `aps_verify_attribution_consent` (~61 tokens)

Representation boundary: verify an AttributionReceipt end-to-end (id, citer signature, consent signature, expiry). Returns {valid, reason?}.

Input parameters:

- `now`: Optional HybridTimestamp to pin the evaluation moment
- `receipt` (required): AttributionReceipt JSON

### `aps_check_artifact_citations` (~91 tokens)

Representation boundary: gate a binding artifact's citations. Each citation must resolve to a provided, signed, unexpired receipt whose content + principal match, with per-artifact replay protection.

Input parameters:

- `artifact` (required): CitingArtifact with optional citations[] array
- `binding_context` (string): Require receipts to be scoped to this binding context
- `receipts` (array, required): AttributionReceipts backing each citation

### `aps_attribution_receipt_id` (~52 tokens)

Representation boundary helper: compute the canonical sha256 id of an AttributionReceipt's unsigned core. Verifiers use this to detect id tampering.

Input parameters:

- `receipt` (required): AttributionReceipt JSON (signatures ignored)

### `aps_create_provisional` (~156 tokens)

Commitment boundary: emit a provisional statement for agent-to-agent negotiation. Default is non-binding until a PromotionEvent satisfies a PromotionPolicy. Dead-man expiry auto-withdraws.

Input parameters:

- `author` (string, required): AgentDID/public key of the emitting agent
- `author_principal` (string, required): PrincipalDID behind the author
- `author_private_key` (string, required): Hex private key of author for signing
- `content` (string, required): Statement content (offer, position, claim)
- `dead_man_ms` (number): Dead-man expiry relative to now (ms). If elapsed without promotion/withdrawal, statement auto-withdraws.
- `gateway_id` (string): Gateway id for timestamping (default: 'mcp')

### `aps_promote_statement` (~108 tokens)

Commitment boundary: promote a provisional statement to binding by attaching a PromotionEvent that satisfies the PromotionPolicy (m-of-n principal signatures). dead_man_elapsed cannot promote — it auto-withdraws via the dead-man path.

Input parameters:

- `policy` (required): PromotionPolicy {id, required_signers, threshold, max_time_to_promote}
- `promotion_event` (required): PromotionEvent with kind, promoted_at, promoter, promoter_signature, policy_reference
- `statement` (required): ProvisionalStatement from aps_create_provisional

### `aps_verify_promotion` (~75 tokens)

Commitment boundary: verify that a promoted statement's PromotionEvent cryptographically satisfies the PromotionPolicy (policy_reference match, promoter in required_signers, threshold, signature, max_time_to_promote, author-signature tamper check).

Input parameters:

- `policy` (required): PromotionPolicy to check against
- `statement` (required): Promoted ProvisionalStatement

### `aps_withdraw_provisional` (~110 tokens)

Commitment boundary: author withdraws their own provisional statement. Already-promoted statements cannot be withdrawn. Caller must supply the author's signature over the withdrawal payload (canonicalize({action:'withdraw', statement_id})).

Input parameters:

- `author_private_key` (string): If provided, tool signs the withdrawal payload with this key.
- `author_signature` (string): Hex Ed25519 signature. If omitted, provide author_private_key and the tool will sign for you.
- `statement` (required): ProvisionalStatement to withdraw

### `aps_check_escalation_required` (~122 tokens)

Escalation boundary: check whether an action on a v2 delegation requires owner confirmation before execution. Returns {required, requirement?, reason?}. Use aps_record_owner_confirmation to clear the flag when required.

Input parameters:

- `action_class` (string, required): Action class (e.g. 'org_creation', 'spend_above_threshold')
- `action_details`: Structured details; hashed for audit
- `delegation` (required): V2Delegation with optional scope.escalation_requirements
- `session_id` (string): Session id (required for per_session scope)

### `aps_record_owner_confirmation` (~140 tokens)

Escalation boundary: owner signs an OwnerConfirmation authorizing a flagged action. Builds the ConfirmationRequest and signs it in a single call. The confirmation is bound to action_details via hash and scoped (per_action / per_session / time_window).

Input parameters:

- `action_class` (string, required): Action class being confirmed
- `action_details` (required): Structured action details — hashed and bound to the confirmation
- `delegation` (required): V2Delegation with escalation_requirements for this action class
- `owner_private_key` (string, required): Hex private key of the delegation's owner (delegator)
- `session_id` (string): Session id (required for per_session scope)

### `aps_construct_attribution_primitive` (~159 tokens)

Build and sign a four-axis AttributionPrimitive for an action. Axes: D (data sources), P (protocol modules), G (delegation chain), C (compute providers). Returns the complete signed object.

Input parameters:

- `action` (object, required): Action identity tuple; the action_ref is derived as sha256(canonical(this))
- `axes` (object, required): Four-axis content. See spec §1.2 for entry shapes per axis.
- `issuer` (string, required): Issuer DID (gateway or agent producing the receipt)
- `issuer_private_key` (string, required): Ed25519 private key hex that signs the envelope
- `timestamp` (string): ISO-8601 UTC with ms precision + Z (§2.5). Defaults to now().

### `aps_project_attribution` (~92 tokens)

Extract a single-axis projection from an AttributionPrimitive. The projection carries the axis content plus a two-hop Merkle path that lets a downstream verifier reconstruct the signed root without seeing the other three axes. axis: 'D' | 'P' | 'G' | 'C'.

Input parameters:

- `axis` (string, required): Axis to project
- `primitive` (required): An AttributionPrimitive (from aps_construct_attribution_primitive)

### `aps_verify_attribution_projection` (~107 tokens)

Verify a single-axis AttributionProjection under the issuer's Ed25519 public key. Returns {valid: true} or {valid: false, reason: 'INVALID_AXIS_TAG'|'MERKLE_MISMATCH'|'SIGNATURE_INVALID'|'MALFORMED'}. Verification is purely local — no other axes required.

Input parameters:

- `issuer_public_key` (string, required): Issuer Ed25519 public key hex
- `projection` (required): An AttributionProjection (from aps_project_attribution)

### `aps_verify_attribution_primitive` (~76 tokens)

End-to-end verify of a full AttributionPrimitive: constructs projections for all four axes and verifies each one. Useful as a post-construction sanity check or for verifying a primitive received from a peer.

Input parameters:

- `issuer_public_key` (string, required): Issuer Ed25519 public key hex
- `primitive` (required): An AttributionPrimitive

### `aps_check_projection_consistency` (~100 tokens)

Cross-projection consistency check (§2.4): given two projections, confirm they originate from the same signed receipt. Returns {same_receipt: true} or {same_receipt: false, reason: 'DIFFERENT_ACTIONS'|'DIFFERENT_RECEIPTS'|'DIFFERENT_SIGNATURES'|'METADATA_MISMATCH'}.

Input parameters:

- `projection_a` (required): First AttributionProjection
- `projection_b` (required): Second AttributionProjection

### `aps_compute_attribution_action_ref` (~85 tokens)

Derive the action_ref (hex sha256) for an action tuple. action_ref is the content-addressed anchor that all four axis projections bind to. Useful for indexing primitives by action without constructing the full primitive.

Input parameters:

- `actionType` (string, required)
- `agentId` (string, required)
- `nonce` (string, required)
- `params` (object, required)

### `aps_compute_data_axis_weights` (~169 tokens)

Compute the D-axis fractional weight vector from a list of AccessReceipt records with role, timestamp, and content length. Returns canonical DataAxisEntry[] with 6-digit decimal contribution_weight strings that sum to ~1.0 and feed directly into aps_construct_attribution_primitive. Empty input → empty array; all-zero raw weights → error. Weights = role × recency_decay × length_weight, normalized per spec BUILD-B §'The D-axis formula'. Parameter names match the SDK: `sources`, `action_timestamp`, optional `profile`.

Input parameters:

- `action_timestamp` (string, required): ISO-8601 UTC ms when the action ran (t_action)
- `profile`: Optional WeightProfile override; defaults to DEFAULT_WEIGHT_PROFILE
- `sources` (array, required): Per-source records with retrieval metadata

### `aps_compute_compute_axis_weights` (~137 tokens)

Compute the C-axis fractional weight vector from a list of inference billing records (prompt_tokens, completion_tokens). Returns canonical ComputeAxisEntry[] with 6-digit decimal compute_share strings that sum to ~1.0 and feed directly into aps_construct_attribution_primitive. Weights = prompt_tokens + completion_tokens × COMPLETION_MULTIPLIER (default 3.0), normalized per spec BUILD-B §'The C-axis formula'. Parameter names match the SDK: `providers`, optional `profile`.

Input parameters:

- `profile`: Optional WeightProfile override; defaults to DEFAULT_WEIGHT_PROFILE
- `providers` (array, required): Per-provider billing records

### `aps_aggregate_settlement` (~181 tokens)

Aggregate a batch of Attribution Primitives over a half-open settlement period [t0, t1) into a signed SettlementRecord. Each axis (D, P, G, C) produces a per-contributor total with a balanced-Merkle commitment. Residual buckets pool sub-threshold contributors per Build A §4.1. Output is a fully signed record ready for third-party verification. Spec: BUILD-C-SETTLEMENT-PIPELINE.md.

Input parameters:

- `gateway_did` (string, required): Gateway DID that signs the record
- `gateway_private_key` (string, required): Ed25519 gateway private key (hex)
- `issued_at` (string): Override issued_at (canonical ISO-8601 UTC ms + Z); defaults to now
- `period` (object, required)
- `receipts` (array, required): Array of AttributionPrimitives to aggregate

### `aps_verify_settlement` (~154 tokens)

Verify a signed SettlementRecord under S1-S5 (signature, Merkle roots, conservation, residual shape, optional input-receipts cross-check). S3 conservation is the strongest invariant: a gateway cannot inflate or suppress any contributor's share without breaking it. Returns {valid: true} or {valid: false, reason, detail}. Pass inputReceipts to also recompute input_receipts_hash.

Input parameters:

- `gateway_public_key` (string, required): Gateway Ed25519 public key hex
- `input_receipts` (array): Optional — the input Attribution Primitives that fed the settlement. When supplied, S5 cross-checks input_receipts_hash and verifies each receipt individually.
- `record` (required): A signed SettlementRecord

### `aps_build_contributor_query` (~138 tokens)

Build a contributor-query response: given a signed SettlementRecord and a contributor DID, return per-axis (total_weight, contribution_count, merkle_path, axis_root) plus the full signed record so a third party can verify the contributor's share end-to-end without trusting the gateway beyond its public key. Returns null if the contributor has no share in the period.

Input parameters:

- `contributor_did` (string, required): Contributor DID (data source, compute provider, governance signer, or protocol module identifier)
- `gateway_jwks` (string): Advisory JWKS URL; not part of the signed material
- `record` (required): A signed SettlementRecord

### `mutualAuthBuildCertificate` (~296 tokens)

Build and sign a mutual-auth certificate identifying an agent or information system. Returns the signed MutualAuthCertificate object ready to carry into a handshake. The issuer's Ed25519 private key (hex) signs over the canonical (JCS) form.

Input parameters:

- `attestation_grade`: For agents: APS attestation grade 0-3
- `binding` (string, required): For an agent: the APS agent_id. For an IS: the resource domain (e.g., mcp://api.bank.com)
- `capabilities` (array): Optional capability tags
- `issuer_id` (string, required): Issuer identifier
- `issuer_privkey_hex` (string, required): Ed25519 private key (hex) of the issuer — used to sign
- `issuer_pubkey_hex` (string, required): Ed25519 public key (hex) of the issuer
- `issuer_role` (string, required): Role of the issuer
- `not_after` (number, required): Latest valid time (unix ms)
- `not_before` (number, required): Earliest valid time (unix ms)
- `role` (string, required): Role of the subject this cert identifies
- `subject_id` (string, required): Stable subject identifier (e.g., agent DID, IS endpoint URL)
- `subject_pubkey_hex` (string, required): Ed25519 public key (hex) of the subject
- `supported_versions` (array, required): Protocol versions supported, highest first (e.g., ['1.0'])

### `mutualAuthVerifyAttest` (~209 tokens)

Verify a MutualAuthAttest against policy and trust anchors. Runs all 10 verification checks: signature, version negotiation, nonce match, timestamp freshness, certificate validity, issuer anchor check, binding constraints, downgrade detection, attestation grade policy, capability policy. Returns ok:true on success or a failure reason on rejection.

Input parameters:

- `attest` (required): MutualAuthAttest to verify
- `expected_own_nonce_b64` (string, required): The nonce we sent in our own prior hello or attest
- `expected_peer_nonce_b64` (string, required): The nonce the peer sent in their prior hello or attest
- `now_ms` (number): Current unix ms — defaults to Date.now()
- `policy` (required): MutualAuthPolicy (accepted_versions, min_agent_grade, required_capabilities, max_clock_skew_ms, max_session_ms)
- `revoked_anchor_ids` (array): IDs of anchors revoked since the bundle was issued
- `trust_anchors` (array, required): TrustAnchor[] — local trusted roots

### `mutualAuthDeriveSession` (~127 tokens)

Derive the shared mutual-auth session record from both sides' Attests. Both parties MUST compute identical session_id given identical inputs (canonical JCS + sha256 of chosen_version, both cert ids, both nonces). Returns a MutualAuthSession with session_id + both certificates + expiry bounds, or failure reason.

Input parameters:

- `agent_attest` (required): The agent's MutualAuthAttest
- `is_attest` (required): The information system's MutualAuthAttest
- `now_ms` (number): Current unix ms — defaults to Date.now()
- `policy` (required): MutualAuthPolicy

### `mutualAuthVerifyTrustBundle` (~111 tokens)

Verify a TrustAnchorBundle signature and freshness. Caller supplies the list of trusted publisher public keys (root configuration). Returns ok:true on success or failure reason (untrusted_publisher, signature_invalid, bundle_expired, not_yet_valid).

Input parameters:

- `bundle` (required): TrustAnchorBundle to verify
- `now_ms` (number): Current unix ms — defaults to Date.now()
- `trusted_publisher_pubkeys_hex` (array, required): List of Ed25519 pubkeys (hex) authorized to publish bundles

### `aps_capability_issue_challenge` (~166 tokens)

v0.1 capability-token sink challenge (M1). Sink issues a signed canonical action statement. Returns the SinkChallenge and its challenge_hash. Used to bind the gateway's later policy evaluation to a specific action the sink authored. Search keywords: capability token, sink challenge, M1.

Input parameters:

- `action` (object, required): Canonical action statement
- `required_policy_freshness` (object)
- `sink_id` (string, required): DID of the sink issuing the challenge
- `sink_private_key` (string, required): Sink Ed25519 private key (hex)
- `sink_public_key` (string, required): Sink Ed25519 public key (hex)
- `subject_id` (string, required): DID of the subject the challenge is addressed to
- `validity_seconds` (integer)

### `aps_capability_evaluate_authority` (~161 tokens)

v0.1 capability-token authority evaluation request (M2). Subject signs a request carrying the sink's M1, the delegation chain, and a revealed authority-token preimage. The gateway consumes this to decide permit/deny. Search keywords: capability token, authority evaluation, M2.

Input parameters:

- `authority_token` (object, required)
- `challenge` (required): SinkChallenge object from M1
- `delegation_chain` (array, required): v2.x delegation envelopes
- `delegation_chain_root` (string): Override; otherwise computed from chain
- `freshness_beacon` (object, required)
- `subject_private_key` (string, required): Subject Ed25519 private key (hex)
- `subject_public_key` (string, required): Subject Ed25519 public key (hex)

### `aps_capability_mint_receipt` (~140 tokens)

v0.1 capability-token gateway receipt (M3). Gateway signs a permit or deny over the sink's exact challenge_hash. Echoes the M2 delegation_chain_root so the sink can verify the gateway saw the same chain the subject committed to. Search keywords: capability token, challenge receipt, gateway receipt, M3.

Input parameters:

- `decision` (string, required)
- `deny_reason` (string)
- `gateway_private_key` (string, required)
- `gateway_public_key` (string, required)
- `policy_digest` (string, required): SHA-256 of the policy bundle used in evaluation
- `request` (required): AuthorityEvaluationRequest from M2

### `aps_capability_sign_effect` (~189 tokens)

v0.1 capability-token sink effect receipt (M4). Sink consumes the token preimage from the gateway's M3 (rejecting on nullifier replay), executes the action, and signs an EffectReceipt binding the consumed token to the result. The (M1, M3, M4) tuple is the full attestation record. Search keywords: capability token, effect receipt, M4, sink attestation.

Input parameters:

- `challenge` (required): Original SinkChallenge from M1 (for binding verification)
- `challenge_receipt` (required): ChallengeReceipt from M3
- `effect` (object, required)
- `expected_delegation_chain_root` (string): If omitted, falls back to the receipt's own root
- `gateway_public_key` (string, required): Used to verify M3 before consuming the token
- `sink_private_key` (string, required)
- `sink_public_key` (string, required)

## Diagnostics

Captured diagnostic sections: Provenance, Install scripts, Dependencies. The full working is on the page: https://verifymcp.io/servers/aeoess-agent-passport-mcp/agent-passport-system-mcp#diagnostics

## Score history

- 2026-08-03: 62
- 2026-08-02: 66
- 2026-08-01: 49
- 2026-07-31: 5
- 2026-07-30: 24
- 2026-07-28: 51
- 2026-07-27: 51

## Links

- npm package: https://www.npmjs.com/package/agent-passport-system-mcp
- Socket report: https://socket.dev/npm/package/agent-passport-system-mcp
- Repository: https://github.com/aeoess/agent-passport-mcp
- Website: https://aeoess.com/
- Changelog RSS feed: https://verifymcp.io/servers/aeoess-agent-passport-mcp/agent-passport-system-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/aeoess-agent-passport-mcp/agent-passport-system-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/aeoess-agent-passport-mcp/agent-passport-system-mcp