# AXIS Toolbox — Agentic Commerce Codebase Intelligence (remote · axis-api-6c7z.onrender.com)

Generate AGENTS.md, AP2 compliance docs, checkout rules, debug playbook & MCP configs from any repo.

- Trust score: 56/100 (low)
- Change this week: +6
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

> **Recent critical change**: Authorization (2026-07-29). See the changelog below before you install this server.

## Components

- remote · `axis-api-6c7z.onrender.com`: 56/100 (this document), [markdown](https://verifymcp.io/servers/lastmanupinc-hub-axis-toolbox/axis-api-6c7z.md), [page](https://verifymcp.io/servers/lastmanupinc-hub-axis-toolbox/axis-api-6c7z)

## Channel facts

- Endpoint: `https://axis-api-6c7z.onrender.com/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `0.4.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Endpoint Security**: 63/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (iliad_object_storage).
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 24/100
  - AI-judged instruction clarity (poor).
  - Context-footprint check failed: tool/resource definitions use about 10781 tokens (~291/item across 37 items; 37 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Capabilities**: 40/100
  - Spec-recency check failed: implements MCP spec 2025-03-26; the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add --transport http lastmanupinc-hub-axis-toolbox https://axis-api-6c7z.onrender.com/mcp
```

### Codex

```toml
[mcp_servers.lastmanupinc-hub-axis-toolbox]
url = "https://axis-api-6c7z.onrender.com/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "lastmanupinc-hub-axis-toolbox": {
      "type": "remote",
      "url": "https://axis-api-6c7z.onrender.com/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add lastmanupinc-hub-axis-toolbox --url https://axis-api-6c7z.onrender.com/mcp --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  lastmanupinc-hub-axis-toolbox:
    url: "https://axis-api-6c7z.onrender.com/mcp"
```

### Other

```json
{
  "mcpServers": {
    "lastmanupinc-hub-axis-toolbox": {
      "type": "http",
      "url": "https://axis-api-6c7z.onrender.com/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 56, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-31 (score 55, +41)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 14, −37)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-29 (score 51, 0)

- [critical regression] Authorization: unverified → fail

### 2026-07-28 (score 51, +1)

- [security regression] Authorization: fail → unverified

### 2026-07-27 (score 50, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-26 (score 49)

First indexed and scored.

## MCP tools (37)

### `analyze_repo` (~226 tokens)

Analyze a GitHub repository and generate 142 structured AXIS artifacts across 20 programs. Returns snapshot_id plus an artifacts listing; use get_artifact to read files and get_snapshot to re-enumerate outputs without re-running analysis. Requires Authorization: Bearer <api_key>. Use this when the source of truth is a GitHub repo URL. Pricing: $0.50 standard, $0.15 lite budget mode, $25 engineer per repo. Engineer mode (X-Agent-Mode: engineer — Living Architecture) adds a verified LLM specificity pass: a living-architecture.md whose every architectural claim is grounded in the repo's extracted facts or dropped. This is the paid path for full repo analysis and can return authentication, quota, payment-required, invalid-URL, or GitHub-fetch errors. private repos require a stored GitHub token. Use analyze_files instead for inline file payloads or list_programs/search_and_discover_tools when you are still selecting a workflow.

Input parameters:

- `github_url` (string, required): GitHub repository URL (https://github.com/owner/repo)

Output parameters:

- `artifact_count` (number)
- `artifacts` (array)
- `content_discarded_at` (string|null): ISO timestamp if this snapshot's source content was discarded after the owning account's web session logged out (R5.7), null if content is still live.
- `programs_executed` (array)
- `project_id` (string)
- `snapshot_id` (string)
- `status` (string)

### `analyze_files` (~189 tokens)

Analyze source files directly and generate the full 142-artifact AXIS bundle without using GitHub. Returns snapshot_id plus artifact listing; use this for local, generated, or unsaved code. Requires Authorization: Bearer <api_key>. Pricing: $0.50 standard, $0.15 lite budget mode, $25 engineer per run (same tiers as analyze_repo). Can return authentication, quota, payment-required, file-limit, or validation errors. Use analyze_repo for GitHub URLs or improve_my_agent_with_axis for recommendation-first agent hardening.

Input parameters:

- `files` (array, required): Source files to analyze
- `frameworks` (array, required): Detected or known frameworks
- `goals` (array, required): Analysis goals
- `project_name` (string, required): Name of the project
- `project_type` (string, required): Project type (web_application, api_service, cli_tool, library, monorepo)

Output parameters:

- `artifact_count` (number)
- `artifacts` (array)
- `content_discarded_at` (string|null): ISO timestamp if this snapshot's source content was discarded after the owning account's web session logged out (R5.7), null if content is still live.
- `programs_executed` (array)
- `project_id` (string)
- `snapshot_id` (string)
- `status` (string)

### `list_programs` (~67 tokens)

Inventory mode. List all 20 AXIS programs, their generators, pricing tier, and artifact paths. Free, no auth, and no side effects. Use search_and_discover_tools instead when you only have a keyword, or discover_commerce_tools when you need install and onboarding metadata.

Output parameters:

- `free_programs` (array)
- `pro_programs` (array)
- `programs` (array)
- `total_generators` (number)
- `total_programs` (number)

### `get_snapshot` (~175 tokens)

Retrieve status and the full artifact listing for a prior analysis by snapshot_id. Use this to re-enumerate artifact paths without re-running analysis. Snapshots created with an API key are scoped to that same account — pass the same Authorization: Bearer <api_key> used to create it, or retrieval fails with a not-found error. Only anonymous (never-authenticated) snapshots are freely retrievable by any caller. The response's content_discarded_at is non-null if the owning account's web session has since logged out — source content is gone (closer/deploy/skills/search_index calls on this snapshot will fail with content_discarded until it's re-uploaded), though this call itself still succeeds and generated artifacts remain listable.

Input parameters:

- `snapshot_id` (string, required): Snapshot ID returned by analyze_repo or analyze_files

Output parameters:

- `artifact_count` (number)
- `artifacts` (array)
- `content_discarded_at` (string|null): ISO timestamp if this snapshot's source content was discarded after the owning account's web session logged out (R5.7), null if content is still live.
- `programs_executed` (array)
- `project_id` (string)
- `snapshot_id` (string)
- `status` (string)

### `get_artifact` (~105 tokens)

Read one generated artifact by snapshot_id and path. Requires access to the snapshot and may return snapshot-not-found, invalid-path, or artifact-not-found errors. Example: snapshot_id=abc-123, path=AGENTS.md. Use this when you need the full text of one artifact. Use get_snapshot instead when you first need the artifact list.

Input parameters:

- `path` (string, required): Artifact file path as returned in the artifacts list
- `snapshot_id` (string, required): Snapshot ID

### `prepare_agentic_purchasing_preview` (~217 tokens)

Compute a free Purchasing Readiness Score (0-100) and gap list for a codebase without generating artifacts. No auth, no charge, no snapshot persisted. Hard caps: 25 files / 50KB per file / 1MB total. Returns score, risk_level, top gaps, frameworks detected, and which AXIS programs would close which gaps. Use this to triage 'should I pay for the full hardening bundle?' before calling prepare_agentic_purchasing. The paid version generates the full artifact bundle including CE 3.0 dispute evidence, SCA exemption matrix, and TAP interop.

Input parameters:

- `files` (array, required): Source files to triage (max 25 files, 50KB each, 1MB total)
- `frameworks` (array): Optional framework hints
- `project_name` (string, required): Name of the project being previewed
- `project_type` (string): Optional project type hint (web_application, api_service, cli_tool, library, monorepo)

Output parameters:

- `conversion` (object)
- `cost` (string)
- `frameworks_detected` (array)
- `gaps` (array)
- `interpretation` (string)
- `risk_level` (string)
- `score` (number): Current Purchasing Readiness Score (0-100) for the codebase as submitted
- `strengths` (array)
- `top_3_gaps` (array)
- `what_axis_would_add` (array)

### `prepare_agentic_purchasing` (~455 tokens)

Prepare a codebase for agentic purchasing and return a readiness score plus commerce artifacts. Requires Authorization: Bearer <api_key>; paid analysis records a new snapshot and may return auth, quota, payment, file-limit, or validation errors. Pricing: $0.50 standard, $0.25 lite budget mode, $250 engineer per run. Lite mode returns the readiness score + top 3 gaps only, with an artifacts_note pointing at standard mode for the full artifact bundle — it does NOT include the artifacts themselves. Standard and engineer modes return the full bundle. focus_areas is recorded and echoed back in the response for the caller's own bookkeeping; it does not filter which artifacts are generated. Use this when you need AP2/UCP/Visa, CE 3.0 dispute evidence, checkout, dispute, and negotiation hardening. Engineer mode (X-Agent-Mode: engineer — Commerce Integration) also emits a deployable x402/AP2/PAI'D endpoint + a runnable sandbox test + a schema-validatable CE 3.0 pack + a transparent dispute-readiness score (a working integration, not just a score), plus a deployable Stripe network-token read adapter when a stripe signal is detected. Use discover_agentic_purchasing_needs instead when you only need workflow triage.

Input parameters:

- `agent_type` (string): Consuming agent type hint
- `budget_per_run_cents` (number): Agent budget for this call in cents
- `files` (array, required): Array of {path, content} objects representing source files
- `focus` (string): Analysis focus (default: purchasing)
- `focus_areas` (array): Compliance focus areas, recorded and echoed back in the response for the caller's own reference — does not filter which artifacts are generated.
- `frameworks` (array, required): Detected or known frameworks
- `goals` (array, required): Project goals
- `project_name` (string, required): Name of the project
- `project_type` (string, required): Project type (web_application, api_service, cli_tool, library, monorepo)
- `referral_token` (string): Optional referral token from another agent
- `spending_window` (string): Agent spending window

Output parameters:

- `artifact_count` (number)
- `programs_executed` (array)
- `project_id` (string)
- `snapshot_id` (string)
- `status` (string)
- `summary` (object)

### `closer` (~172 tokens)

Package an existing AXIS snapshot (create one first via analyze_repo, analyze_files, or prepare_agentic_purchasing) into complete professional packaging + marketplace certification artifacts so a 70-80%-complete project is ready to ship and sell. Requires a paid plan or entitlement. Pricing: $0.50 standard, $0.25 lite budget mode.

Input parameters:

- `product_name` (string): Optional branding override for product name
- `project_root` (string): Optional local project root path hint (metadata only in remote MCP mode)
- `snapshot_id` (string, required): Existing AXIS snapshot_id to package into a distributable product
- `tagline` (string): Optional branding tagline
- `target_marketplaces` (array): Optional marketplaces list (e.g. npm, unreal, vscode, dockerhub, github-marketplace)

Output parameters:

- `artifact_count` (number)
- `artifacts` (array)
- `program` (string)
- `project_id` (string)
- `snapshot_id` (string)

### `deploy` (~151 tokens)

Generate a zero-pipeline-minutes deploy bundle: stack-aware Dockerfile, .dockerignore, dev compose, render.yaml (Render existing-image), wrangler.pages.toml + wrangler.containers.toml + worker.ts (Cloudflare), bash/PowerShell push scripts, and a qualification report. The project builds locally in VSCode, pushes images to GHCR or via wrangler, and Render/Cloudflare just pulls — no GitHub Actions minutes, no Render build pipeline minutes, no CF build minutes. Requires a paid plan or entitlement. Pricing: $0.50 standard, $0.25 lite budget mode.

Input parameters:

- `snapshot_id` (string, required): Existing AXIS snapshot_id to package into deploy artifacts

Output parameters:

- `artifact_count` (number)
- `artifacts` (array)
- `program` (string)
- `project_id` (string)
- `snapshot_id` (string)

### `search_and_discover_tools` (~126 tokens)

Search AXIS programs by keyword and return ranked matches with artifact paths. Free, no auth, and no stateful side effects. Example: q=checkout returns commerce-relevant programs first. Use this when you know the outcome you want but not the right program. Use list_programs instead for the full catalog, discover_commerce_tools for install metadata, or discover_agentic_purchasing_needs for purchasing-specific triage.

Input parameters:

- `program` (string): Optional: filter results to a specific program name
- `q` (string): Search query — keyword or phrase

Output parameters:

- `program_filter` (string|null)
- `query` (string|null)
- `results` (array)
- `total_matches` (number)

### `discover_commerce_tools` (~93 tokens)

Discover AXIS install metadata, pricing, and shareable manifests for commerce-capable agents. Free, no auth, and no mutation beyond read access. Example: call before wiring AXIS into Claude Desktop, Cursor, or VS Code. Use this when you need onboarding and ecosystem setup details. Use search_and_discover_tools instead for keyword routing or discover_agentic_purchasing_needs for purchasing-task triage.

Output parameters:

- `axis_iliad` (object)
- `free_tools` (array)
- `install` (object)
- `shareable_manifest` (object)
- `tools` (array)

### `ping_payment` (~119 tokens)

Exercise the real x402 payment-flow loop at $0 — zero risk, no auth required. Call it once with no payment credential to receive a 402-style payment_required challenge (the exact same shape every real paid tool returns); retry the same tools/call carrying a payment credential in Authorization (with your API key moved to X-Axis-Key) to get a success envelope. Learn the vocabulary here before paying real money for prepare_agentic_purchasing or analyze_repo. No side effects on any other tool, no real payment rail is ever touched.

Output parameters:

- `_payment_required` (boolean)
- `message` (string)
- `ok` (boolean)
- `settled_cents` (number)
- `tool` (string)

### `improve_my_agent_with_axis` (~130 tokens)

Analyze an agent codebase and return a prioritized AXIS hardening plan. Requires Authorization: Bearer <api_key>; this creates a snapshot and may return auth, quota, file-limit, or validation errors. Example: pass your agent source files to see missing AGENTS.md, CLAUDE.md, and MCP config gaps. Use this when you want recommendations and missing-context detection. Use analyze_files instead when you want the full artifact bundle directly.

Input parameters:

- `files` (array, required): Source files of the agent to analyze
- `project_name` (string, required): Name of the agent/project to improve

Output parameters:

- `analysis` (object)
- `call_again` (object)
- `improvement_plan` (object)
- `mcp_config` (object)
- `project_name` (string)
- `snapshot_id` (string)

### `discover_agentic_purchasing_needs` (~136 tokens)

Discover the best AXIS workflow for a purchasing or compliance task. Free, no auth, and logs lightweight task metadata for intent analytics. Example: task_description='prepare for autonomous Visa checkout'. Use this when you need commerce-specific triage and next-step guidance. Use search_and_discover_tools instead for non-commerce keyword routing across all programs.

Input parameters:

- `current_readiness` (number): Optional: current Purchasing Readiness Score (0-100) if known
- `focus_areas` (array): Optional: specific areas to focus on
- `task_description` (string): What the agent is trying to accomplish

Output parameters:

- `matched_capabilities` (array)
- `readiness` (object)
- `recommended_next_step` (object)
- `task_description` (string)

### `get_referral_code` (~91 tokens)

Get or create the caller's AXIS referral token. Requires Authorization: Bearer <api_key>, has no usage charge, and may persist a new referral code if one does not exist yet. Example: call before sharing AXIS with another agent or workspace. Use this when you need the shareable token itself. Use get_referral_credits instead when you need balances, milestones, and discount status.

Output parameters:

- `cost` (string)
- `current_earnings` (object)
- `next_milestone` (string)
- `referral_token` (string)
- `share_instruction` (string)

### `get_referral_credits` (~87 tokens)

Get the caller's referral earnings, milestones, and free-call status. Requires Authorization: Bearer <api_key>, has no usage charge, and returns the current discount ledger without creating a new analysis. Example: call after a referral campaign to inspect earned credits. Use this when you need balances and milestones. Use get_referral_code instead when you only need the shareable token.

Output parameters:

- `cost` (string)
- `discount_active` (boolean)
- `earned_credits_millicents` (number)
- `earned_discount` (string)
- `free_calls_remaining` (number)
- `lifetime_referrals` (number)
- `next_milestone` (string)
- `paid_call_count` (number)
- `persistence_credits_remaining` (number)
- `referral_token` (string)
- `tier` (string)

### `iliad_web_research` (~196 tokens)

Scrape a single URL with AXIS's owned crawler (SSRF-guarded fetch, robots.txt-aware, readability extraction — no third-party key) and return markdown-formatted content. Honest scope: fetches static HTML only, no JavaScript rendering, so client-rendered SPA pages may extract thin content. Returns markdown body, extracted metadata, and title. Best for research, documentation reading, or SEO analysis. Requires Authorization: Bearer <api_key>. Pricing: $0.10 standard, $0.05 lite per page. If the operator's backend configuration is incomplete, this call returns {_not_configured:true} instead of scraping, and is not billed. Use iliad_web_research_crawl for crawling multiple pages or link following.

Input parameters:

- `only_main_content` (boolean): Extract only the main content (default: true)
- `url` (string, required): The URL to scrape (http or https)

Output parameters:

- `data` (object)
- `error` (string): Error message if request failed
- `success` (boolean)

### `iliad_web_research_crawl` (~219 tokens)

Crawl a domain with AXIS's owned crawler — a same-origin BFS frontier with robots.txt compliance and per-host politeness, no third-party key — and scrape multiple pages. Honest scope: static HTML only, no JavaScript rendering. Returns array of scraped pages with markdown content. Best for site mapping, content audits, or bulk research. Requires Authorization: Bearer <api_key>. Pricing: $0.01/page beyond your account's shared 100-page/month free pool (standard and lite) — a crawl fully covered by the free pool costs $0.00; a fully-paid 100-page crawl costs up to $1.00. If the operator's backend configuration is incomplete, this call returns {_not_configured:true} instead of crawling, and is not billed. Use iliad_web_research for single-page scrapes.

Input parameters:

- `limit` (number): Maximum pages to crawl (1-100, default: 10)
- `url` (string, required): The domain/URL to crawl (http or https)

Output parameters:

- `data` (object)
- `error` (string): Error message if request failed
- `success` (boolean)

### `iliad_object_storage` (~506 tokens)

AXIS-owned signed-URL minter backed by Cloudflare R2. Returns a pre-signed PUT or GET URL scoped to the calling account (keys are prefixed with `accounts/<account_id>/` server-side, so accounts can't reach each other's objects). Requires Authorization: Bearer <api_key>. Returns the URL plus expires_at (ISO 8601), bucket, and scoped_key. Returns `{_not_configured: true, ...}` when the operator has not provisioned R2_* env vars (no crash, no leaked secrets); not billed when not configured. Pricing: $0.01 standard, free in lite mode. TTL is capped at 86400 seconds (24h). Engineer mode (X-Agent-Mode: engineer — Managed Bucket, $0.05): adds delete + list + copy (server-side, no bytes through the agent) operations, content-addressed dedup keys (content_sha256), and mint-time PUT policy (pin content_type / exact content_length as signed headers R2 enforces).

Input parameters:

- `content_length` (number): Engineer mode (put): pin the EXACT byte size the upload must be (signed; ≤5 GiB). Pairs with content_sha256 for verified content-addressed writes.
- `content_sha256` (string): Engineer mode: 64-char hex sha256 of the bytes you'll PUT. When set, the object lands under accounts/<id>/cas/<sha256> so identical content dedupes.
- `content_type` (string): Engineer mode (put): pin the Content-Type the upload must send (signed; R2 rejects a mismatch). Printable ASCII type/subtype, ≤255 chars. Echo via required_headers.
- `ext` (string): Engineer mode: optional extension appended to the content-addressed key (e.g. 'png').
- `key` (string, required): Object key (max 1024 chars), or the prefix for operation=list. Path traversal and leading-/ are rejected.
- `operation` (string, required): put / get (standard). delete / list / copy and content-addressed put require X-Agent-Mode: engineer (Managed Bucket).
- `source_key` (string): Engineer mode (operation=copy): source object key to copy from, scoped to your account; `key` is the destination. Echo the returned required_headers on the PUT.
- `ttl_seconds` (number): Signed-URL lifetime, 1..86400. Defaults to 3600.

Output parameters:

- `bucket` (string): Resolved R2 bucket name.
- `expires_at` (string): ISO-8601 expiry timestamp.
- `operation` (string): PUT or GET — what the URL was signed for.
- `scoped_key` (string): Server-side key after account scoping (the user-supplied key prefixed with accounts/<account_id>/).
- `url` (string): Pre-signed URL valid for ttl_seconds.

### `iliad_vector_database` (~360 tokens)

AXIS-owned vector store. Two operations: `upsert` (insert or replace vectors) and `query` (cosine top-k nearest neighbors). Namespaces are account-scoped server-side (`acct:<account_id>:<namespace>`), so tenants cannot read each other's vectors. Persistent across restarts via Postgres. Requires Authorization: Bearer <api_key>. Pricing: $0.01 standard, free in lite mode. Best for RAG retrievers, deduplication, and similarity search. Engineer mode (X-Agent-Mode: engineer — Managed Memory, $0.05): query runs a pgvector/HNSW ANN candidate pool with optional recency-decay reranking (recency_half_life_days — managed forgetting), RRF hybrid fusion (sparse_ids), and metadata filter; upsert applies intra-batch semantic-dedup (dedup_threshold).

Input parameters:

- `dedup_threshold` (number): Engineer upsert: cosine threshold for intra-batch semantic-dedup (default 0.97).
- `namespace` (string): Logical isolation key. Defaults to 'default'. Account ID is always prepended server-side.
- `operation` (string, required): upsert (insert/replace) or query (top-k cosine).
- `query` (object): {vector: number[], top_k?: number, filter?: object}. Engineer mode also reads recency_half_life_days (number — exponential recency decay) and sparse_ids (string[] — RRF hybrid fusion). Required for q…
- `semantic_dedup` (boolean): Engineer upsert: set false to disable dedup (default on).
- `vectors` (array): Array of {id, vector, metadata?} — required for upsert.

Output parameters:

- `backend` (string): Engineer query: 'pgvector' or 'js' — which ANN path served the query.
- `engineer` (object): Engineer query only: { ann, recency_decay, hybrid_fusion } flags.
- `matches` (array): Nearest neighbors sorted by score desc (query mode only).
- `namespace` (string): Scoped namespace the call wrote to or queried.
- `operation` (string): Echo of the operation that ran.
- `semantic_dedup` (object): Engineer upsert only: { dropped: [{id, duplicate_of, similarity}] } — vectors dropped as intra-batch duplicates.
- `total_in_namespace` (number): Total vectors in this namespace after the call (upsert mode only).
- `upserted` (number): Vectors written (upsert mode only).

### `iliad_embeddings` (~398 tokens)

Convert text into dense vectors. Accepts a single string or a batch (max 2048). Returns one vector per input. AXIS-owned in-process inference by default (node-llama-cpp + an embedding-capable GGUF at AXIS_EMBEDDING_MODEL_PATH — no upstream provider call); an optional OpenAI /v1/embeddings backend is available behind AXIS_EMBEDDING_BACKEND=openai (model: text-embedding-3-small by default, overridable via OPENAI_EMBEDDING_MODEL; reports token usage). Requires Authorization: Bearer <api_key> to call. Pricing: $0.05 standard, $0.02 lite. When the selected backend is not provisioned (local: GGUF file absent; openai: OPENAI_API_KEY unset), returns a structured `_not_configured: true` envelope naming the backend and remediation, and is not billed. Pairs natively with iliad_vector_database — feed `vectors` from this tool's output into `vector` of the vector_database upsert/query calls. Engineer mode (X-Agent-Mode: engineer — Domain Embeddings, $0.08): pass `dimensions` (Matryoshka truncation → smaller vectors) and/or `corpus_adapter: true` (mean-center the batch to sharpen retrieval on your data); returns an `engineer` block with the fitted adapter_mean for query alignment.

Input parameters:

- `corpus_adapter` (boolean): Engineer mode: mean-center the batch (all-but-the-mean) to sharpen retrieval; returns the fitted adapter_mean.
- `dimensions` (number): Engineer mode: truncate each vector to this many leading dims (Matryoshka) + renormalize. Smaller, cheaper vectors.
- `input` (string|array, required): A single string or an array of strings to embed. Empty strings and entries > 32k chars are rejected (chunk before calling).

Output parameters:

- `engineer` (object): Engineer mode only: { dimensions, truncated, adapter_applied, adapter_mean? } — the post-processing applied + the fitted corpus mean.
- `input_count` (number): Number of inputs submitted (matches vectors.length).
- `model_used` (string): Concrete embedding model used: the GGUF filename on the local backend, or the provider model name on the openai backend.
- `usage` (object): {prompt_tokens, total_tokens} — openai backend only (the local in-process backend has no provider token report).
- `vectors` (array): Array of dense vectors. vectors[i] corresponds to input[i] (order preserved).

### `iliad_transactional_email` (~426 tokens)

Send a single transactional email. Requires Authorization: Bearer <api_key>. Provide either body_html, body_text, or both (Resend will pick the best variant per recipient). All emails ship from RESEND_FROM_ADDRESS — operator must verify that domain in Resend before sending. Returns the provider-assigned message_id plus the accepted recipient list. Pricing: $0.02 standard, $0.01 lite. Returns a structured _not_configured envelope when RESEND_API_KEY or RESEND_FROM_ADDRESS is missing, and is not billed. Recipients capped at 50 per call; subject capped at 998 chars; bodies capped at 1 MB. Engineer mode (X-Agent-Mode: engineer — Deliverability, $0.50): instead of sending, pass a `domain` and get a full SPF/DKIM/DMARC setup (fresh DKIM keypair) + sender warmup schedule + verification checklist — no email sent, no ESP key needed.

Input parameters:

- `body_html` (string): HTML body. At least one of body_html / body_text required.
- `body_text` (string): Plaintext body. At least one of body_html / body_text required.
- `dkim_selector` (string): Engineer mode: DKIM selector (alphanumeric/hyphen, 1-32). Defaults 'axis'.
- `dmarc_policy` (string): Engineer mode: DMARC policy none|quarantine|reject. Defaults none (monitoring).
- `domain` (string): Engineer mode (Deliverability): domain to generate SPF/DKIM/DMARC setup for. Replaces the send.
- `provider` (string): Engineer mode: ESP for the SPF include (resend/sendgrid/mailgun/postmark/ses/google). Defaults resend.
- `reply_to` (string): Optional Reply-To address.
- `subject` (string): Email subject (max 998 chars, RFC 5322).
- `to` (string|array): Recipient address or array of addresses (max 50). Required for a send (standard mode).

Output parameters:

- `delivered_to` (array): Recipients the provider accepted.
- `from` (string): RESEND_FROM_ADDRESS used as the From: header.
- `message_id` (string): Provider-assigned message ID.
- `subject` (string): Subject sent (echo).

### `iliad_llm_inference` (~558 tokens)

AXIS-hosted LLM chat-completion via node-llama-cpp + a small GGUF model loaded in-process. Two input shapes accepted: `prompt` (single string) or `messages` (chat-style array of {role, content}). Sampling controls: `max_tokens` (≤2048), `temperature` (0-2), `top_k`, `top_p`, `seed` (threaded through for more deterministic output — NOT a proven byte-identical guarantee; thread count isn't pinned and GGML's multi-threaded matmul reduction order isn't guaranteed bit-exact across runs), `stop` (string[]). Inference runs in-process — no upstream LLM provider call — but this AXIS tool call is still billed: $0.02 standard, $0.01 lite. Operator sets AXIS_LLM_MODEL_PATH to point at a Phi-3-mini / TinyLlama / Llama-3.2-1B GGUF; if missing, the tool returns a `_not_configured: true` envelope and is not billed. Engineer mode (X-Agent-Mode: engineer — Constrained Inference, $0.10): pass a `json_schema` and decoding is grammar-constrained to it AND the output is validated against it (returns a `structured` block with valid + parsed + schema_errors) — guaranteed-valid structured output. Requires Authorization: Bearer <api_key>.

Input parameters:

- `json_schema` (object): Engineer mode (required): a JSON Schema. Decoding is grammar-constrained to it and the output is validated against it; returns a `structured` block.
- `max_tokens` (number): Max tokens to generate. Defaults 512, hard cap 2048.
- `messages` (array): Chat-style input. Array of {role: system|user|assistant, content: string}.
- `prompt` (string): Single-prompt completion input. Use either this OR messages, not both.
- `seed` (number): Optional seed, threaded through with temperature for more deterministic output. Not a proven byte-identical guarantee (thread count/matmul reduction order isn't pinned) — see the tool description.
- `stop` (array): Stop sequences. Generation halts when any string in the array is produced.
- `system` (string): Optional system prompt (prompt mode only). For messages mode, use role=system entries.
- `temperature` (number): Sampling temperature in [0, 2]. Defaults 0.7.
- `top_k` (number): Top-k sampling (positive integer). Defaults 40.
- `top_p` (number): Top-p nucleus sampling in (0, 1]. Defaults 0.95.

Output parameters:

- `_not_configured` (boolean): True when no GGUF model is present at AXIS_LLM_MODEL_PATH.
- `completion_tokens` (number): Token count of the generated text (best-effort).
- `model_path` (string): Path checked for the GGUF file (only present when _not_configured=true).
- `model_used` (string): Basename of the GGUF model file used.
- `prompt_tokens` (number): Token count of the input prompt (best-effort).
- `reason` (string): Why the tool returned _not_configured (only present when true).
- `remediation` (string): How the operator should fix the missing-model condition.
- `structured` (object): Engineer mode only: { schema_constrained, valid, parsed, schema_errors } — the guaranteed-valid structured-output verdict.
- `text` (string): Generated completion text.

### `iliad_code_sandbox` (~461 tokens)

AXIS-owned secure code execution. Each call spawns a fresh ephemeral Docker container with hardened isolation: no network, read-only root filesystem, all Linux capabilities dropped, no-new-privileges, PID/memory/CPU limits, tmpfs /tmp only, runs as nobody:nobody. Container is force-removed after each call. Supports python | node | bash via the multi-runtime image `nikolaik/python-nodejs:python3.12-nodejs22-slim` (operator can override via AXIS_CODE_SANDBOX_IMAGE). Returns stdout/stderr/exit_code/timed_out/duration_ms/image. Wall-clock timeout enforced via SIGKILL + force-remove. Source is fed via stdin (no fs write to the read-only root). Code body capped at 256 KiB; stdin at 1 MiB; timeout 1-600 seconds (default 30); stdout/stderr each capped at 1 MiB output. Pricing: $0.05 standard, $0.02 lite — billed whenever a container actually ran, including a timeout or non-zero exit code. Not billed when the call instead returns `_not_configured: true`: no Docker daemon reachable (Render standard services don't expose /var/run/docker.sock), the operator has set AXIS_CODE_SANDBOX_DISABLED=1, or more than AXIS_SANDBOX_MAX_CONCURRENT (default 4) runs are already in flight (reason sandbox_busy — transient, retry shortly). Engineer mode (X-Agent-Mode: engineer — Verified Exec, $0.25): the result includes an Ed25519-signed attestation binding code-hash → output-hash + a per-account hash-chain entry, so another agent that pins AXIS's published key can verify the run without re-executing it. Requires Authorization: Bearer <api_key>.

Input parameters:

- `code` (string, required): Source code to execute. Fed via stdin to the interpreter. Max 256 KiB.
- `language` (string, required): Runtime language.
- `stdin` (string): Optional additional stdin appended after the code body. Max 1 MiB.
- `timeout_seconds` (number): Wall-clock limit. Defaults 30, max 600. SIGKILL on overrun.

Output parameters:

- `_not_configured` (boolean): True when the call didn't run (unreachable daemon, disabled, or at concurrency limit).
- `attestation` (object): Engineer mode only: Ed25519-signed attestation binding code-hash to output-hash, plus a per-account hash-chain entry.
- `duration_ms` (number): End-to-end wall time including container spawn + teardown.
- `exit_code` (number): Process exit code (137 on SIGKILL).
- `image` (string): Container image actually used.
- `reason` (string): docker_daemon_unreachable | dockerode_import_failed | disabled | sandbox_busy (only when _not_configured=true).
- `remediation` (string): How the operator (or, for sandbox_busy, the caller by retrying) should resolve the condition.
- `stderr` (string): Captured stderr (UTF-8, capped at 1 MiB).
- `stdout` (string): Captured stdout (UTF-8, capped at 1 MiB with truncation marker).
- `timed_out` (boolean): True if the wall-clock timeout fired.

### `iliad_document_parsing` (~461 tokens)

AXIS-owned document → Markdown extractor. Accepts either `document_url` (https fetch + 50 MiB cap + 60s timeout) or `document_base64` (inline bytes, 50 MiB decoded cap) — exactly one. Optional `mime_type` hint (application/pdf, application/vnd.openxmlformats-officedocument.wordprocessingml.document, text/html, text/markdown, text/plain); we sniff from magic bytes + URL extension when omitted. Format dispatch: PDF → pdfjs-dist text extraction (one block per page with `--- page N ---` separators); DOCX → mammoth → markdown (tables preserved); HTML → tag-strip with heading + list + entity handling (NOT a full HTML→MD converter — bring turndown if you need fancier); plain text + markdown → passthrough. Returns `{markdown, format_detected, byte_size, page_count, table_count, truncated}`. Output capped at 1 MiB markdown with a truncation marker. Pricing: $0.02 standard, $0.01 lite. Engineer mode (X-Agent-Mode: engineer — Document Intelligence, $0.10): adds an `engineer` block with retrieval chunks (heading-aware, overlapping) + extract-to-caller-schema (pass `json_schema` → a grammar-constrained, validated typed object) + image OCR (image/* via document_base64, capped at 10 MiB — smaller than the 50 MiB document cap; an OCR failure or oversized image returns a descriptive `reason` that may not match the standard-mode enum) — typed data, not just markdown. Requires Authorization: Bearer <api_key>.

Input parameters:

- `document_base64` (string): Base64-encoded document bytes. Use this OR document_url, not both.
- `document_url` (string): https URL to a document. Use this OR document_base64, not both.
- `json_schema` (object): Engineer mode: a JSON Schema. The document is extracted into a validated object matching it (returned in engineer.extracted).
- `mime_type` (string): Optional MIME-type hint. When omitted we sniff from magic bytes + URL extension. Engineer mode: an image/* mime triggers OCR.

Output parameters:

- `_not_configured` (boolean): True when a prerequisite is missing or the document was unsupported.
- `byte_size` (number): Raw byte size of the source document.
- `engineer` (object): Engineer mode only: { chunk_count, chunks, extracted? } — retrieval chunks + optional schema-validated extraction.
- `format_detected` (string): pdf | docx | html | markdown | text | unknown | image (engineer-mode OCR path only).
- `markdown` (string): Extracted text, formatted as Markdown when the source had structure.
- `page_count` (number|null): Page count for PDFs; null otherwise.
- `reason` (string): document_download_failed | document_decode_failed | unsupported_format | parse_failed | pdf_runtime_missing | docx_runtime_missing (only when _not_configured=true).
- `remediation` (string): Operator-actionable fix.
- `table_count` (number): Number of tables detected in the rendered markdown (DOCX only; 0 elsewhere).
- `truncated` (boolean): True when the markdown output was capped at the 1 MiB ceiling.

### `iliad_web_search` (~443 tokens)

AXIS-owned BM25 search engine over the corpus YOUR account has indexed. NOT a Google/Bing scraper — agents build their own searchable index by first calling operation='index' with documents (often pages fetched via iliad_web_research), then querying with operation='search'. Five operations: `index` (insert one or many documents), `search` (BM25 top-k ranked hits with snippet + score + metadata), `delete` (drop one doc), `delete_namespace` (drop all), `count`. Namespaces are account-scoped server-side (`acct:<id>:<namespace>`). Persistent across restarts via Postgres (the shared @axis/snapshots database). Search supports `max_results` (default 10, max 100) and `site` (restrict to a single URL host, case-insensitive). Only operation='search' is billed ($0.01 standard, free in lite mode) — index, delete, delete_namespace, and count are always free. Engineer mode (X-Agent-Mode: engineer — Answer Engine, $0.25): search also returns a grounded extractive answer with [n] citation spans over your corpus, reranked, refusing on weak evidence. Requires Authorization: Bearer <api_key>.

Input parameters:

- `doc_id` (string): Document id to remove. Required in delete mode.
- `document` (object): Single document {doc_id, url?, title?, content, metadata?} — used in index mode (alternative to documents[]).
- `documents` (array): Batch of documents (max 100). Transactional — malformed entry aborts the whole call.
- `max_results` (number): Cap on hits returned. Defaults 10, max 100.
- `namespace` (string): Logical isolation key. Defaults 'default'. Account id is always prepended server-side.
- `operation` (string, required): index | search | delete | delete_namespace | count.
- `query` (string): Search query (1-1024 chars). Required in search mode.
- `site` (string): Filter to a single URL host (e.g. 'docs.python.org', case-insensitive).

Output parameters:

- `hits` (array): BM25-ranked hits [{doc_id, url, title, snippet, score, metadata}] (search mode).
- `indexed` (number): Documents written (index mode).
- `namespace` (string): Scoped namespace the call touched.
- `operation` (string): Echo of the operation that ran.
- `query` (string): Echo of the search query (search mode).
- `removed` (boolean|number): delete: boolean; delete_namespace: count of rows removed.
- `total` (number): Document count (count mode).
- `total_in_namespace` (number): Documents currently in the namespace (index, search modes -- count mode returns this same figure under the field name `total` instead).

### `iliad_text_to_speech` (~482 tokens)

AXIS-owned voice synthesis via Piper (rhasspy/piper) + ffmpeg-static. Accepts `text` (1-5000 chars), optional `voice` slug (filename without extension; defaults to AXIS_PIPER_DEFAULT_VOICE or the first available voice), optional `format` (wav | mp3 | opus; defaults wav), optional `sentence_silence` (0-5 seconds, default 0.2). Returns `{audio_base64, format, voice_used, sample_rate, duration_seconds, byte_size}`. Inference runs in-process — no upstream provider call — but this AXIS tool call is still billed: $0.02 standard, $0.01 lite. When operator hasn't installed piper or placed voice .onnx + .onnx.json files in AXIS_PIPER_VOICE_DIR (default models/piper/), returns `{_not_configured: true, reason, detail, remediation}` and is not billed. format=mp3/opus additionally requires ffmpeg-static. Engineer mode (X-Agent-Mode: engineer — Brand Voice, $0.10): requires `brand_text` (a brand / voice-and-tone artifact — the call throws without it in engineer mode) and AXIS auto-derives the voice persona (Piper voice slug + sentence pacing) and synthesizes in it; the persona is echoed in the response. Requires Authorization: Bearer <api_key>.

Input parameters:

- `brand_text` (string): Required when X-Agent-Mode: engineer is set (the call throws without it); ignored otherwise. Brand / voice-and-tone artifact — AXIS derives a voice persona from it and synthesizes in that voice (over…
- `format` (string): Audio codec.
- `gender` (string): Engineer mode: persona gender override.
- `locale` (string): Engineer mode: persona locale override.
- `sentence_silence` (number): Per-sentence silence in seconds (0-5). Defaults 0.2.
- `text` (string, required): Text to speak. 1-5000 chars after trim.
- `voice` (string): Voice slug (filename without extension, e.g. 'en_US-amy-medium'). Defaults to first available voice or AXIS_PIPER_DEFAULT_VOICE.

Output parameters:

- `_not_configured` (boolean): True when a prerequisite is missing.
- `audio_base64` (string): Base64-encoded audio bytes in the requested format.
- `byte_size` (number): Byte length of the encoded audio (post-transcode for mp3/opus).
- `duration_seconds` (number): Audio duration in seconds, computed from the WAV header.
- `format` (string): Echo of the requested format.
- `persona` (object): Engineer mode only: the derived voice persona (voice slug, sentence_silence, locale, gender, tone_tags) used for this synthesis.
- `reason` (string): piper_cli_not_found | voice_dir_missing | no_voices_available | voice_model_not_found | voice_config_not_found | ffmpeg_static_missing | synthesis_failed (only when _not_configured=true).
- `remediation` (string): Operator-actionable fix for the unconfigured prerequisite.
- `sample_rate` (number): WAV sample rate parsed from the RIFF header (typically 22050 for Piper).
- `voice_used` (string): Voice slug that was used (resolved if caller omitted `voice`).

### `iliad_speech_to_text` (~503 tokens)

AXIS-owned audio transcription via whisper.cpp + ffmpeg-static. Accepts either `audio_url` (https URL we fetch, max 100 MiB, 60s download timeout) or `audio_base64` (inline bytes, max 100 MiB decoded) — exactly one. Accepts any audio format ffmpeg can decode (mp3, wav, m4a, opus, ogg, flac); we resample to 16 kHz mono WAV internally. Optional `language` (ISO-639-1 like "en" / "fr" / "ja", or "auto" — default). Optional `initial_prompt` (≤512 chars; biases spelling of rare names). Optional `word_timestamps` boolean. Returns `{text, segments: [{start, end, text}], language_detected, duration_seconds, model_used}`. Pricing: $0.03 standard, $0.01 lite. When operator hasn't installed whisper-cli or placed the GGML model file at AXIS_WHISPER_MODEL_PATH (default `models/ggml-base.en.bin`), returns `{_not_configured: true, reason, detail, remediation}` and is not billed. Engineer mode (X-Agent-Mode: engineer — Diarization, $0.10): the response adds `diarization` — speaker turns grouped from the segments by inter-segment pause gaps (tune with diarization_gap_seconds / max_speakers; this is pause-based turn segmentation, not acoustic speaker ID). Requires Authorization: Bearer <api_key>.

Input parameters:

- `audio_base64` (string): Base64-encoded audio bytes. Use this OR audio_url, not both.
- `audio_url` (string): https URL to an audio file. Use this OR audio_base64, not both.
- `diarization_gap_seconds` (number): Engineer mode: pause (seconds) between segments that starts a new speaker turn. Defaults 0.75.
- `initial_prompt` (string): Optional bias prompt (≤512 chars) — useful for spelling of rare names.
- `language` (string): ISO-639-1 language code (en, fr, ja, ...) or 'auto' to autodetect. Defaults 'auto'.
- `max_speakers` (number): Engineer mode: max alternating speaker labels. Defaults 2.
- `word_timestamps` (boolean): Emit word-level timestamps within segments. Defaults false.

Output parameters:

- `_not_configured` (boolean): True when a prerequisite is missing.
- `diarization` (array): Engineer mode only: speaker turns [{speaker, start, end, text}] grouped from segments by inter-segment pause gaps.
- `duration_seconds` (number): Audio duration as inferred from the last segment end timestamp.
- `language_detected` (string): Language code whisper detected (or echoed from input language).
- `model_used` (string): Basename of the GGML model file used.
- `reason` (string): model_file_not_found | whisper_cli_not_found | ffmpeg_static_missing | audio_download_failed | audio_decode_failed (only when _not_configured=true).
- `remediation` (string): Operator-actionable fix for the unconfigured prerequisite.
- `segments` (array): [{start: seconds, end: seconds, text}] timestamped segments.
- `text` (string): Full transcript text, joined from segments.

### `iliad_analytics` (~312 tokens)

AXIS-owned product analytics. Two operations: `capture` (insert events) and `query` (aggregations). Capture accepts a single `event` or a batch via `events[]` (max 500). Query kinds: `count` (total events), `count_by_event` (top events by frequency), `distinct_users` (unique user_id count), `count_by_bucket` (time-series with minute/hour/day buckets). All queries support optional `event`, `from_ts`, `to_ts`, and `property_filter` filters. Namespaces are account-scoped server-side (`acct:<account_id>:<namespace>`). Persistent across restarts via Postgres (the shared @axis/snapshots database). Pricing: $0.01 standard, free in lite mode. Requires Authorization: Bearer <api_key>. Best for funnels, cohorts, and retention on workloads up to ~1M events per account.

Input parameters:

- `event` (object): Single event payload {event, user_id?, properties?, timestamp?} — used in capture mode.
- `events` (array): Batch of event payloads (max 500). Transactional — partial inserts never persist.
- `namespace` (string): Logical isolation key. Defaults to 'default'. Account id is always prepended server-side.
- `operation` (string, required): capture or query.
- `query` (object): {kind, event?, from_ts?, to_ts?, property_filter?, bucket?, limit?} — used in query mode.

Output parameters:

- `captured` (number): Events written (capture mode only).
- `namespace` (string): Scoped namespace the call wrote to or queried.
- `operation` (string): Echo of the operation that ran.
- `result` (object): Aggregation result shape depending on query.kind (query mode only).

### `iliad_hygiene` (~381 tokens)

AXIS-owned workspace hygiene grader. Analyzes an inline file set [{path,content}] and returns a letter grade (A-F) across a closed set of dimensions plus structured findings. Two modes: mode='scan' (DEFAULT, FREE) returns grade + findings (committed-secret scan, .env/secret-file detection, .gitignore gaps for build/scratch artifacts, oversized blobs, stub/placeholder markers, byte-identical duplicate files, source test-peer coverage, TODO/FIXME debt); mode='fix' (METERED, $0.05 standard / $0.02 lite) adds a prioritized remediation plan with ready-to-apply .gitignore additions and per-finding actions. Sending X-Agent-Mode: engineer always bills the fix-mode price, even if mode is 'scan' or omitted. Deterministic, dependency-free, never mutates your repo (fix returns a PLAN). Rules needing a live git checkout/toolchain (worktree pruning, build/vet, governance-source-of-truth checks, route-registration dup-handler analysis, ROI-queue coherence) are reported as repo_only_rules, not run. Engineer mode (X-Agent-Mode: engineer — Security Engineer, $5): the fix arrives as a git-applyable unified-diff patch (`patch`) + a SARIF 2.1.0 log for CI code-scanning (`sarif`). Requires Authorization: Bearer <api_key>.

Input parameters:

- `config` (object): Optional threshold overrides: maxFileBytes, coverageA, coverageB, coverageC, todoDebtThreshold.
- `files` (array, required): Inline files [{path, content}] to scan (non-empty; each content <= 5 MB).
- `mode` (string): scan (free grade+findings, default) | fix (metered, adds remediation plan).

Output parameters:

- `counts` (object): {high, medium, low, deferredByPolicy} open-finding counts.
- `dimensions` (array): Per-dimension grade [{id, grade, detail}].
- `findings` (array): All findings [{id, ruleId, severity, path, message, policy, recommendedAction}].
- `grade` (string): Overall hygiene grade A-F (minimum across dimensions).
- `mode` (string): Echo of the mode that ran.
- `paid_fix_hint` (string): scan mode only: how to obtain the metered remediation plan.
- `patch` (string): Engineer mode only: git-apply-able unified diff of the safe auto-fixes (currently .gitignore additions only); empty string when nothing is safely auto-fixable.
- `reasons` (array): Dimensions that capped the grade below A.
- `remediation_plan` (object): fix mode only: {ordered_steps, gitignore_additions, summary}.
- `repo_only_rules` (array): Rules that need a live repo and were not run.
- `sarif` (object): Engineer mode only: SARIF 2.1.0 log of all open findings for CI code-scanning.
- `scanned` (object): {files, bytes} actually analyzed.

### `sca_exemption_decision` (~442 tokens)

Decide the lighter-SCA path for a single transaction using AXIS's published 7-priority PSD2 exemption matrix (the same decideScaExemption engine that renders the SCA Exemption Decision Matrix in generated artifacts). Input: amount_eur (required, PSD2 thresholds are EUR-denominated — convert before calling) plus optional context flags (secure corporate program, MIT, fixed recurring + prior SCA, trusted beneficiary + prior SCA, one-leg-out, acquirer TRA fraud rate in basis points). Returns the chosen exemption, its priority, sca_required, rationale, fallback path, all applicable candidates, the rendered priority matrix, and a sha256 reproducibility proof. Free, no auth, deterministic, no side effects. HONESTY: decision-support only, NOT an authorization oracle — final exemption eligibility is decided by the acquirer/issuer; TRA caps use published EBA RTS Art. 15 bands, not your acquirer's live fraud rate.

Input parameters:

- `amount_eur` (number, required): Transaction amount in EUR (PSD2 thresholds are EUR-denominated).
- `has_prior_sca` (boolean): A prior SCA exists — gates recurring_fixed and trusted_beneficiary.
- `is_merchant_initiated` (boolean): MIT with stored credential + original SCA reference (out of SCA scope).
- `is_one_leg_out` (boolean): Payer or payee outside the EEA (territorial scope, not a formal exemption).
- `is_recurring_fixed` (boolean): Fixed-amount subsequent collection (RTS Art. 13). Requires has_prior_sca.
- `is_secure_corporate` (boolean): Dedicated/lodged corporate card program (RTS Art. 16).
- `is_trusted_beneficiary` (boolean): Merchant on the cardholder's trusted list (RTS Art. 12). Requires has_prior_sca.
- `tra_acquirer_fraud_bps` (number): Acquirer reference fraud rate in basis points (EBA RTS Art. 15 bands: <=1 → €500 cap, <=6 → €250, <=13 → €100).

Output parameters:

- `caveat` (string): Decision-support-only honesty caveat.
- `decision` (object): {exemption, priority, sca_required, rationale, fallback, candidates, tra_cap_eur?}.
- `matrix` (string): The rendered 7-priority SCA Exemption Decision Matrix (markdown) this decision was taken from.
- `proof` (object): {algo:'sha256', digest, over[]} — reproducibility proof over canonical input+decision.

### `grade_compliance` (~230 tokens)

Run the real 8-check AP2/Visa compliance grading engine (gradeCompliance — the same engine behind computeComplianceGrade and the commerce registry's verified_decisions block) over an inline file set. Each of the 8 validators (SCA/3DS2 readiness, AP2 mandate validity, tokenization posture, CE 3.0 readiness, dispute rail wiring, idempotency/receipt hygiene, budget negotiation, refund/cancel path) is a multi-signal check with weight, evidence trail, and remediation. Returns grade A-D, score, checks_passed/8, the full checks[] detail, detected commerce signals, and a sha256 reproducibility proof. Free, no auth, deterministic, no snapshot persisted. Hard caps: 25 files / 50KB per file / 1MB total. HONESTY: deterministic static source-signal analysis — a checklist starting point, NOT a certification, audit, PCI assessment, or card-network certification.

Input parameters:

- `files` (array, required): Source files to grade (max 25 files, 50KB each, 1MB total)

Output parameters:

- `checks` (array): Per-check {name, title, status, weight, score, evidence[], remediation}.
- `checks_passed` (number)
- `checks_total` (number): Always 8.
- `grade` (string): A | B | C | D (score >= 85 / 65 / 40 / below).
- `methodology` (string): The engine's own honesty statement (static analysis, not a certification).
- `proof` (object): {algo:'sha256', digest, over[]} reproducibility proof.
- `score` (number): Weighted 0-100 score across the 8 checks.
- `signals` (object): detectCommerceSignals(files) — providers + capability booleans the grade was derived from.

### `assemble_ce3_evidence` (~306 tokens)

Assemble a Visa Compelling Evidence 3.0 packet + eligibility verdict for a disputed card-absent-fraud (reason code 10.4) transaction using the real assembleCe3 engine: finds prior undisputed transactions in the caller-supplied history that share >=2 qualified data elements (device_id / ip_address / email / shipping_address / login_id) and fall 120-365 days before the disputed transaction, per CE 3.0 rules. Returns {eligible, qualifying_priors, matched_element_union, rejection_reason?, evidence_packet, caveat} plus a sha256 reproducibility proof. Free, no auth, deterministic, no side effects. HONESTY: CE 3.0 applies to reason code 10.4 ONLY (10.2/10.3 are card-present conditions), and this is ASSEMBLY ONLY — not a submission to VROL/Verifi (use assemble_representment for the Stripe representment path). AXIS does not publish win-rate estimates.

Input parameters:

- `dispute` (object, required): {txn: {id, amount_minor, currency, created_at, disputed, device_id?, ip_address?, email?, shipping_address?, login_id?}, reason_code: string (CE 3.0 requires '10.4'), disputed_at: ISO timestamp}
- `transaction_history` (array): Candidate prior transactions (same Txn shape, max 500). Undisputed priors sharing >=2 qualified elements qualify.

Output parameters:

- `caveat` (string): 'assembly only; not a submission to VROL/Verifi'.
- `eligible` (boolean): True when >=2 qualifying priors were found under the CE 3.0 rules.
- `evidence_packet` (object): The structured, submission-ready CE 3.0 packet (assembly only).
- `matched_element_union` (array): Union of matched qualified data elements across priors, canonical order.
- `proof` (object): {algo:'sha256', digest, over[]} reproducibility proof.
- `qualifying_priors` (array): [{txn_id, matched_elements[], age_days}] most-matching first, deterministic order.
- `reason_code` (string): Always '10.4' — the only CE 3.0 reason code.
- `rejection_reason` (string): Present iff eligible=false — why the packet did not qualify.

### `build_ap2_mandate` (~350 tokens)

Validate, canonically encode, and optionally Ed25519-sign an AP2 mandate (Intent / Cart / Payment) using the real @axis/ap2 codecs — schema validation (including cart-total arithmetic and intent cross-references), RFC 8785 JCS-style canonical JSON encoding, and detached-JWS EdDSA signing over node:crypto. Pass seed_hex (64 hex chars = 32 bytes) to sign deterministically client-side-supplied key material — AXIS stores no keys; omit it for an unsigned template with encoding only. The signed envelope round-trips through verifyMandate before it is returned. Free, no auth, deterministic (Ed25519 signatures are deterministic per RFC 8032), no side effects. SCOPE HONESTY: conformant to AXIS's TypeScript encoding of the public AP2 mandate schema, verified against self-authored golden vectors — NOT certified against an official AP2 conformance suite or a live network counterparty.

Input parameters:

- `intent_context` (object): Optional IntentMandate to cross-reference a cart's intent_ref against.
- `mandate` (object, required): An AP2 mandate object: {kind: 'intent'|'cart'|'payment', version: 'ap2/1', id, created_at, ...kind-specific fields (intent: user_id/description/constraints.max_amount/expires_at; cart: intent_ref/mer…
- `seed_hex` (string): Optional 64-char hex (32-byte) Ed25519 seed to sign with. Caller-supplied key material — AXIS stores no keys. Omit for an unsigned template.

Output parameters:

- `encoded` (string): Canonical (JCS-style) JSON wire encoding — null when invalid.
- `issues` (array): [{path, message}] validation issues (empty when valid).
- `mandate` (object): Echo of the validated mandate.
- `note` (string): Signed vs 'unsigned template — sign client-side' + trust-model caveat.
- `proof` (object): {algo:'sha256', digest, over[]} reproducibility proof.
- `signed` (object): When seed_hex supplied: {jws: {protected, signature}, public_key} — a SignedMandate envelope, verified before return.
- `valid` (boolean): Structural validation verdict (validateMandate).
- `verified` (boolean): verifyMandate result for the signed envelope (null when unsigned).

### `score_dispute_readiness` (~339 tokens)

Score how ready a disputed transaction's EVIDENCE FILE is for representment, per Visa reason-code family, using the transparent scoreWinProbability heuristic (win-prob-v0: hand-set, documented logistic coefficients — exported, inspectable, monotonic in evidence). Input: reason_code + the evidence on file (CE 3.0 eligibility, matching data elements, prior undisputed transactions, delivery proof, AVS/CVV, 3DS, signed mandate, customer communication). Returns the heuristic score, band, top missing evidence (what to capture next), recommended action, rationale, model version, and a sha256 reproducibility proof. Free, no auth, deterministic. HONESTY (read this): this scores evidence-capture readiness and is NOT a dispute-win prediction — the v0 heuristic is NOT empirically calibrated against real network outcomes, is NOT a Visa-published or Visa-endorsed win rate, and AXIS does not publish win-rate estimates. Treat it as a prioritization signal for evidence gathering only; always follow your operator's dispute policy.

Input parameters:

- `evidence` (object): Evidence on file: {ce3Eligible?, matchingDataElements? (0-5), priorUndisputedTransactions? (0-10), hasDeliveryProof?, hasAvsMatch?, hasCvvMatch?, has3dsAuthenticated?, hasSignedMandate?, hasCustomerC…
- `reason_code` (string, required): Visa dispute reason code (e.g. '10.4', '13.1', '12.5'). Unknown codes fall back to a documented default family.

Output parameters:

- `disclaimer` (string): The NOT-a-win-prediction honesty disclaimer (always present).
- `proof` (object): {algo:'sha256', digest, over[]} reproducibility proof.
- `readiness` (object): {reasonCode, readiness_score (0-1 heuristic score), band, topMissingEvidence[], recommendedAction, rationale[], modelVersion}.

### `assemble_representment` (~386 tokens)

Turn a webhook-ingested dispute (charge.dispute.* events persist DisputeRecords server-side) into a Stripe representment: qualifies CE 3.0 priors from your supplied transaction history (assembleCe3), builds the Stripe `evidence` hash (buildStripeRepresentment), walks the dispute state machine (needs_response → evidence_assembling → evidence_submitted) with a full transition ledger, and — when submit=true and Stripe is configured — submits the evidence through the live Stripe disputes API. Requires Authorization: Bearer <api_key>; metered ($0.50 standard, $0.25 lite) through the standard authorize/capture path — a failed assembly never charges. Returns {dispute, evidence, ce3, ce3_eligible, submitted, disclaimer}. HONESTY: the dispute lifecycle is LIVE on the Stripe rail only; VROL/RDR/CDRN (Verifi/Ethoca) is integration-ready code gated on acquirer provisioning (AXIS_ENABLE_VROL) and never fakes a submission. AXIS does not publish win-rate estimates.

Input parameters:

- `dispute_id` (string, required): Provider dispute id (Stripe dp_...) previously ingested by the charge.dispute.created webhook.
- `disputed_txn` (object): Optional CE 3.0 data elements of the disputed transaction: {device_id?, ip_address?, email?, shipping_address?, login_id?}.
- `evidence_inputs` (object): {customerEmail?, shippingAddress?, billingAddress?, serviceDate?, productDescription?, deliveryTracking?, threeDsAuthenticated?} — merchant-supplied evidence fields.
- `submit` (boolean): true → submit the built evidence to the Stripe disputes API (requires STRIPE_SECRET_KEY server-side). Default false (assemble only).
- `transaction_history` (array): Candidate prior transactions for CE 3.0 qualification (Txn shape, max 500).

Output parameters:

- `ce3` (object): Full assembleCe3 result (eligible, qualifying_priors, evidence_packet, caveat).
- `ce3_eligible` (boolean)
- `disclaimer` (string): Stripe-rail-live / VROL-gated honesty split + no-win-rate stance.
- `dispute` (object): The DisputeRecord after state-machine bookkeeping (state, dueBy, representmentId, ...).
- `evidence` (object): Stripe `evidence` hash: uncategorized_text (CE 3.0 narrative) + customer_email_address/shipping_address/... from evidence_inputs.
- `submit_note` (string): Present when submit was requested but skipped (e.g. Stripe not configured).
- `submitted` (boolean): True only when the evidence was actually submitted through the dispute client.

### `iliad_network_tokenization` (~436 tokens)

Network-tokenization capability. (1) `lifecycle`: an EXECUTABLE TAP-style token-lifecycle state machine (provision → activate → suspend → resume → delete; deleted is terminal; illegal transitions are rejected with an error, not silently accepted) — pure simulation, no real payment method involved. (2) `capabilities` reports which providers are configured (env-derived). (3) `read` and (4) `provision` are TEMPORARILY DISABLED: both would resolve a caller-supplied payment_method_id/pan_source against the platform's Stripe account, and this service has no way yet to verify that id belongs to the calling AXIS account — calling either always returns a structured `_not_configured: true` envelope explaining this, never real payment-method data. (For context once re-enabled: `read`'s underlying Stripe adapter is fully implemented; direct VTS/MDES `provision` is additionally capability-gated behind a network-issued Token Requestor ID — AXIS_VTS_TOKEN_REQUESTOR_ID / AXIS_MDES_TOKEN_REQUESTOR_ID — plus network onboarding, and NEVER fakes a token.) Raw PANs are never accepted even when disabled (pan_source is documented as an opaque reference only). Free (unmetered); requires Authorization: Bearer <api_key>.

Input parameters:

- `event` (string): lifecycle: single-event shorthand for `events: [event]`.
- `events` (array): lifecycle: ordered TokenEvent list (provision|activate|suspend|resume|delete), max 100. Must start from provision; illegal transitions throw.
- `operation` (string): read (default, disabled) | provision (disabled) | lifecycle | capabilities.
- `pan_source` (string): provision: ignored — this operation is disabled and always returns _not_configured. NEVER a raw PAN in any case.
- `payment_method_id` (string): read: ignored — this operation is disabled and always returns _not_configured.
- `provider` (string): provision: ignored — this operation is disabled and always returns _not_configured.

Output parameters:

- `_not_configured` (boolean): True for every read/provision call (disabled) and for capability-gated states.
- `capabilities` (object): { stripe, vts, mdes } — which providers are configured (env-derived).
- `honesty` (string): The stripe-live / VTS-MDES-gated honesty statement (capabilities only).
- `lifecycle` (object): lifecycle: { state, history: [{from, event, to}] } after applying every event.
- `operation` (string): The operation that ran.
- `provider_checked` (string): Always 'stripe' for the disabled read/provision envelope; the real provider gate name otherwise.
- `reason` (string): Why the call returned _not_configured (only when true).
- `remediation` (string): What to use instead, or the exact env var / onboarding step required.
- `tool` (string): Always 'iliad_network_tokenization'.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/lastmanupinc-hub-axis-toolbox/axis-api-6c7z#diagnostics

## Score history

- 2026-08-03: 56
- 2026-08-02: 55
- 2026-08-01: 55
- 2026-07-31: 55
- 2026-07-30: 14
- 2026-07-29: 51
- 2026-07-28: 51
- 2026-07-27: 50
- 2026-07-26: 49

## Links

- Remote endpoint: https://axis-api-6c7z.onrender.com/mcp
- Repository: https://github.com/lastmanupinc-hub/Toolbox
- Changelog RSS feed: https://verifymcp.io/servers/lastmanupinc-hub-axis-toolbox/axis-api-6c7z/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/lastmanupinc-hub-axis-toolbox/axis-api-6c7z/changelog.json
- HTML version of this page: https://verifymcp.io/servers/lastmanupinc-hub-axis-toolbox/axis-api-6c7z