Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, email [email protected] and we’ll put it right.

Guardian Engine

REMOTE · API.KAIMEILABS.DEV · SCANNED AUG 3

Deterministic recipe verification engine — validates AI-generated recipes against master SOPs.

+2 this week 62 Trust /100
Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score →

Endpoint Security46
Transport & Reachability100
Schema Quality & AI Usability73
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 2422 tokens (~346/item across 7 items; 7 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
  • Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
  • Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

remote · api.kaimeilabs.dev

# add to Claude Code
claude mcp add --transport http dev-kaimeilabs-guardian-engine https://api.kaimeilabs.dev/mcp
# ~/.codex/config.toml
[mcp_servers.dev-kaimeilabs-guardian-engine]
url = "https://api.kaimeilabs.dev/mcp"
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "dev-kaimeilabs-guardian-engine": {
      "type": "remote",
      "url": "https://api.kaimeilabs.dev/mcp",
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add dev-kaimeilabs-guardian-engine --url https://api.kaimeilabs.dev/mcp --transport streamable-http
# ~/.hermes/config.yaml
mcp_servers:
  dev-kaimeilabs-guardian-engine:
    url: "https://api.kaimeilabs.dev/mcp"
// mcp.json
{
  "mcpServers": {
    "dev-kaimeilabs-guardian-engine": {
      "type": "http",
      "url": "https://api.kaimeilabs.dev/mcp"
    }
  }
}

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 3 Aug 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

  • 31 Jul 26 −1
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 30 Jul 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 29 Jul 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.

  • 28 Jul 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

  • 27 Jul 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 26 Jul 26 60

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Probed https://api.kaimeilabs.dev/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=kaimeilabs.dev CN=YE2,O=Let's Encrypt,C=US 22 Jun 2026 20 Sept 2026 ECDSA 256 ECDSA-SHA384 51e4ae5e42bd61842269cfda8b1f5656a28
SANs: *.kaimeilabs.dev, kaimeilabs.dev
CN=YE2,O=Let's Encrypt,C=US (CA) CN=Root YE,O=ISRG,C=US 3 Sept 2025 2 Sept 2028 ECDSA 384 ECDSA-SHA384 4df3b15dd6c0784c507cd37b58e6f115
CN=Root YE,O=ISRG,C=US (CA) CN=ISRG Root X2,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 ECDSA 384 ECDSA-SHA384 872165fc34b6e5fba8add5b3705fb53a
CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) CN=ISRG Root X1,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 ECDSA 384 SHA256-RSA 6c8f1dc727c7117f7baf853ac980f9cd
DNSSEC insecure

Validation of api.kaimeilabs.dev. Not signed

Zone DS Keys Algorithms Outcome
. trust_anchor 20326, 38696 8, 8 Verified
dev. present 60074 8 Verified
kaimeilabs.dev. absent Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation
Authentication No authorisation required

The endpoint answered without asking for a token. Anyone who knows the URL can reach it.

Result No authorisation required
HTTP status 200
Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://api.kaimeilabs.dev/mcp Verified 200
http (plaintext) http://api.kaimeilabs.dev/mcp Inconclusive 403
MCP tools — 7 exposed · ~2,222 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens
check_allergens ~289

Check ingredients for EU FIC 1169/2011 allergen compliance. Returns a detailed audit trace mapping each ingredient to its EU Annex II allergen group with entry numbers and labels. The safety verdict is deterministic — no LLM involvement in the decision. Use check_all_eu_allergens=True for food labelling (detect all allergens). Use restrictions=['dairy', 'gluten'] to check for specific user allergies.

NameTypeReqDescription
check_all_eu_allergensbooleanIf True, scans for all 14 EU Annex II allergens regardless of restrictions list. Use this for food labelling (declare all allergens present).
dish_nameOptional dish name for reporting context.
ingredientsarrayyesList of ingredient names (freeform or canonical IDs). Examples: ['butter', 'wheat_flour', 'eggs', 'peanut_butter']
response_formatstringResponse format: 'text' (default) or 'json'. Use 'json' for machine-actionable output.
restrictionsAllergen group IDs to check against user restrictions. Valid IDs: gluten, crustaceans, eggs, fish, peanuts, soy, dairy, tree_nuts, celery, mustard, sesame, sulphites, lupin, molluscs. If None and che…
NameTypeReqDescription
resultyes

No examples provided.

check_safety ~182

Run master-independent safety checks on a candidate recipe. Works for ANY recipe — no dish resolution, no master SOP required. Checks poultry internal-temperature safety and scans all ingredients for the 14 EU FIC 1169/2011 Annex II allergen groups. The verdict is a deterministic function of (candidate, kb_version_hash) — no LLM involvement. Use this when verify_recipe has no matching master for the dish: the safety layer still applies to every recipe. Returns: Safety envelope: verdict (PASSED/FAILED per the zero-critical policy gate), safe flag, issues found, and the pinned kb_version_hash.

NameTypeReqDescription
candidate_jsonstringyesThe full candidate recipe as a JSON string. Checked for poultry internal temperature safety (≥74°C) and EU FIC 1169 allergen presence.

Structured output declared, but exposes no named fields.

No examples provided.

fix_recipe ~434

Deterministically repair a candidate recipe against a Guardian master. Verifies the candidate, applies every machine-actionable correction the symbolic engine produced (missing ingredients, quantities, temperatures, durations, cooking media, ingredient substitutions), then re-verifies the result. No LLM is used — the repair is a deterministic function of the candidate recipe and the master ruleset. Findings that need recipe-authoring judgement — adding a whole cooking phase, rewriting step instructions, ingredient-ratio rebalancing — are not auto-applied; they are returned under `patches_skipped`. Allergen findings are never auto-fixed. The response reports the verdict before and after so the caller can see exactly what was resolved. Note: `verdict_after` may still be FAILED when structural changes (e.g. adding a cooking step, rebalancing ingredient ratios) are needed. These require recipe-authoring judgement and are returned under `patches_skipped`. Callers should NOT assume a fixed recipe will pass verification.

NameTypeReqDescription
candidate_jsonThe full candidate recipe as a JSON string or object — same schema as verify_recipe's candidate_json (title, cuisine, ingredients[], steps[]).
dishAlias for dish_name — for backward compatibility with production clients.
dish_namestringName of the dish to repair against (e.g. 'carbonara', 'rendang', 'roast-chicken'). Use list_dishes() to see all available recipes and their aliases.
master_jsonOptional user-supplied master SOP to repair against (BYO master, ADR-018), same schema as catalog masters. When provided, the catalog is bypassed and dish_name may be omitted; patches (including sugg…
original_promptOptional. The user's original cooking request, used only for safety-context awareness during verification. Does not change which fixes are applied.
response_formatstringResponse format: 'json' (default — includes the full fixed_recipe object) or 'text' (human-readable report).
NameTypeReqDescription
resultstringyes

No examples provided.

get_master ~256

Return the canonical master recipe for a dish (read-only, no LLM). Enables compare-then-verify agentic loops: fetch the master, diff it against the user's recipe, then call verify_recipe — instead of verifying blind. Pure knowledge-base lookup, no LLM in the hot path. Master content is transparent by default (ADR-009 / ADR-010): exact temperatures, timings, and EU FIC 1169/2011 allergen codes are returned verbatim, never obfuscated. No score is included (ADR-013) — this is reference data, not a verdict. Returns ingredients, steps (technique/temperature/timing/medium), and the EU FIC allergens derived from the required ingredients. Unknown dishes return a structured UNKNOWN_DISH error.

NameTypeReqDescription
dish_namestringName or alias of the dish to fetch the canonical master recipe for (e.g. 'carbonara', 'spaghetti bolognese', 'angel food cake'). Alias resolution and slug normalisation are applied. Use list_dishes()…
response_formatstringResponse format: 'json' (default, structured) or 'text' (human-readable summary).
NameTypeReqDescription
resultstringyes

No examples provided.

list_dishes ~128

List all available master dishes with rich metadata. Returns: Dictionary with `schema_version` and a `dishes` list. Each dish includes slug, title, cuisine, region, aliases, and complexity.

NameTypeReqDescription
cuisine_filterstringOptional cuisine to filter by. Case-insensitive exact match against the dish's cuisine field. Valid values: italian | french | spanish | british | thai | chinese | indian | indonesian | japanese | ma…

Structured output declared, but exposes no named fields.

No examples provided.

verify_dietary_claim ~188

Verify that a recipe satisfies a dietary claim (vegan, halal, gluten-free, ...). Reuses the existing allergen-detection logic plus a curated forbidden-ingredient map (apps/guardian/knowledge/dietary_claims.yaml). Returns a structured verdict with the specific offending ingredients and a short justification — never a vague paraphrase.

NameTypeReqDescription
candidate_jsonstringRecipe JSON string (CandidateRecipe schema). Expected shape: {"title": "...", "ingredients": [{"name": "..."}, ...], "steps": [...]}. Only the ingredient list is required for dietary verification.
claimstringDietary claim to verify: vegan | vegetarian | gluten_free | dairy_free | nut_free | halal | kosher.
response_formatstringResponse format: 'text' (default, human-readable) or 'json' (machine-actionable).
NameTypeReqDescription
resultstringyes

No examples provided.

verify_recipe ~745

Verify a candidate recipe against a Guardian master recipe. Uses deterministic graph-based verification to check technique, temperature, timing, cooking medium, and required ingredients. **Verdict**: `verdict` is strictly PASSED or FAILED and is policy-driven — any CRITICAL finding fails the recipe; more than 5 WARNINGs also fail. There is no score in the response (ADR-013): gate on `verdict` and explain failures from `findings`. **Field audience**: `issue` is a machine-readable code for programmatic handling — never show it to end users. Use `title` and `suggested_correction` as the user-facing fields. Returns structured JSON by default (machine-actionable findings and patches); response_format="text" renders a human-readable report. Both formats are transparent (ADR-009 / ADR-018): exact values and ingredient names included.

NameTypeReqDescription
candidate_jsonThe full candidate recipe as a JSON string or object. Expected schema: {"title": "<string>", "cuisine": "<string>", "serves": <int>, "ingredients": [{"name": "<string>", "quantity": "<string>"}], "st…
dishAlias for dish_name — for backward compatibility with production clients.
dish_namestringName of the dish to verify against (e.g. 'carbonara', 'rendang', 'roast-chicken', 'confit', 'cheesecake', 'kung-pao', 'fried-chicken', 'brisket', 'wellington', 'cheese-souffle'). Use list_dishes() to…
master_jsonOptional user-supplied master SOP to verify against (BYO master, ADR-018), as a JSON string or object using the same schema as catalog masters (dish_name, steps[], required_ingredients[]; see get_mas…
operator_idOptional audit identifier for the calling operator (letters, digits, hyphens; max 64 chars). Tags the verification in the tamper-evident log and compliance record. Defaults to 'anonymous'.
original_promptRECOMMENDED for best results. Include the user's original cooking request. Copy the user's exact message that triggered this recipe (e.g., 'Make me a spicy vegan rendang' or 'Generate a traditional c…
response_formatstringResponse format: 'json' (default — machine-actionable verdict, findings, and patches) or 'text' (human-readable report).
session_idOptional session ID to track an agent's improvement loop across multiple attempts.
NameTypeReqDescription
resultstringyes

No examples provided.