four tools - one server - one post-quantum primitive

One MCP server. Real receipts. No mocks.

Every panel below is the output of running the actual tool function on the server. The receipt fields shown - atom_id, evidence_hash, signature_alg, the legs - are what the merged OpenAgentOntology mint_receipt returned on this run. The tamper panel actually edits a signed receipt and re-verifies it. Smithery publish package is staged; nothing is submitted.

Bottom Line

4 tools. All PQ-signed. All verify. Tamper caught.

So What

#4 and #5 collapse to one testable MCP server.

What We Did

Reused OAO mint_receipt; FastMCP wiring; 10/10 tests.

What's Next

Approve Smithery submission per-item. Nothing auto.

live demo - generated from real tool outputs

The four tools. Each one runs.

mint_receipt_for_record_change()

A CRM record change becomes per-decision evidence

tool call

record_id="opp-019efc34", object_type="Opportunity",
field="stage", old_value="discovery", new_value="closed_won",
changed_by_agent="relaticle-ai@tenant-acme"

action carried (hashes, not cleartext)

{
  "operation": "crm_record_change",
  "record_id": "opp-019efc34",
  "object_type": "Opportunity",
  "field": "stage",
  "old_value_hash": "sha256:fa44132b238e67958fb17d33a71d325221805079909c3a7f5bed1a03666cf834",
  "new_value_hash": "sha256:514d98f5d057b523a2f0217782251c2b333432a0df91424675fb1391dfd9b93d",
  "changed_by_agent": "relaticle-ai@tenant-acme",
  "tenant": "acme",
  "policy": "per-decision CRM change evidence"
}

receipt

decision:      CRM_RECORD_CHANGED
atom_id:       oao-ONTOLOGY-e43176b400
evidence_hash: e43176b4007e5e4108c0aab76fea98f0e77014cbb17ddb157057...
signature_alg: Ed25519+ML-DSA-65+SLH-DSA
legs verified: Ed25519 + ML-DSA-65 + SLH-DSA
verify:        VALID (hash valid; verified from the cert alone via: ed25519,)

audit_my_agent_inventory()

Caller-provided inventory → worst-regret ranking (read-only)

tool call

inventory=[gmail.send_email, files.delete_file, stripe.charge_card, calendar.create_event, search.web_search]

honest scope (in every response)

input-driven: the MCP protocol does not allow auto-discovery of other servers; the caller supplied the inventory

ranking

  CRITICAL  score= 90  files/delete_file (delete)
  CRITICAL  score= 90  stripe/charge_card (pay)
  HIGH      score= 70  gmail/send_email (send)
  MEDIUM    score= 40  calendar/create_event (write)
  LOW       score= 10  search/web_search (read)

design choice

read-only by design. the caller passes the returned
audit_manifest_for_receipt to mint_action_receipt
if they want the audit recorded.

mint_action_receipt()

General-purpose post-quantum agent action receipt

tool call

agent_id="ci-deploy-agent", operation="deploy",
target="prod/grid-api", policy="EU AI Act Art 12"

receipt

decision:      ACTION_GOVERNED
atom_id:       oao-ONTOLOGY-850b0cdba1
evidence_hash: 850b0cdba102ec7f6962928f67bd3bbaa340a8e001d3d5d0609d...
signature_alg: Ed25519+ML-DSA-65+SLH-DSA
legs verified: Ed25519 + ML-DSA-65 + SLH-DSA
verify:        VALID

verify_receipt() -- tamper demo

One field edit (operation: deploy → delete) breaks verification

before tamper

verify: True  (intact receipt)

after one-field tamper

verify: False
reason: evidence_hash mismatch -- evidence was altered

Honesty footer

What this MCP does not claim.

No auto-discovery. audit_my_agent_inventory cannot enumerate the host's other MCP servers - MCP gives a server no view of its siblings. The caller passes the inventory in. Every response carries this scope note.
Read-only audit. The audit tool returns the ranking and a manifest the caller can hand to mint_action_receipt. It does not mint a receipt itself, so it is not a side-effecting authority surface.
Tamper-evident, not "admissible". A signed receipt is tamper-evident and verify-from-cert; admissibility in any forum is a separate decision for counsel.
Heuristic ranking. Worst-regret tiers are inferred from side-effecting verbs in the tool's label, anchored to OWASP Agentic Threats T2/T3 + LLM06. Verb inference can misfire (e.g. "delete_label" vs "delete_user"); the output is a starting point, not a proof.
Smithery publish is gated. smithery.yaml + Dockerfile are staged in this directory; nothing is submitted. See PUBLISH.md for the three publish paths and the verified-or-ABSTAIN note on schema field names.