io.github.mizcausevic-dev/mcp-kinetic-gain

Fetch the full AEO Protocol declaration at an origin's /.well-known/aeo.json. Returns the raw conforming JSON document.

Extract a single AEO claim by ID. Returns the claim object or a not-found error listing available claim IDs.

Return a structured summary of an AEO declaration: entity, source/verification counts, claim IDs, audit mode. Cheaper than aeo_fetch for context-window-constrained agents.

Compute the canonical AEO well-known URL for an origin, without fetching.

Structured summary of an Agent Card document. Pass EITHER `url` (the server fetches it) OR `document_json` (already-fetched).

Return the list of tools an agent declares, with side-effect class and (when present) MCP Tool Card URI for each tool.

Validate an Agent Card JSON document against the v0.1 schema.

Compute the canonical Agent Card well-known URL for a given origin + agent_id (convention: /.well-known/agents/<agent_id>.json).

Structured summary of an AI Evidence object: claim text, source metadata, retrieval method, synthesis role, hash, signed-or-not.

Validate an AI Evidence object against the v0.1 schema.

Compute SHA-256 over the canonical UTF-8 form of `candidate_text` (LF endings, no trailing newline) and compare against the evidence's verification.content_hash. Returns ok=true on match, or { error: hash_mismatch, expected, recomputed }.

Compute the SHA-256 canonical-JSON hash of an arbitrary value (sorted keys, no whitespace). This is the structural hash convention used by procurement-decision-api, aeo-validator-service, aeo-graph-explorer-rs, and hash-attestation-rs. Identical JSON values produce identical hashes regardless of original whitespace or key order.

Pretty-print an Attestation envelope with structural validation: confirms every required field is present, reports the decoded signature byte-length (should be 64), and surfaces the key_url + signed_at fields a caller would use to find the matching public key.

Verify an ed25519 Attestation envelope against a body and caller-supplied public key. Recomputes the canonical hash and verifies the signature over the hash string. Does not verify that the supplied key belongs to the claimed key_url or signer. Public key accepted as 64-char hex or base64.

Walk an array of GovernanceEvents top-to-bottom and verify the hash chain: monotonic event_id, prev_hash linkage, self-consistency of each event's hash. Returns { valid, checked, first_break_at, reason }, the same shape audit-stream-py's GET /verify endpoint emits.

Ask the configured audit-stream service to check its full server-side hash chain. This checks chain continuity, not whether events are truthful, authorized, complete, or legally compliant. Returns valid, checked, first_break_at, and reason. Requires AUDIT_STREAM_URL and AUDIT_STREAM_TOKEN; returns a structured error otherwise.

Build a ready-to-POST audit-stream-py GovernanceEvent: assigns event_id, computes the canonical hash, links to prev_hash (defaults to 64 zeros for event #1). Kind must be one of the 19 declared event kinds (decision_card_drafted, watch_drifted, request_denied, etc., plus 'other').

POSTs a governance event to the audit-stream-py instance configured by AUDIT_STREAM_URL and AUDIT_STREAM_TOKEN. This sends kind, caller-asserted source, and payload to that service. The bearer token authenticates this MCP process, not the claimed producer or tenant. Obtain the user's approval before recording an event; omit secrets and personal data unless the service is approved for them. The server assigns event_id/timestamp/prev_hash/hash. Returns a validated service event receipt or a structured error; receipt does not prove durable storage or event completeness.

Pretty-print one GovernanceEvent with structural validation: required fields, known/unknown kind, payload key list, and self-consistency check (does the event's `hash` match the recomputed canonical hash of the body?).

GET recent governance events from a running audit-stream-py instance (AUDIT_STREAM_URL and AUDIT_STREAM_TOKEN), optionally filtered by kind or source. The service does not combine both filters. Returns the events array plus a count field; recorded source labels are caller-asserted. Returns a structured error when unconfigured.

Compare an AUP with a Student AI Disclosure on eight declared checks: policy effective window, signature, artifact_hash, teacher acknowledgment, prompt evidence mode, permitted/prohibited roles, assistance-extent ceiling, and assistance_extent_max=none vs ai_used=true. Returns { allowed, policy_id, disclosure_id, violations[] }; allowed=true means only these checks passed. It does not verify policy scope, tool/vendor requirements, parent consent, Tutor Cards, or legal compliance, and is not an enforcement decision.

Fetch a Classroom AI AUP from a URL. Returns the parsed, schema-validated JSON document.

Structured summary of a Classroom AI AUP: policy identity, scope, permitted-use counts, prohibited-use counts, disclosure requirements, supervision level, vendor requirements posture, parent-consent gating.

Validate a Classroom AI AUP JSON document against the v0.1 schema. Enforces conditional rules: course scope requires non-empty course_ids; assignment scope requires non-empty assignment_ids; assistance_extent_max=none forbids any permitted_roles; expires_at must follow effective_at; roles cannot be both permitted and prohibited.

Compute the canonical Classroom AI AUP well-known URL: /.well-known/ai-aup.json.

Link a new AI Claims Decision Card to its predecessor: sets attestation.chain_index (prev + 1) and attestation.prev_card_hash. Validates the predecessor hash is 64-char hex and its index is a non-negative integer. Call claims_card_sign next.

Structured summary of an AI Claims Decision Card: claim type, outcome, coverage, evidence count, model, jurisdiction, human-in-loop, chain position, and attestation status. Cheaper than reading the full card.

Compute the canonical SHA-256 hash of an AI Claims Decision Card for ed25519 signing. Sorts object keys recursively and excludes attestation.card_hash + attestation.signature before hashing. Returns the 64-char lowercase hex card_hash; caller signs it offline.

Validate an AI Claims Decision Card against the bundled v0.1 structural schema, including required fields, enums, ranges, and attestation field shapes. Returns the first schema issue or { valid, claims_card_id, version }. This does not verify signatures, evidence authenticity, the coverage decision, or legal compliance.

Fetch a Clinical AI Card from a URL. Returns the parsed, schema-validated JSON document.

Structured summary of a Clinical AI Card: system identity, clinical context (indication / care settings / patient population), regulatory posture (FDA / SaMD), clinical role, evidence (validation studies + bias audit + performance metrics), HIPAA + BAA posture, EHR integration (FHIR / SMART / CDS Hooks), safety + mandated reporting.

Validate a Clinical AI Card JSON document against the v0.1 schema. Enforces the headline rules: autonomy ⇔ medical device, SaMD completeness, FDA-clearance documentation, PHI ⇒ explicit HIPAA + BAA posture, and bias_audit_uri requirement for SaMD class II+ / autonomous / pre-authorization use.

Compute the canonical Clinical AI Card well-known URL: /.well-known/clinical-ai/<system_id>.json.

Fetch an AI Procurement Decision Card from a URL. Returns the parsed, schema-validated JSON document.

Validate each rubric row, then infer a preview decision.status. Mirrors procurement-decision-api's rubric engine: any 'fail' -> 'rejected-with-remediation'; any 'partial' or 'pass-with-condition' -> 'approved-with-conditions'; all 'pass' -> 'approved'; empty or all 'n/a' -> 'pending'. An unsupported result returns an error, never an approval.

Structured summary of an AI Procurement Decision Card: buyer identity, decision status + scope, vendor + documents reviewed (by type and URL), rubric pass/partial/fail counts, conditions count, signatures count, publication posture, history event count, withdrawal flag.

Structural check on a Decision Card's signatures[] block: count signers, show their method/key/timestamp, and return the canonical-JSON hash of the card body (excluding signatures) so a caller can pair this with attestation_verify for cryptographic checking.

Read-only deny preview for rejected, withdrawn, expired, or pending Decision Cards; returned bundles carry preview_only=true and enforceable=false. Approved statuses return an MCP error: only the live policy engine can check buyer identity and trusted attestation, vendor scope, allowed action, and effective window before producing an enforceable bundle. Do not use this tool output as an access grant.

Validate an AI Procurement Decision Card JSON document against the v0.1 schema. Enforces conditional rules: status=approved-with-conditions and status=rejected-with-remediation require at least one entry in conditions; status=withdrawn requires a withdrawal block; publication.is_public=true requires publication_uri.

Compute the canonical AI Procurement Decision Card well-known URL: /.well-known/decisions/<decision_id>.json.

Run three deterministic DefenseTech event checks: CUI distribution-statement presence, ITAR status with tokenized license for an authorized foreign person, and a 72-hour discovery-to-filing interval. The last check requires event.discovered_at; event.timestamp is not a substitute. Returns ok + errors + passed, not a legal compliance determination.

Check that a CUI-Specified+ tier event carries the required distribution_statement (DoDI 5230.24). For PUBLIC / CUI-BASIC tiers reports applicable=false.

Calculate the DFARS 252.204-7012 discovery-to-filing 72-hour interval from supplied timezone-qualified timestamps. Requires discovered_at, not occurred_at. Invalid or pre-discovery filing timestamps return valid=false and within_window=false. This arithmetic preview does not establish a reporting duty or prove filing.

Check that an ITAR resource event has US-PERSON-VERIFIED (or AUTHORIZED-FOREIGN-PERSON-WITH-LICENSE + DDTC license number tokenized) on the agent. Per 22 CFR 120.62 / 22 CFR 120.50 deemed-export rule.

Given a freeform description of a defense-AI incident, classify it into one of the 22 DefenseTech Incident Card event_type values (DFARS cyber / CUI spillage / ITAR violation / foreign-person breach / classified misuse / NISPOM insider-threat / CMMC POA&M / AI-tool supply-chain / etc.). Returns top 3 candidates with token-match scoring.

Summarize a CMMC L2/L3 readiness evidence bundle: target level, assessment mode, evidence count, family coverage count, outcome distribution, orphan-failure count (not-satisfied without poam_ref), SPRS evidence presence, and quick invariant checks for POA&M traceability + SPRS-when-7019/7020-in-scope.

Verify the cross_binding_refs block on a DefenseTech vault contract is syntactically valid: all referenced repos are HTTPS URLs. Returns valid_refs + errors. Does NOT fetch remotely (syntactic check only).

Deterministic preview of a DefenseTech 3-axis vault contract: intersect allowed_actions and OR requires_* flags. Unknown or incomparable human-user requirements return ok=false for an authorized policy owner to resolve. This does not verify identity, classification, licenses, or enforce access.

Surface the disclosure's declared policy posture and any aup_uri reference. Status is one of: declared_compliant, declared_non_compliant, aup_referenced_but_unclaimed, no_aup_reference. This does not verify compliance; aup_check_compliance evaluates eight declared AUP/Disclosure checks only.

Structured summary of a Student AI Disclosure: assignment identity, AI usage facts, tools used (with back-refs to agent / tutor cards), role taxonomy, assistance extent, prompt-mode + count, artifact hash, policy posture, signature + acknowledgment.