{"serverId":"mcp-registry/io.github.projetnanocorp/mandate","tools":[{"name":"broker.introspect-grant","fixed":{"name":"broker_introspect-grant","description":"Validates a grant token seal, reports active/revoked/expired state, and records introspection to the ledger.","inputSchema":{"type":"object","properties":{}},"title":"Introspect credential grant"},"changes":[{"kind":"name","detail":"Renamed \"broker.introspect-grant\" → \"broker_introspect-grant\" (letters, digits, _ and - only; max 64). Keep the old name as an alias for a release if clients already call it.","verify":true},{"kind":"schema","detail":"Removed required entries with no matching property: grant_token.","verify":true}],"tokensBefore":61,"tokensAfter":58},{"name":"broker.register-credential","fixed":{"name":"broker_register-credential","description":"Registers an opaque vault handle/reference only; plaintext secret fields are rejected and never ledgered.","inputSchema":{"type":"object","required":["vault_handle"],"properties":{"metadata":{"type":"object"},"vault_handle":{"type":"string","description":"Opaque vault reference such as vault://provider/path; never a plaintext secret."}}},"title":"Register credential handle"},"changes":[{"kind":"name","detail":"Renamed \"broker.register-credential\" → \"broker_register-credential\" (letters, digits, _ and - only; max 64). Keep the old name as an alias for a release if clients already call it.","verify":true},{"kind":"schema","detail":"Removed required entries with no matching property: organization_id, registered_by_agent_id, label, credential_type, allowed_action_type.","verify":true}],"tokensBefore":135,"tokensAfter":109},{"name":"broker.request-access","fixed":{"name":"broker_request-access","description":"Asks the canonical Policy Engine for an ALLOW decision before issuing a short-lived HMAC-sealed grant bound to credential, mandate, agent, scope, and expiry.","inputSchema":{"type":"object","properties":{}},"title":"Request short-lived credential grant"},"changes":[{"kind":"name","detail":"Renamed \"broker.request-access\" → \"broker_request-access\" (letters, digits, _ and - only; max 64). Keep the old name as an alias for a release if clients already call it.","verify":true},{"kind":"schema","detail":"Removed required entries with no matching property: credential_id, acting_agent_id, mandate_id, action.","verify":true}],"tokensBefore":86,"tokensAfter":71},{"name":"broker.revoke-grant","fixed":{"name":"broker_revoke-grant","description":"Revokes a broker grant by id and records the revocation to the ledger.","inputSchema":{"type":"object","properties":{}},"annotations":{"readOnlyHint":false,"destructiveHint":true,"idempotentHint":false},"title":"Revoke credential grant"},"changes":[{"kind":"name","detail":"Renamed \"broker.revoke-grant\" → \"broker_revoke-grant\" (letters, digits, _ and - only; max 64). Keep the old name as an alias for a release if clients already call it.","verify":true},{"kind":"schema","detail":"Removed required entries with no matching property: revoked_by_agent_id, reason.","verify":true},{"kind":"annotations","detail":"Added readOnlyHint: false, destructiveHint: true, idempotentHint: false (inferred from the name).","verify":true}],"tokensBefore":54,"tokensAfter":46},{"name":"broker.use","fixed":{"name":"broker_use","description":"Redeems a sealed grant for the bound acting agent and executes the bound action through the Gateway and Policy Engine; does not expose plaintext secrets.","inputSchema":{"type":"object","properties":{}},"title":"Use credential grant"},"changes":[{"kind":"name","detail":"Renamed \"broker.use\" → \"broker_use\" (letters, digits, _ and - only; max 64). Keep the old name as an alias for a release if clients already call it.","verify":true},{"kind":"schema","detail":"Removed required entries with no matching property: grant_token, acting_agent_id.","verify":true}],"tokensBefore":75,"tokensAfter":67},{"name":"mandate.authorize-action","fixed":{"name":"mandate_authorize-action","description":"Submits an action through the Gateway and canonical Policy Engine; returns ALLOW, DENY, or REQUIRE_APPROVAL with ledger proof.","inputSchema":{"type":"object","properties":{}},"title":"Authorize gateway action"},"changes":[{"kind":"name","detail":"Renamed \"mandate.authorize-action\" → \"mandate_authorize-action\" (letters, digits, _ and - only; max 64). Keep the old name as an alias for a release if clients already call it.","verify":true},{"kind":"schema","detail":"Removed required entries with no matching property: acting_agent_id, action_type, amount_minor, counterparty.","verify":true}],"tokensBefore":80,"tokensAfter":63},{"name":"mandate.delegate","fixed":{"name":"mandate_delegate","description":"Creates a child mandate only when it is a no-escalation subset of the parent mandate.","inputSchema":{"type":"object","properties":{}},"title":"Delegate mandate"},"changes":[{"kind":"name","detail":"Renamed \"mandate.delegate\" → \"mandate_delegate\" (letters, digits, _ and - only; max 64). Keep the old name as an alias for a release if clients already call it.","verify":true},{"kind":"schema","detail":"Removed required entries with no matching property: parent_mandate_id, delegator_agent_id, delegate_agent_id, budget_total, per_action_limit, starts_at, expires_at, scopes.","verify":true}],"tokensBefore":85,"tokensAfter":50},{"name":"mandate.discover","fixed":{"name":"mandate_discover","description":"Returns this self-describing tool manifest.","inputSchema":{"type":"object","properties":{},"additionalProperties":false},"title":"Discover MANDATE agent tools"},"changes":[{"kind":"name","detail":"Renamed \"mandate.discover\" → \"mandate_discover\" (letters, digits, _ and - only; max 64). Keep the old name as an alias for a release if clients already call it.","verify":true}],"tokensBefore":46,"tokensAfter":46},{"name":"mandate.mint","fixed":{"name":"mandate_mint","description":"Creates an active human-granted mandate for an agent and records it to the hash-chained ledger.","inputSchema":{"type":"object","properties":{}},"title":"Mint root mandate"},"changes":[{"kind":"name","detail":"Renamed \"mandate.mint\" → \"mandate_mint\" (letters, digits, _ and - only; max 64). Keep the old name as an alias for a release if clients already call it.","verify":true},{"kind":"schema","detail":"Removed required entries with no matching property: organization_id, agent_id, grantor_principal_id, budget_currency, budget_total, per_action_limit, expires_at, scopes.","verify":true}],"tokensBefore":85,"tokensAfter":51},{"name":"mandate.revoke","fixed":{"name":"mandate_revoke","description":"Revokes a mandate subtree and records the revocation to the hash-chained ledger.","inputSchema":{"type":"object","properties":{}},"annotations":{"readOnlyHint":false,"destructiveHint":true,"idempotentHint":false},"title":"Revoke mandate"},"changes":[{"kind":"name","detail":"Renamed \"mandate.revoke\" → \"mandate_revoke\" (letters, digits, _ and - only; max 64). Keep the old name as an alias for a release if clients already call it.","verify":true},{"kind":"schema","detail":"Removed required entries with no matching property: revoked_by_principal_id, reason.","verify":true},{"kind":"annotations","detail":"Added readOnlyHint: false, destructiveHint: true, idempotentHint: false (inferred from the name).","verify":true}],"tokensBefore":57,"tokensAfter":48},{"name":"mandate.verify-proof","fixed":{"name":"mandate_verify-proof","description":"Records a proof payload hash and appends proof evidence to the hash-chained ledger.","inputSchema":{"type":"object","properties":{}},"title":"Record or verify proof"},"changes":[{"kind":"name","detail":"Renamed \"mandate.verify-proof\" → \"mandate_verify-proof\" (letters, digits, _ and - only; max 64). Keep the old name as an alias for a release if clients already call it.","verify":true},{"kind":"schema","detail":"Removed required entries with no matching property: organization_id, subject_type, subject_id, proof_type, payload.","verify":true}],"tokensBefore":69,"tokensAfter":50}],"toolsChanged":11,"tokensSaved":174,"todo":[{"tool":"broker_register-credential","params":["metadata"]}],"note":"Deterministic fixes. Changes marked verify need a human look before shipping (renames, inferred annotations, inferred types, removed text). Parameter descriptions in `todo` need to be written by someone who knows the API."}