# io.github.mizcausevic-dev/mcp-kinetic-gain (npm · mcp-kinetic-gain)

Unified MCP server for the 12-spec Kinetic Gain Suite + DefenseTech 6-pack — 75 governance tools.

- Trust score: 62/100 (medium)
- Change this week: +19
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `mcp-kinetic-gain`: 62/100 (this document), [markdown](https://verifymcp.io/servers/mizcausevic-dev-mcp-kinetic-gain/mcp-kinetic-gain.md), [page](https://verifymcp.io/servers/mizcausevic-dev-mcp-kinetic-gain/mcp-kinetic-gain)

## Channel facts

- Registry: `npm`
- Package: `mcp-kinetic-gain`
- Version: `0.9.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (114 of 118), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (114 of 118), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (AGPL-3.0).
  - Actively maintained (last published 28 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 71/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 5709 tokens (~76/item across 75 items; 75 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 76/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 29% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add mizcausevic-dev-mcp-kinetic-gain -- npx -y mcp-kinetic-gain
```

### Codex

```bash
codex mcp add mizcausevic-dev-mcp-kinetic-gain -- npx -y mcp-kinetic-gain
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "mizcausevic-dev-mcp-kinetic-gain": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "mcp-kinetic-gain"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add mizcausevic-dev-mcp-kinetic-gain --command npx --arg -y --arg mcp-kinetic-gain
```

### Hermes

```yaml
mcp_servers:
  mizcausevic-dev-mcp-kinetic-gain:
    command: "npx"
    args: ["-y", "mcp-kinetic-gain"]
```

### Other

```json
{
  "mcpServers": {
    "mizcausevic-dev-mcp-kinetic-gain": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-kinetic-gain"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 62, +15)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] License: unverified → pass
- [functional] Licence: AGPL-3.0

### 2026-08-02 (score 47, +23)

- [security improvement] Malware scan: unverified → pass
- [functional improvement] Schema quality: unverified → good

### 2026-08-01 (score 24, +5)

- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] MCP protocol: unverified → pass

### 2026-07-31 (score 19, −6)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 25, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-27 (score 43)

First indexed and scored.

## MCP tools (75)

### `aeo_fetch` (~58 tokens)

Fetch the full AEO Protocol declaration at an origin's /.well-known/aeo.json. Returns the raw conforming JSON document.

Input parameters:

- `origin` (string, required): Origin URL (e.g. 'https://mizcausevic-dev.github.io').

### `aeo_inspect` (~53 tokens)

Return a structured summary of an AEO declaration: entity, source/verification counts, claim IDs, audit mode. Cheaper than aeo_fetch for context-window-constrained agents.

Input parameters:

- `origin` (string, required)

### `aeo_get_claim` (~48 tokens)

Extract a single AEO claim by ID. Returns the claim object or a not-found error listing available claim IDs.

Input parameters:

- `claim_id` (string, required)
- `origin` (string, required)

### `aeo_well_known_url` (~34 tokens)

Compute the canonical AEO well-known URL for an origin, without fetching.

Input parameters:

- `origin` (string, required)

### `prompt_provenance_validate` (~61 tokens)

Validate a Prompt Provenance JSON document against the v0.1 schema. Returns { valid, prompt_id, version } or { valid: false, reason }.

Input parameters:

- `document_json` (string, required): A Prompt Provenance JSON document as a string.

### `prompt_provenance_inspect` (~40 tokens)

Structured summary of a Prompt Provenance document: prompt identity, lineage, approval state, evaluation suites.

Input parameters:

- `document_json` (string, required)

### `prompt_provenance_eval_result` (~49 tokens)

Extract a single evaluation suite's result from a Prompt Provenance document.

Input parameters:

- `document_json` (string, required)
- `suite_name` (string, required): Name of the evaluation suite to extract.

### `agent_card_well_known_url` (~57 tokens)

Compute the canonical Agent Card well-known URL for a given origin + agent_id (convention: /.well-known/agents/<agent_id>.json).

Input parameters:

- `agent_id` (string, required)
- `origin` (string, required)

### `agent_card_inspect` (~56 tokens)

Structured summary of an Agent Card document. Pass EITHER `url` (the server fetches it) OR `document_json` (already-fetched).

Input parameters:

- `document_json` (string)
- `url` (string)

### `agent_card_tool_disclosure` (~52 tokens)

Return the list of tools an agent declares, with side-effect class and (when present) MCP Tool Card URI for each tool.

Input parameters:

- `document_json` (string)
- `url` (string)

### `agent_card_validate` (~31 tokens)

Validate an Agent Card JSON document against the v0.1 schema.

Input parameters:

- `document_json` (string, required)

### `ai_evidence_validate` (~31 tokens)

Validate an AI Evidence object against the v0.1 schema.

Input parameters:

- `document_json` (string, required)

### `ai_evidence_inspect` (~45 tokens)

Structured summary of an AI Evidence object: claim text, source metadata, retrieval method, synthesis role, hash, signed-or-not.

Input parameters:

- `document_json` (string, required)

### `ai_evidence_verify_hash` (~92 tokens)

Compute SHA-256 over the canonical UTF-8 form of `candidate_text` (LF endings, no trailing newline) and compare against the evidence's verification.content_hash. Returns ok=true on match, or { error: hash_mismatch, expected, recomputed }.

Input parameters:

- `candidate_text` (string, required): The text whose hash should match the evidence's content_hash.
- `document_json` (string, required)

### `tool_card_well_known_url` (~55 tokens)

Compute the canonical MCP Tool Card well-known URL (convention: /.well-known/mcp-tools/<tool_name>.json).

Input parameters:

- `mcp_server_origin` (string, required)
- `tool_name` (string, required)

### `tool_card_inspect` (~59 tokens)

Structured summary of an MCP Tool Card: tool identity, safety profile (side-effect class, PII/secrets exposure, approval requirement), test count, p99 latency.

Input parameters:

- `document_json` (string)
- `url` (string)

### `tool_card_tested_with` (~74 tokens)

Return the tested-LLM entries for a tool, optionally filtered by a substring match on the LLM identifier.

Input parameters:

- `document_json` (string)
- `llm_filter` (string): Substring of the LLM identifier to filter by (case-insensitive). Optional.
- `url` (string)

### `tool_card_validate` (~32 tokens)

Validate an MCP Tool Card JSON document against the v0.1 schema.

Input parameters:

- `document_json` (string, required)

### `tutor_card_well_known_url` (~53 tokens)

Compute the canonical AI Tutor Card well-known URL (convention: /.well-known/tutors/<tutor_id>.json).

Input parameters:

- `origin` (string, required)
- `tutor_id` (string, required)

### `tutor_card_fetch` (~33 tokens)

Fetch a Tutor Card from a URL. Returns the parsed, schema-validated JSON.

Input parameters:

- `url` (string, required)

### `tutor_card_validate` (~54 tokens)

Validate an AI Tutor Card JSON document against the v0.1 schema, including the COPPA conditional rule (age_range_min < 13 ⇒ coppa_compliant must be true).

Input parameters:

- `document_json` (string, required)

### `tutor_card_inspect` (~65 tokens)

Structured summary of a Tutor Card: tutor identity, audience, pedagogy, subject scope counts, safety strength, FERPA/COPPA/GDPR posture, evaluation count, COPPA-rule check.

Input parameters:

- `document_json` (string)
- `url` (string)

### `tutor_card_subject_check` (~79 tokens)

Classify a topic against the tutor's subject scope. Returns one of: primary, included, excluded, unknown, with the matched term when applicable.

Input parameters:

- `document_json` (string)
- `query` (string, required): Topic to classify, e.g. 'algebra' or 'differential equations'.
- `url` (string)

### `tutor_card_coppa_check` (~76 tokens)

Enforce the spec's COPPA conditional rule: if audience.age_range_min < 13, data_privacy.coppa_compliant MUST be true. Returns { ok: true } or { error: coppa_violation, reason }.

Input parameters:

- `document_json` (string)
- `url` (string)

### `disclosure_validate` (~62 tokens)

Validate a Student AI Disclosure JSON document against the v0.1 schema. Enforces conditional rules (ai_used true requires tools/roles/extent/prompt_mode; ai_used false forbids them; prompt mode gates prompts presence).

Input parameters:

- `document_json` (string, required)

### `disclosure_inspect` (~66 tokens)

Structured summary of a Student AI Disclosure: assignment identity, AI usage facts, tools used (with back-refs to agent / tutor cards), role taxonomy, assistance extent, prompt-mode + count, artifact hash, policy posture, signature + acknowledgment.

Input parameters:

- `document_json` (string, required)

### `disclosure_verify_artifact_hash` (~138 tokens)

Recompute SHA-256 over a candidate artifact and compare to disclosure.artifact_hash. Pass either `candidate_text` (canonical SHA-256: LF, no trailing newline) for text artifacts, or `candidate_bytes_base64` (raw-bytes SHA-256) for binary artifacts like PDFs / images. Returns ok=true on match, otherwise { error: artifact_hash_mismatch, expected, recomputed }.

Input parameters:

- `candidate_bytes_base64` (string): Base64-encoded raw artifact bytes (raw-bytes mode).
- `candidate_text` (string): Text artifact (canonical-text mode).
- `document_json` (string, required)

### `disclosure_verify_prompt_hash` (~93 tokens)

Verify a single prompt hash in a hashed-mode disclosure. Looks up prompt_id and compares canonical SHA-256 of candidate_text. Returns ok=true on match or { error: prompt_hash_mismatch, expected, recomputed }. Errors with wrong_prompt_mode if prompt_evidence_mode is not 'hashed'.

Input parameters:

- `candidate_text` (string, required)
- `document_json` (string, required)
- `prompt_id` (string, required)

### `disclosure_aup_check` (~84 tokens)

Surface the disclosure's policy posture: whether an aup_uri is referenced and what the student declared. Status is one of: declared_compliant, declared_non_compliant, aup_referenced_but_unclaimed, no_aup_reference. Reports declared posture only; for the actual three-way join use aup_check_compliance.

Input parameters:

- `document_json` (string, required)

### `aup_well_known_url` (~39 tokens)

Compute the canonical Classroom AI AUP well-known URL: /.well-known/ai-aup.json.

Input parameters:

- `origin` (string, required)

### `aup_fetch` (~36 tokens)

Fetch a Classroom AI AUP from a URL. Returns the parsed, schema-validated JSON document.

Input parameters:

- `url` (string, required)

### `aup_validate` (~80 tokens)

Validate a Classroom AI AUP JSON document against the v0.1 schema. Enforces conditional rules: course scope requires non-empty course_ids; assignment scope requires non-empty assignment_ids; assistance_extent_max=none forbids any permitted_roles; expires_at must follow effective_at; roles cannot be both permitted and prohibited.

Input parameters:

- `document_json` (string, required)

### `aup_inspect` (~62 tokens)

Structured summary of a Classroom AI AUP: policy identity, scope, permitted-use counts, prohibited-use counts, disclosure requirements, supervision level, vendor requirements posture, parent-consent gating.

Input parameters:

- `document_json` (string)
- `url` (string)

### `aup_check_compliance` (~162 tokens)

HEADLINE TOOL, joins an AUP with a Student AI Disclosure and decides whether the submission complies with the operative policy. Eight gates: policy effective window, signature, artifact_hash, teacher acknowledgment, prompt evidence mode, permitted/prohibited roles, assistance-extent ceiling, and assistance_extent_max=none vs ai_used=true. Returns { allowed, policy_id, disclosure_id, violations[] } with one entry per failed gate. The three-document join (Tutor Card + AUP + Disclosure) reduces to a single allow/deny call.

Input parameters:

- `aup_json` (string): AUP as inline JSON.
- `aup_url` (string): AUP URL — server fetches it.
- `disclosure_json` (string, required): Student AI Disclosure as inline JSON.

### `clinical_ai_well_known_url` (~58 tokens)

Compute the canonical Clinical AI Card well-known URL: /.well-known/clinical-ai/<system_id>.json.

Input parameters:

- `origin` (string, required)
- `system_id` (string, required): Vendor's stable system identifier (kebab-case).

### `clinical_ai_fetch` (~35 tokens)

Fetch a Clinical AI Card from a URL. Returns the parsed, schema-validated JSON document.

Input parameters:

- `url` (string, required)

### `clinical_ai_validate` (~90 tokens)

Validate a Clinical AI Card JSON document against the v0.1 schema. Enforces the headline rules: autonomy ⇔ medical device, SaMD completeness, FDA-clearance documentation, PHI ⇒ explicit HIPAA + BAA posture, and bias_audit_uri requirement for SaMD class II+ / autonomous / pre-authorization use.

Input parameters:

- `document_json` (string, required): Clinical AI Card as inline JSON.

### `clinical_ai_inspect` (~93 tokens)

Structured summary of a Clinical AI Card: system identity, clinical context (indication / care settings / patient population), regulatory posture (FDA / SaMD), clinical role, evidence (validation studies + bias audit + performance metrics), HIPAA + BAA posture, EHR integration (FHIR / SMART / CDS Hooks), safety + mandated reporting.

Input parameters:

- `document_json` (string)
- `url` (string)

### `incident_well_known_url` (~62 tokens)

Compute the canonical AI Incident Card well-known URL: /.well-known/ai-incidents/<id>.json.

Input parameters:

- `incident_id` (string, required): Convention: INC-<YYYY-MM-DD>-<vendor>-<seq>
- `origin` (string, required)

### `incident_fetch` (~34 tokens)

Fetch an AI Incident Card from a URL. Returns the parsed, schema-validated JSON document.

Input parameters:

- `url` (string, required)

### `incident_validate` (~92 tokens)

Validate an AI Incident Card JSON document against the v0.1 schema. Enforces conditional rules: status=resolved requires resolved_at; status=withdrawn requires withdrawal block; non-empty regulatory.reported_to requires non-empty regulatory_filing_uris; root_cause.category=other and categories containing 'other' both require the corresponding _other_text fields.

Input parameters:

- `document_json` (string, required): Incident Card as inline JSON.

### `incident_inspect` (~78 tokens)

Structured summary of an AI Incident Card: incident identity (id, title, severity, categories, status, timeline), affected products + versions + Agent/Tutor/Tool Card cross-references, root cause, harm, mitigation, regulatory filings, withdrawal posture, revision metadata.

Input parameters:

- `document_json` (string)
- `url` (string)

### `incident_index_fetch` (~90 tokens)

HEADLINE TOOL, fetch a vendor's /.well-known/ai-incidents.json index and return a procurement-friendly summary: total count, breakdown by severity, breakdown by status, IDs sorted by disclosed_at descending. The cheapest way for a CISO or procurement reviewer to scan a vendor's incident history.

Input parameters:

- `origin` (string, required): Vendor origin (e.g. https://edu.kineticgain.com).

### `decision_card_well_known_url` (~67 tokens)

Compute the canonical AI Procurement Decision Card well-known URL: /.well-known/decisions/<decision_id>.json.

Input parameters:

- `decision_id` (string, required): Buyer-issued identifier (e.g. SPRINGFIELD-DEC-2026-001).
- `origin` (string, required)

### `decision_card_fetch` (~36 tokens)

Fetch an AI Procurement Decision Card from a URL. Returns the parsed, schema-validated JSON document.

Input parameters:

- `url` (string, required)

### `decision_card_validate` (~81 tokens)

Validate an AI Procurement Decision Card JSON document against the v0.1 schema. Enforces conditional rules: status=approved-with-conditions and status=rejected-with-remediation require at least one entry in conditions; status=withdrawn requires a withdrawal block; publication.is_public=true requires publication_uri.

Input parameters:

- `document_json` (string, required): Decision Card as inline JSON.

### `decision_card_inspect` (~76 tokens)

Structured summary of an AI Procurement Decision Card: buyer identity, decision status + scope, vendor + documents reviewed (by type and URL), rubric pass/partial/fail counts, conditions count, signatures count, publication posture, history event count, withdrawal flag.

Input parameters:

- `document_json` (string)
- `url` (string)

### `decision_card_infer_status` (~86 tokens)

Given a rubric, infer the right `decision.status`. Mirrors procurement-decision-api's rubric engine: any 'fail' -> 'rejected-with-remediation'; any 'partial' or 'pass-with-condition' -> 'approved-with-conditions'; all 'pass' -> 'approved'; empty or all 'n/a' -> 'pending'.

Input parameters:

- `rubric` (array, required)

### `decision_card_to_policy_bundle` (~112 tokens)

Translate a Decision Card into the PolicyBundle that policy-as-code-engine's POST /bundles/from-decision-card would generate. Read-only preview. 'approved' -> allow-all; 'rejected*' / 'withdrawn' / 'expired' / 'pending' -> deny-all; 'approved-with-conditions' -> one policy per condition (deny-by-default, allow only when conditions_satisfied.{id} is true).

Input parameters:

- `document_json` (string)
- `url` (string)

### `decision_card_signature_check` (~77 tokens)

Structural check on a Decision Card's signatures[] block: count signers, show their method/key/timestamp, and return the canonical-JSON hash of the card body (excluding signatures) so a caller can pair this with attestation_verify for cryptographic checking.

Input parameters:

- `document_json` (string)
- `url` (string)

### `incident_affected_walk` (~67 tokens)

Walk an Incident Card's `affected` block and return every referenced Suite document as { uri, kind }. Useful as the seed list for incident-correlation-rs or fan-out validation via aeo-validator-service.

Input parameters:

- `document_json` (string)
- `url` (string)

### `incident_remediation_plan` (~78 tokens)

Map each affected URI in an Incident Card to a recommended Action + Urgency. Single-hop preview of what incident-correlation-rs.correlate() would produce: agent/tutor/tool-card -> revalidate; vendor/product -> request_review. Urgency follows severity.

Input parameters:

- `document_json` (string)
- `url` (string)

### `attestation_canonical_hash` (~90 tokens)

Compute the SHA-256 canonical-JSON hash of an arbitrary value (sorted keys, no whitespace). This is the structural hash convention used by procurement-decision-api, aeo-validator-service, aeo-graph-explorer-rs, and hash-attestation-rs. Identical JSON values produce identical hashes regardless of original whitespace or key order.

Input parameters:

- `body` (required): Any JSON value to hash.

### `attestation_verify` (~127 tokens)

Verify an ed25519 Attestation envelope (algorithm/signed_hash/signature/key_url/signed_at) against a body and a public key. Recomputes the canonical hash, checks it matches signed_hash, then verifies the ed25519 signature over the hash string. Returns { ok, reason? }. Public key accepted as 64-char hex or base64.

Input parameters:

- `attestation` (object, required)
- `body` (required): The body the attestation was minted over.
- `public_key` (string, required): 32-byte ed25519 verifying key as 64-char hex OR base64.

### `attestation_inspect` (~67 tokens)

Pretty-print an Attestation envelope with structural validation: confirms every required field is present, reports the decoded signature byte-length (should be 64), and surfaces the key_url + signed_at fields a caller would use to find the matching public key.

Input parameters:

- `attestation` (object, required)

### `audit_event_compose` (~142 tokens)

Build a ready-to-POST audit-stream-py GovernanceEvent: assigns event_id, computes the canonical hash, links to prev_hash (defaults to 64 zeros for event #1). Kind must be one of the 19 declared event kinds (decision_card_drafted, watch_drifted, request_denied, etc., plus 'other').

Input parameters:

- `event_id` (integer, required)
- `kind` (string, required)
- `payload` (object)
- `prev_hash` (string): 64-char hex; defaults to 64 zeros.
- `source` (string, required)
- `timestamp` (string): Optional ISO-8601; defaults to now.

### `audit_chain_verify` (~74 tokens)

Walk an array of GovernanceEvents top-to-bottom and verify the hash chain: monotonic event_id, prev_hash linkage, self-consistency of each event's hash. Returns { valid, checked, first_break_at, reason }, the same shape audit-stream-py's GET /verify endpoint emits.

Input parameters:

- `events` (array, required)

### `audit_event_inspect` (~62 tokens)

Pretty-print one GovernanceEvent with structural validation: required fields, known/unknown kind, payload key list, and self-consistency check (does the event's `hash` match the recomputed canonical hash of the body?).

Input parameters:

- `event` (object, required)

### `audit_event_emit` (~238 tokens)

POST one governance event to a running audit-stream-py instance (env var AUDIT_STREAM_URL). The server assigns event_id/timestamp/prev_hash/hash; the caller provides kind + source + payload. Use when Claude needs to record a governance moment from inside a chat (e.g. a manual override, a human-approved exception, an out-of-band incident). Returns the persisted event as audit-stream-py wrote it. Requires AUDIT_STREAM_URL in the MCP server's environment; returns a structured error otherwise.

Input parameters:

- `kind` (string, required): Event kind. Conventionally snake_case; matches the event kinds emitted by Kinetic Gain producers (decision_card_drafted, request_denied, breaker_opened, slo_burn_started, attestation_failed, watch_dr…
- `payload` (object): Free-form structured payload to record alongside kind+source.
- `source` (string, required): Who's emitting. Use a stable producer identifier (e.g. 'mcp-kinetic-gain', 'manual', or one of the suite producer names).

### `audit_events_query` (~179 tokens)

GET recent governance events from a running audit-stream-py instance (env var AUDIT_STREAM_URL), with optional server-side filters. Use to surface the last N denies, attestation failures, breaker trips, contract incompatibilities, or any other governance moment a user is investigating. Returns the events array plus a `count` field. Requires AUDIT_STREAM_URL; returns a structured error otherwise.

Input parameters:

- `kind` (string): Filter by event kind (exact match). Omit to get all kinds.
- `limit` (integer): Cap the number of events returned. Defaults to the server's own cap.
- `since_id` (integer): Return only events with event_id > since_id. Use for incremental tailing without re-fetching the whole chain.
- `source` (string): Filter by source (exact match). Omit to get all sources.

### `audit_chain_verify_live` (~96 tokens)

Ask a running audit-stream-py instance to walk its own chain end-to-end and report whether it's still intact. This is the canonical compliance answer, covers the FULL server-side history, not just events the agent has in context. Returns the same shape as the local audit_chain_verify tool (valid, checked, first_break_at, reason) but for the live chain. Requires AUDIT_STREAM_URL; returns a structured error otherwise.

### `suite_doc_detect_spec` (~63 tokens)

Detect which Kinetic Gain Suite spec a JSON document is by sniffing its top-level *_version field. Returns { spec, version_field, version }. Recognises all 12 specs; returns spec='unknown' for anything else.

Input parameters:

- `body` (object, required)

### `suite_doc_drift` (~81 tokens)

Structural diff between two versions of the same Suite document. Returns { drifted, spec_before, spec_after, spec_changed, content_hash_before, content_hash_after, added_fields, removed_fields, changed_fields }, mirrors the DriftReport shape aeo-validator-service emits for watch rechecks.

Input parameters:

- `after` (object, required)
- `before` (object, required)

### `defensetech_vault_resolve_3axis` (~90 tokens)

Resolve a (CUI tier, export-control status, foreign-person restriction) tuple against a DefenseTech 3-axis vault contract. Returns the most-restrictive resolved policy: intersected allowed_actions, max minimum_human_user_status, OR-ed requires_* flags. The DefenseTech runtime-policy operator.

Input parameters:

- `contract` (object, required)
- `tuple` (object, required)

### `defensetech_audit_event_check_invariants` (~111 tokens)

Run all 3 DefenseTech audit-stream invariants against a single event: (#1) CUI distribution-statement on CUI-Specified+ per DoDI 5230.24, (#2) ITAR us-person verification per 22 CFR 120.62, (#3) DFARS 252.204-7012(c)(1)(ii) 72-hour cyber incident reporting wall-clock. Returns ok + errors + passed.

Input parameters:

- `event` (object, required)

### `defensetech_check_dfars_72h_clock` (~69 tokens)

Check DFARS 252.204-7012(c)(1)(ii) 72-hour cyber-incident reporting clock specifically. Returns elapsed_hours, within_window, overrun_hours.

Input parameters:

- `filed_at` (string, required)
- `occurred_at` (string, required)

### `defensetech_check_cui_distribution_statement` (~68 tokens)

Check that a CUI-Specified+ tier event carries the required distribution_statement (DoDI 5230.24). For PUBLIC / CUI-BASIC tiers reports applicable=false.

Input parameters:

- `cui_categorization` (string, required)
- `distribution_statement` (object)

### `defensetech_check_itar_us_person` (~109 tokens)

Check that an ITAR resource event has US-PERSON-VERIFIED (or AUTHORIZED-FOREIGN-PERSON-WITH-LICENSE + DDTC license number tokenized) on the agent. Per 22 CFR 120.62 / 22 CFR 120.50 deemed-export rule.

Input parameters:

- `ddtc_export_license_number_tokenized` (string)
- `export_control_status` (string, required)
- `human_user_us_person_status` (string)

### `defensetech_incident_classify_event_type` (~99 tokens)

Given a freeform description of a defense-AI incident, classify it into one of the 22 DefenseTech Incident Card event_type values (DFARS cyber / CUI spillage / ITAR violation / foreign-person breach / classified misuse / NISPOM insider-threat / CMMC POA&M / AI-tool supply-chain / etc.). Returns top 3 candidates with token-match scoring.

Input parameters:

- `description` (string, required)

### `defensetech_summarize_cmmc_evidence_bundle` (~98 tokens)

Summarize a CMMC L2/L3 readiness evidence bundle: target level, assessment mode, evidence count, family coverage count, outcome distribution, orphan-failure count (not-satisfied without poam_ref), SPRS evidence presence, and quick invariant checks for POA&M traceability + SPRS-when-7019/7020-in-scope.

Input parameters:

- `bundle` (object, required)

### `defensetech_vault_contract_cross_binding_check` (~63 tokens)

Verify the cross_binding_refs block on a DefenseTech vault contract is syntactically valid: all referenced repos are HTTPS URLs. Returns valid_refs + errors. Does NOT fetch remotely (syntactic check only).

Input parameters:

- `contract` (object, required)

### `claims_card_validate` (~93 tokens)

Validate an AI Claims Decision Card (InsurTech) JSON document against the v0.1 spec. Checks the claims_card_version detection key, required top-level keys, decision.outcome enum, a non-empty evidence_bundle.sources, and the disclaimer. Returns { valid, claims_card_id, version } or { valid: false, reason }.

Input parameters:

- `document` (object, required): The Claims Decision Card JSON (parsed object).

### `claims_card_inspect` (~68 tokens)

Structured summary of an AI Claims Decision Card: claim type, outcome, coverage, evidence count, model, jurisdiction, human-in-loop, chain position, and attestation status. Cheaper than reading the full card.

Input parameters:

- `document` (object, required): The Claims Decision Card JSON (parsed object).

### `claims_card_sign` (~84 tokens)

Compute the canonical SHA-256 hash of an AI Claims Decision Card for ed25519 signing. Sorts object keys recursively and excludes attestation.card_hash + attestation.signature before hashing. Returns the 64-char lowercase hex card_hash; caller signs it offline.

Input parameters:

- `document` (object, required): Claims Decision Card. attestation.card_hash and attestation.signature are stripped before hashing.

### `claims_card_chain` (~117 tokens)

Link a new AI Claims Decision Card to its predecessor: sets attestation.chain_index (prev + 1) and attestation.prev_card_hash. Validates the predecessor hash is 64-char hex and its index is a non-negative integer. Call claims_card_sign next.

Input parameters:

- `card` (object, required): The new Claims Decision Card (attestation may be partial).
- `prev_card_hash` (string, required): 64-char lowercase hex SHA-256 of the previous card.
- `prev_chain_index` (integer, required): chain_index of the previous card.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/mizcausevic-dev-mcp-kinetic-gain/mcp-kinetic-gain#diagnostics

## Score history

- 2026-08-03: 62
- 2026-08-02: 47
- 2026-08-01: 24
- 2026-07-31: 19
- 2026-07-30: 25
- 2026-07-28: 43
- 2026-07-27: 43

## Links

- npm package: https://www.npmjs.com/package/mcp-kinetic-gain
- Socket report: https://socket.dev/npm/package/mcp-kinetic-gain
- Repository: https://github.com/mizcausevic-dev/mcp-kinetic-gain
- Changelog RSS feed: https://verifymcp.io/servers/mizcausevic-dev-mcp-kinetic-gain/mcp-kinetic-gain/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/mizcausevic-dev-mcp-kinetic-gain/mcp-kinetic-gain/changelog.json
- HTML version of this page: https://verifymcp.io/servers/mizcausevic-dev-mcp-kinetic-gain/mcp-kinetic-gain