io.github.mizcausevic-dev/mcp-kinetic-gain

Fetch the full AEO Protocol declaration at an origin's /.well-known/aeo.json. Returns the raw conforming JSON document.

Extract a single AEO claim by ID. Returns the claim object or a not-found error listing available claim IDs.

Return a structured summary of an AEO declaration: entity, source/verification counts, claim IDs, audit mode. Cheaper than aeo_fetch for context-window-constrained agents.

Compute the canonical AEO well-known URL for an origin, without fetching.

Structured summary of an Agent Card document. Pass EITHER `url` (the server fetches it) OR `document_json` (already-fetched).

Return the list of tools an agent declares, with side-effect class and (when present) MCP Tool Card URI for each tool.

Validate an Agent Card JSON document against the v0.1 schema.

Compute the canonical Agent Card well-known URL for a given origin + agent_id (convention: /.well-known/agents/<agent_id>.json).

Structured summary of an AI Evidence object: claim text, source metadata, retrieval method, synthesis role, hash, signed-or-not.

Validate an AI Evidence object against the v0.1 schema.

Compute SHA-256 over the canonical UTF-8 form of `candidate_text` (LF endings, no trailing newline) and compare against the evidence's verification.content_hash. Returns ok=true on match, or { error: hash_mismatch, expected, recomputed }.

Compute the SHA-256 canonical-JSON hash of an arbitrary value (sorted keys, no whitespace). This is the structural hash convention used by procurement-decision-api, aeo-validator-service, aeo-graph-explorer-rs, and hash-attestation-rs. Identical JSON values produce identical hashes regardless of original whitespace or key order.

Pretty-print an Attestation envelope with structural validation: confirms every required field is present, reports the decoded signature byte-length (should be 64), and surfaces the key_url + signed_at fields a caller would use to find the matching public key.

Verify an ed25519 Attestation envelope (algorithm/signed_hash/signature/key_url/signed_at) against a body and a public key. Recomputes the canonical hash, checks it matches signed_hash, then verifies the ed25519 signature over the hash string. Returns { ok, reason? }. Public key accepted as 64-char hex or base64.

Walk an array of GovernanceEvents top-to-bottom and verify the hash chain: monotonic event_id, prev_hash linkage, self-consistency of each event's hash. Returns { valid, checked, first_break_at, reason }, the same shape audit-stream-py's GET /verify endpoint emits.

Ask a running audit-stream-py instance to walk its own chain end-to-end and report whether it's still intact. This is the canonical compliance answer, covers the FULL server-side history, not just events the agent has in context. Returns the same shape as the local audit_chain_verify tool (valid, checked, first_break_at, reason) but for the live chain. Requires AUDIT_STREAM_URL; returns a structured error otherwise.

Build a ready-to-POST audit-stream-py GovernanceEvent: assigns event_id, computes the canonical hash, links to prev_hash (defaults to 64 zeros for event #1). Kind must be one of the 19 declared event kinds (decision_card_drafted, watch_drifted, request_denied, etc., plus 'other').

POST one governance event to a running audit-stream-py instance (env var AUDIT_STREAM_URL). The server assigns event_id/timestamp/prev_hash/hash; the caller provides kind + source + payload. Use when Claude needs to record a governance moment from inside a chat (e.g. a manual override, a human-approved exception, an out-of-band incident). Returns the persisted event as audit-stream-py wrote it. Requires AUDIT_STREAM_URL in the MCP server's environment; returns a structured error otherwise.

Pretty-print one GovernanceEvent with structural validation: required fields, known/unknown kind, payload key list, and self-consistency check (does the event's `hash` match the recomputed canonical hash of the body?).

GET recent governance events from a running audit-stream-py instance (env var AUDIT_STREAM_URL), with optional server-side filters. Use to surface the last N denies, attestation failures, breaker trips, contract incompatibilities, or any other governance moment a user is investigating. Returns the events array plus a `count` field. Requires AUDIT_STREAM_URL; returns a structured error otherwise.

HEADLINE TOOL, joins an AUP with a Student AI Disclosure and decides whether the submission complies with the operative policy. Eight gates: policy effective window, signature, artifact_hash, teacher acknowledgment, prompt evidence mode, permitted/prohibited roles, assistance-extent ceiling, and assistance_extent_max=none vs ai_used=true. Returns { allowed, policy_id, disclosure_id, violations[] } with one entry per failed gate. The three-document join (Tutor Card + AUP + Disclosure) reduces to a single allow/deny call.

Fetch a Classroom AI AUP from a URL. Returns the parsed, schema-validated JSON document.

Structured summary of a Classroom AI AUP: policy identity, scope, permitted-use counts, prohibited-use counts, disclosure requirements, supervision level, vendor requirements posture, parent-consent gating.

Validate a Classroom AI AUP JSON document against the v0.1 schema. Enforces conditional rules: course scope requires non-empty course_ids; assignment scope requires non-empty assignment_ids; assistance_extent_max=none forbids any permitted_roles; expires_at must follow effective_at; roles cannot be both permitted and prohibited.

Compute the canonical Classroom AI AUP well-known URL: /.well-known/ai-aup.json.

Link a new AI Claims Decision Card to its predecessor: sets attestation.chain_index (prev + 1) and attestation.prev_card_hash. Validates the predecessor hash is 64-char hex and its index is a non-negative integer. Call claims_card_sign next.

Structured summary of an AI Claims Decision Card: claim type, outcome, coverage, evidence count, model, jurisdiction, human-in-loop, chain position, and attestation status. Cheaper than reading the full card.

Compute the canonical SHA-256 hash of an AI Claims Decision Card for ed25519 signing. Sorts object keys recursively and excludes attestation.card_hash + attestation.signature before hashing. Returns the 64-char lowercase hex card_hash; caller signs it offline.

Validate an AI Claims Decision Card (InsurTech) JSON document against the v0.1 spec. Checks the claims_card_version detection key, required top-level keys, decision.outcome enum, a non-empty evidence_bundle.sources, and the disclaimer. Returns { valid, claims_card_id, version } or { valid: false, reason }.

Fetch a Clinical AI Card from a URL. Returns the parsed, schema-validated JSON document.

Structured summary of a Clinical AI Card: system identity, clinical context (indication / care settings / patient population), regulatory posture (FDA / SaMD), clinical role, evidence (validation studies + bias audit + performance metrics), HIPAA + BAA posture, EHR integration (FHIR / SMART / CDS Hooks), safety + mandated reporting.

Validate a Clinical AI Card JSON document against the v0.1 schema. Enforces the headline rules: autonomy ⇔ medical device, SaMD completeness, FDA-clearance documentation, PHI ⇒ explicit HIPAA + BAA posture, and bias_audit_uri requirement for SaMD class II+ / autonomous / pre-authorization use.

Compute the canonical Clinical AI Card well-known URL: /.well-known/clinical-ai/<system_id>.json.

Fetch an AI Procurement Decision Card from a URL. Returns the parsed, schema-validated JSON document.

Given a rubric, infer the right `decision.status`. Mirrors procurement-decision-api's rubric engine: any 'fail' -> 'rejected-with-remediation'; any 'partial' or 'pass-with-condition' -> 'approved-with-conditions'; all 'pass' -> 'approved'; empty or all 'n/a' -> 'pending'.

Structured summary of an AI Procurement Decision Card: buyer identity, decision status + scope, vendor + documents reviewed (by type and URL), rubric pass/partial/fail counts, conditions count, signatures count, publication posture, history event count, withdrawal flag.

Structural check on a Decision Card's signatures[] block: count signers, show their method/key/timestamp, and return the canonical-JSON hash of the card body (excluding signatures) so a caller can pair this with attestation_verify for cryptographic checking.

Translate a Decision Card into the PolicyBundle that policy-as-code-engine's POST /bundles/from-decision-card would generate. Read-only preview. 'approved' -> allow-all; 'rejected*' / 'withdrawn' / 'expired' / 'pending' -> deny-all; 'approved-with-conditions' -> one policy per condition (deny-by-default, allow only when conditions_satisfied.{id} is true).

Validate an AI Procurement Decision Card JSON document against the v0.1 schema. Enforces conditional rules: status=approved-with-conditions and status=rejected-with-remediation require at least one entry in conditions; status=withdrawn requires a withdrawal block; publication.is_public=true requires publication_uri.

Compute the canonical AI Procurement Decision Card well-known URL: /.well-known/decisions/<decision_id>.json.

Run all 3 DefenseTech audit-stream invariants against a single event: (#1) CUI distribution-statement on CUI-Specified+ per DoDI 5230.24, (#2) ITAR us-person verification per 22 CFR 120.62, (#3) DFARS 252.204-7012(c)(1)(ii) 72-hour cyber incident reporting wall-clock. Returns ok + errors + passed.

Check that a CUI-Specified+ tier event carries the required distribution_statement (DoDI 5230.24). For PUBLIC / CUI-BASIC tiers reports applicable=false.

Check DFARS 252.204-7012(c)(1)(ii) 72-hour cyber-incident reporting clock specifically. Returns elapsed_hours, within_window, overrun_hours.

Check that an ITAR resource event has US-PERSON-VERIFIED (or AUTHORIZED-FOREIGN-PERSON-WITH-LICENSE + DDTC license number tokenized) on the agent. Per 22 CFR 120.62 / 22 CFR 120.50 deemed-export rule.

Given a freeform description of a defense-AI incident, classify it into one of the 22 DefenseTech Incident Card event_type values (DFARS cyber / CUI spillage / ITAR violation / foreign-person breach / classified misuse / NISPOM insider-threat / CMMC POA&M / AI-tool supply-chain / etc.). Returns top 3 candidates with token-match scoring.

Summarize a CMMC L2/L3 readiness evidence bundle: target level, assessment mode, evidence count, family coverage count, outcome distribution, orphan-failure count (not-satisfied without poam_ref), SPRS evidence presence, and quick invariant checks for POA&M traceability + SPRS-when-7019/7020-in-scope.

Verify the cross_binding_refs block on a DefenseTech vault contract is syntactically valid: all referenced repos are HTTPS URLs. Returns valid_refs + errors. Does NOT fetch remotely (syntactic check only).

Resolve a (CUI tier, export-control status, foreign-person restriction) tuple against a DefenseTech 3-axis vault contract. Returns the most-restrictive resolved policy: intersected allowed_actions, max minimum_human_user_status, OR-ed requires_* flags. The DefenseTech runtime-policy operator.

Surface the disclosure's policy posture: whether an aup_uri is referenced and what the student declared. Status is one of: declared_compliant, declared_non_compliant, aup_referenced_but_unclaimed, no_aup_reference. Reports declared posture only; for the actual three-way join use aup_check_compliance.

Structured summary of a Student AI Disclosure: assignment identity, AI usage facts, tools used (with back-refs to agent / tutor cards), role taxonomy, assistance extent, prompt-mode + count, artifact hash, policy posture, signature + acknowledgment.