PHION Agent Trust Infrastructure
by phion.systems · remote · no sign-in to list tools · v1.57.0 · published by systems.phion
123 agent services with free discovery, intent, x402 terms and signed verification.
Deletes · 1Final · 8Changes · 106
135 tools: 1 can delete or cancel things, 8 do something that can't be undone, 106 change things and 20 only read.
Scanned Oct 21, 2026
- Deletes or cancels1Claude Code: deny: see these tools
- Can't be undone8Claude Code: ask: see these tools
- Changes things106Claude Code: ask: see these tools
- Only reads20Claude Code: allow: see these tools
17 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http evidence-engine https://phion.systems/mcpFindings
Matches of fixed checks, with the text they matched.
The server marks "payment_capability_preflight" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "payment_capability_preflight" says "payment": a word that usually means money moves, which cannot be taken back.
The server marks "payment_preflight" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "payment_preflight" says "payment": a word that usually means money moves, which cannot be taken back.
The server marks "payment_route_selector" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "payment_route_selector" says "payment": a word that usually means money moves, which cannot be taken back.
The server marks "payment_receipt_reconciler" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "payment_receipt_reconciler" says "payment": a word that usually means money moves, which cannot be taken back.
The server marks "duplicate_charge_detector" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "duplicate_charge_detector" says "charge": a word that usually means money moves, which cannot be taken back.
The server marks "task_cancel_assurance" read-only (readOnlyHint: true), and its own name, description or input give the class "destructive".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "task_cancel_assurance" says "cancel": a word for removing or ending something.
Show 11 more findingsShow fewer
The server marks "task_cancel_assurance" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "task_cancel_assurance" says "cancel": a word for removing or ending something.
The server marks "payment_delivery_atomicity" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "payment_delivery_atomicity" says "payment": a word that usually means money moves, which cannot be taken back.
The server marks "agent_behavior_fingerprint" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "create": a word for a change.
The server marks "payment_optimizer" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "payment_optimizer" says "payment": a word that usually means money moves, which cannot be taken back.
- Warnx402_v2_router
The server marks "x402_v2_router" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "select": a word for a change.
- Warnproof_of_service
The server marks "proof_of_service" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "commit": a word for a change.
The server marks "reputation_update_receipt" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "reputation_update_receipt" says "update": a word for a change.
- Infotry_service
The input schema at properties.service.enum[79] mentions "credential".
What this check looks forMatched text
inputSchema.properties.service.enum[79]: "delegated-credential-guard"
The title mentions "Credential".
What this check looks forMatched text
title: "Delegated Credential Guard"
The description mentions "Credential".
What this check looks forMatched text
description: "Delegated Credential Guard; deterministic signed assessment..."
The input schema at required[0] mentions "credential".
What this check looks forMatched text
inputSchema.required[0]: "credential"
Tools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
135 tools
Deletes or cancels 1Claude Code: deny
task_cancel_assuranceTask Cancel Assurance; deterministic signed assessment over supplied input.2 findings
Why it is in this group
- The name "task_cancel_assurance" says "cancel": a word for removing or ending something.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
- The server marks it not destructive (destructiveHint: false), but an annotation never lowers a class.
Findings
- Warn
The server marks "task_cancel_assurance" read-only (readOnlyHint: true), and its own name, description or input give the class "destructive".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "task_cancel_assurance" says "cancel": a word for removing or ending something.
- Warn
The server marks "task_cancel_assurance" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "task_cancel_assurance" says "cancel": a word for removing or ending something.
Description, as the server wrote it Task Cancel Assurance; deterministic signed assessment over supplied input.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
Can't be undone 8Claude Code: ask
duplicate_charge_detectorDetect repeated transaction hashes, payment identifiers and idempotent intents; 0.003 USDC.1 finding
Why it is in this group
- The name "duplicate_charge_detector" says "charge": a word that usually means money moves, which cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "duplicate_charge_detector" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "duplicate_charge_detector" says "charge": a word that usually means money moves, which cannot be taken back.
Description, as the server wrote it Detect repeated transaction hashes, payment identifiers and idempotent intents; 0.003 USDC.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
payment_capability_preflightFree anonymous non-blocking self-report of wallet, mandate, x402 v2, network, asset, account kind and funding readiness.1 finding
Why it is in this group
- The name "payment_capability_preflight" says "payment": a word that usually means money moves, which cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "payment_capability_preflight" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "payment_capability_preflight" says "payment": a word that usually means money moves, which cannot be taken back.
Description, as the server wrote it Free anonymous non-blocking self-report of wallet, mandate, x402 v2, network, asset, account kind and funding readiness. Detects EVM account types incompatible with exact EIP-3009 before signature. Stores only a daily pseudonymous actor and normalized reason; never a wallet, balance, signature or request content.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
payment_delivery_atomicityPayment Delivery Atomicity; deterministic signed assessment over supplied input.1 finding
Why it is in this group
- The name "payment_delivery_atomicity" says "payment": a word that usually means money moves, which cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "payment_delivery_atomicity" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "payment_delivery_atomicity" says "payment": a word that usually means money moves, which cannot be taken back.
Description, as the server wrote it Payment Delivery Atomicity; deterministic signed assessment over supplied input.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
payment_diagnoseFree diagnosis of the exact payment-funnel stage and machine-readable recovery actions for any PHION service.No findings
Why it is in this group
- The name "payment_diagnose" says "payment": a word that usually means money moves, which cannot be taken back.
Description, as the server wrote it Free diagnosis of the exact payment-funnel stage and machine-readable recovery actions for any PHION service.
payment_optimizerRank only integration-tested payment routes under explicit cost and latency constraints.; 0.003 USDC.1 finding
Why it is in this group
- The name "payment_optimizer" says "payment": a word that usually means money moves, which cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "payment_optimizer" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "payment_optimizer" says "payment": a word that usually means money moves, which cannot be taken back.
Description, as the server wrote it Rank only integration-tested payment routes under explicit cost and latency constraints.; 0.003 USDC. Deterministic, evidence-bounded and signed.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
payment_preflightFail-closed x402 v2 firewall for network, asset, recipient, amount, scheme, resource host and expiry; 0.002 USDC.1 finding
Why it is in this group
- The name "payment_preflight" says "payment": a word that usually means money moves, which cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "payment_preflight" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "payment_preflight" says "payment": a word that usually means money moves, which cannot be taken back.
Description, as the server wrote it Fail-closed x402 v2 firewall for network, asset, recipient, amount, scheme, resource host and expiry; 0.002 USDC.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
payment_receipt_reconcilerCompare canonical and common x402 payment/receipt aliases, settlement state and coverage; 0.003 USDC.1 finding
Why it is in this group
- The name "payment_receipt_reconciler" says "payment": a word that usually means money moves, which cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "payment_receipt_reconciler" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "payment_receipt_reconciler" says "payment": a word that usually means money moves, which cannot be taken back.
Description, as the server wrote it Compare canonical and common x402 payment/receipt aliases, settlement state and coverage; 0.003 USDC.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
payment_route_selectorReject impossible x402 routes, rank safe eligible routes by policy and return the exact next payment action; read-only, deterministic, 0.002 USDC.1 finding
Why it is in this group
- The name "payment_route_selector" says "payment": a word that usually means money moves, which cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "payment_route_selector" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "payment_route_selector" says "payment": a word that usually means money moves, which cannot be taken back.
Description, as the server wrote it Reject impossible x402 routes, rank safe eligible routes by policy and return the exact next payment action; read-only, deterministic, 0.002 USDC.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: Payment Route Selector
Changes things 106Claude Code: ask
a2a_transaction_bridgeBind an A2A task to a transaction without silently transferring authority.; 0.004 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Bind an A2A task to a transaction without silently transferring authority.; 0.004 USDC. Deterministic, evidence-bounded and signed.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
abandoned_tool_detectorRequire stale success plus multiple independent failed probes before classifying likely abandonment; 0.003 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Require stale success plus multiple independent failed probes before classifying likely abandonment; 0.003 USDC.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
agent_approval_relayAgent Approval Relay; deterministic signed assessment over supplied input.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Agent Approval Relay; deterministic signed assessment over supplied input.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
agent_behavior_fingerprintCreate a privacy-minimized behavioral commitment without retaining payloads or raw identifiers.; 0.003 USDC.1 finding
Why it is in this group
- The description's first verb is "create": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "agent_behavior_fingerprint" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "create": a word for a change.
Description, as the server wrote it Create a privacy-minimized behavioral commitment without retaining payloads or raw identifiers.; 0.003 USDC. Deterministic, evidence-bounded and signed.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
agent_budget_guardEnforce per-call, task, session and period budgets; 0.002 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Enforce per-call, task, session and period budgets; 0.002 USDC.
agent_economic_graphBuild privacy-bounded economic relationships only from supplied nodes and edges.; 0.005 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Build privacy-bounded economic relationships only from supplied nodes and edges.; 0.005 USDC. Deterministic, evidence-bounded and signed.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
agent_memory_provenanceAgent Memory Provenance; deterministic signed assessment over supplied input.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Agent Memory Provenance; deterministic signed assessment over supplied input.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
agent_rate_limit_negotiatorAgent Rate Limit Negotiator; deterministic signed assessment over supplied input.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Agent Rate Limit Negotiator; deterministic signed assessment over supplied input.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
agent_reputation_evidenceEvidence-bounded agent reputation assessment with confidence, coverage, provenance limitations and a signed receipt; 0.005 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Evidence-bounded agent reputation assessment with confidence, coverage, provenance limitations and a signed receipt; 0.005 USDC.
agent_session_continuityAgent Session Continuity; deterministic signed assessment over supplied input.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Agent Session Continuity; deterministic signed assessment over supplied input.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
agent_task_handoff_receiptSign a bounded agent-task handoff; 0.003 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Sign a bounded agent-task handoff; 0.003 USDC.
ap2_mandate_bridgeMap mandate fields for review without advertising unsupported AP2 production authorization.; 0.004 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Map mandate fields for review without advertising unsupported AP2 production authorization.; 0.004 USDC. Deterministic, evidence-bounded and signed.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
attestx402 paid signed JSON attestation; 0.001 USDC on Base.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it x402 paid signed JSON attestation; 0.001 USDC on Base.
automated_dispute_bundleAssemble failure evidence and recommend resolution without executing refunds.; 0.005 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Assemble failure evidence and recommend resolution without executing refunds.; 0.005 USDC. Deterministic, evidence-bounded and signed.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
autonomous_procurementRecommend a verified eligible provider under a mandate without purchasing.; 0.005 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Recommend a verified eligible provider under a mandate without purchasing.; 0.005 USDC. Deterministic, evidence-bounded and signed.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
capability_benchmarkMeasure reproducible success, latency and cost from versioned evidence-bound benchmark cases.; 0.004 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Measure reproducible success, latency and cost from versioned evidence-bound benchmark cases.; 0.004 USDC. Deterministic, evidence-bounded and signed.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
capability_negotiation_preflightCapability Negotiation Preflight; deterministic signed assessment over supplied input.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Capability Negotiation Preflight; deterministic signed assessment over supplied input.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
capability_verificationSeparate claimed capabilities from independently evidenced successful demonstrations.; 0.003 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Separate claimed capabilities from independently evidenced successful demonstrations.; 0.003 USDC. Deterministic, evidence-bounded and signed.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
company_enrichment_evidenceCompany enrichment with free input preflight, provider attribution and signed evidence; 0.005 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Company enrichment with free input preflight, provider attribution and signed evidence; 0.005 USDC.
concurrency_guardFail closed unless capacity counter is fresh and the request carries a lease plus idempotency binding; 0.002 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Fail closed unless capacity counter is fresh and the request carries a lease plus idempotency binding; 0.002 USDC.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
contact_enrichment_evidenceBusiness-contact enrichment with free input preflight, identity limitations and signed receipt; 0.007 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Business-contact enrichment with free input preflight, identity limitations and signed receipt; 0.007 USDC.
context_provenance_labelerHash and label context integrity, confidentiality and source; 0.002 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Hash and label context integrity, confidentiality and source; 0.002 USDC.
counterparty_risk_preflightDeterministic counterparty policy preflight using supplied reputation evidence and transaction limits; 0.003 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Deterministic counterparty policy preflight using supplied reputation evidence and transaction limits; 0.003 USDC.
cross_agent_receipt_bundleCross-Agent Receipt Bundle; deterministic signed assessment over supplied input.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Cross-Agent Receipt Bundle; deterministic signed assessment over supplied input.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
cross_protocol_receiptBundle consistent transaction commitments across multiple protocols.; 0.004 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Bundle consistent transaction commitments across multiple protocols.; 0.004 USDC. Deterministic, evidence-bounded and signed.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
data_freshness_certificateCertify freshness only when timestamp is bound to source URI and a 64-hex content hash; 0.002 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Certify freshness only when timestamp is bound to source URI and a 64-hex content hash; 0.002 USDC.
delegated_credential_guardDelegated Credential Guard; deterministic signed assessment over supplied input.3 findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Info
The title mentions "Credential".
What this check looks forMatched text
title: "Delegated Credential Guard"
- Info
The description mentions "Credential".
What this check looks forMatched text
description: "Delegated Credential Guard; deterministic signed assessment..."
- Info
The input schema at required[0] mentions "credential".
What this check looks forMatched text
inputSchema.required[0]: "credential"
Description, as the server wrote it Delegated Credential Guard; deterministic signed assessment over supplied input.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
delegated_spend_policyFail closed when delegated authority, per-call limit or remaining budget is insufficient.; 0.003 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Fail closed when delegated authority, per-call limit or remaining budget is insufficient.; 0.003 USDC. Deterministic, evidence-bounded and signed.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
delegation_scope_guardLeast-privilege guard for agent-to-agent delegation scope, destinations, budget and expiry; 0.003 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Least-privilege guard for agent-to-agent delegation scope, destinations, budget and expiry; 0.003 USDC.
delivery_evidenceBind successful delivery to transaction, request and matching 64-hex expected/observed content hashes without echoing content; 0.003 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Bind successful delivery to transaction, request and matching 64-hex expected/observed content hashes without echoing content; 0.003 USDC.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
dependency_provenance_assessmentFail closed on empty dependency sets or absent registry policy; distinguish digest declarations from verified provenance; 0.003 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Fail closed on empty dependency sets or absent registry policy; distinguish digest declarations from verified provenance; 0.003 USDC.
document_to_verified_jsonPublic text, HTML, JSON or XML normalized to source-backed JSON; no OCR; 0.010 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Public text, HTML, JSON or XML normalized to source-backed JSON; no OCR; 0.010 USDC.
domain_ownership_evidenceRequire a fresh domain-bound DNS-01/HTTP-01 challenge and separate control from legal ownership; 0.003 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Require a fresh domain-bound DNS-01/HTTP-01 challenge and separate control from legal ownership; 0.003 USDC.
durable_agent_taskDurable Agent Task; deterministic signed assessment over supplied input.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Durable Agent Task; deterministic signed assessment over supplied input.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
dynamic_service_pricingPropose a capped shadow price without changing the live catalog.; 0.004 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Propose a capped shadow price without changing the live catalog.; 0.004 USDC. Deterministic, evidence-bounded and signed.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
economic_loop_detectorDetect self-transfer and reciprocal economic patterns without presenting correlation as fraud.; 0.004 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Detect self-transfer and reciprocal economic patterns without presenting correlation as fraud.; 0.004 USDC. Deterministic, evidence-bounded and signed.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
entity_enrichment_evidenceSource-bounded entity field coverage with explicit missing facts; 0.008 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Source-bounded entity field coverage with explicit missing facts; 0.008 USDC.
erc8004_identity_evidenceBind an ERC-8004 registry identity to evidence while separating registration from ownership.; 0.004 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Bind an ERC-8004 registry identity to evidence while separating registration from ownership.; 0.004 USDC. Deterministic, evidence-bounded and signed.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
erc8004_reputation_intelligenceAggregate diverse verified reputation observations with low-sample abstention.; 0.004 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Aggregate diverse verified reputation observations with low-sample abstention.; 0.004 USDC. Deterministic, evidence-bounded and signed.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
execution_cost_estimatorExecution Cost Estimator; deterministic signed assessment over supplied input.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Execution Cost Estimator; deterministic signed assessment over supplied input.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
human_approval_policyClassify an action as automatic, approval-required or denied; 0.002 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Classify an action as automatic, approval-required or denied; 0.002 USDC.
idempotency_replay_guardDetect safe replays and conflicting idempotency-key reuse; 0.002 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Detect safe replays and conflicting idempotency-key reuse; 0.002 USDC.
index_feedCanonical catalog snapshot or digest-based delta with exact HTTP/MCP records, PHION Execute templates and signed evidence; 0.005 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Canonical catalog snapshot or digest-based delta with exact HTTP/MCP records, PHION Execute templates and signed evidence; 0.005 USDC.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
inter_agent_policy_evaluatorRequire policy identity, subject, action, lifetime and valid decisions; compute the restrictive cap and shared actions; 0.003 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Require policy identity, subject, action, lifetime and valid decisions; compute the restrictive cap and shared actions; 0.003 USDC.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
interrupted_task_recoveryResume only when task/checkpoint identity, sequence, deadline, attempt budget, idempotency and side effects are explicit; 0.003 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Resume only when task/checkpoint identity, sequence, deadline, attempt budget, idempotency and side effects are explicit; 0.003 USDC.
journey_verifyVerify hash continuity, timestamps and ordered intent→quote→payment→delivery lifecycle; 0.010 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Verify hash continuity, timestamps and ordered intent→quote→payment→delivery lifecycle; 0.010 USDC.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
live_data_freshnessEvaluate live source observation against explicit maximum age; 0.002 USDC.No findings
Why it is in this group
- The description's first verb is "evaluate": a word for a change.
Description, as the server wrote it Evaluate live source observation against explicit maximum age; 0.002 USDC.
mandate_reserveAtomic spending reservation with cumulative cap and conflict-safe idempotency; 0.004 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Atomic spending reservation with cumulative cap and conflict-safe idempotency; 0.004 USDC.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: false
market_demand_predictorForecast verified demand trends while abstaining on insufficient history.; 0.005 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Forecast verified demand trends while abstaining on insufficient history.; 0.005 USDC. Deterministic, evidence-bounded and signed.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
mcp_2026_compatibility_gatewayMCP 2026 Compatibility Gateway; deterministic signed assessment over supplied input.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it MCP 2026 Compatibility Gateway; deterministic signed assessment over supplied input.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
mcp_a2a_task_bridgeMCP-A2A Task Bridge; deterministic signed assessment over supplied input.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it MCP-A2A Task Bridge; deterministic signed assessment over supplied input.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
mcp_catalog_cache_guardMCP Catalog Cache Guard; deterministic signed assessment over supplied input.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it MCP Catalog Cache Guard; deterministic signed assessment over supplied input.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
mcp_server_identity_evidenceBind MCP domain, endpoint, manifest, key and version; 0.003 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Bind MCP domain, endpoint, manifest, key and version; 0.003 USDC.
mcp_transaction_gatewayBind an MCP tool call to transaction evidence without granting undeclared authority.; 0.004 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Bind an MCP tool call to transaction evidence without granting undeclared authority.; 0.004 USDC. Deterministic, evidence-bounded and signed.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
memory_write_guardScreen persistent memory writes for poisoning, unsafe instructions and missing provenance; 0.002 USDC.No findings
Why it is in this group
- The name "memory_write_guard" says "write": a word for a change.
Description, as the server wrote it Screen persistent memory writes for poisoning, unsafe instructions and missing provenance; 0.002 USDC.
multi_agent_escrowRecommend hold or release from evidence without PHION custody or fund movement.; 0.005 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Recommend hold or release from evidence without PHION custody or fund movement.; 0.005 USDC. Deterministic, evidence-bounded and signed.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
multi_source_fact_bundleIndependent source observations with agreement made explicit; 0.005 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Independent source observations with agreement made explicit; 0.005 USDC.
oauth_issuer_binding_evidenceOAuth Issuer Binding Evidence; deterministic signed assessment over supplied input.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it OAuth Issuer Binding Evidence; deterministic signed assessment over supplied input.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
onchain_evidencePublic explorer or RPC response evidence with immutable hashes; 0.004 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Public explorer or RPC response evidence with immutable hashes; 0.004 USDC.
person_enrichment_evidencePerson enrichment with free input preflight, provider attribution, likelihood, limitations and signed receipt; 0.006 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Person enrichment with free input preflight, provider attribution, likelihood, limitations and signed receipt; 0.006 USDC.
phion_discoverFree complete PHION service index generated from canonical inventory.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Free complete PHION service index generated from canonical inventory. Use when the agent knows a capability or wants to inspect the full network.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
phion_enrichEnrich a company, person or contact through an attributed provider route without hiding upstream cost.; 0.120 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Enrich a company, person or contact through an attributed provider route without hiding upstream cost.; 0.120 USDC. Deterministic, evidence-bounded and signed.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
phion_enrich_basicObserve a public company domain directly and return bounded website metadata, hashes, injection screening and signed delivery without an expensive enrichment upstream.; 0.003 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Observe a public company domain directly and return bounded website metadata, hashes, injection screening and signed delivery without an expensive enrichment upstream.; 0.003 USDC. Deterministic, evidence-bounded and signed.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
phion_executeUniversal PHION execution gateway: enforce a budget and persistent idempotency, execute one selected PHION service, evaluate acceptance criteria, and return a signed completion env…No findings
Why it is in this group
- The name "phion_execute" says "execute": a word for a change.
Description, as the server wrote it Universal PHION execution gateway: enforce a budget and persistent idempotency, execute one selected PHION service, evaluate acceptance criteria, and return a signed completion envelope. No gateway surcharge; the selected service price applies.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: false
phion_inferenceComplete a bounded inference microtask and return a directly usable answer with signed delivery.; 0.001 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Complete a bounded inference microtask and return a directly usable answer with signed delivery.; 0.001 USDC. Deterministic, evidence-bounded and signed.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
phion_preflightFree service-specific schema, network, budget and economic preflight.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Free service-specific schema, network, budget and economic preflight. It does not execute or charge.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
preflightFree URL safety and reachability check.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Free URL safety and reachability check.
price_discovery_engineDerive price bands only from settled observations, never traffic or unsigned quotes.; 0.005 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Derive price bands only from settled observations, never traffic or unsigned quotes.; 0.005 USDC. Deterministic, evidence-bounded and signed.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
proof_of_serviceCommit request, authority, execution, payment and delivery evidence in one proof.; 0.005 USDC.1 finding
Why it is in this group
- The description's first verb is "commit": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "proof_of_service" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "commit": a word for a change.
Description, as the server wrote it Commit request, authority, execution, payment and delivery evidence in one proof.; 0.005 USDC. Deterministic, evidence-bounded and signed.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
provider_quality_predictorEstimate provider success, quality, latency and cost using transparent sample-aware statistics.; 0.004 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Estimate provider success, quality, latency and cost using transparent sample-aware statistics.; 0.004 USDC. Deterministic, evidence-bounded and signed.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
purpose_bound_consentFail-closed consent bound to ID, subject, recipient, purpose, scope, issue/expiry and checked revocation state; 0.003 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Fail-closed consent bound to ID, subject, recipient, purpose, scope, issue/expiry and checked revocation state; 0.003 USDC.
quote_freshness_guardQuote Freshness Guard; deterministic signed assessment over supplied input.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Quote Freshness Guard; deterministic signed assessment over supplied input.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
reputation_update_receiptRecommend a bounded auditable reputation update from verified outcome evidence.; 0.004 USDC.1 finding
Why it is in this group
- The name "reputation_update_receipt" says "update": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "reputation_update_receipt" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "reputation_update_receipt" says "update": a word for a change.
Description, as the server wrote it Recommend a bounded auditable reputation update from verified outcome evidence.; 0.004 USDC. Deterministic, evidence-bounded and signed.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
resource_cycle_guardRequire per-step identity, token and cost counters; detect repeated nodes/edges and enforce all three hard caps; 0.002 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Require per-step identity, token and cost counters; detect repeated nodes/edges and enforce all three hard caps; 0.002 USDC.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
retention_deletion_receiptSeparate requested, operator-completed and evidence-verified retention/deletion states using content and evidence hashes; 0.003 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Separate requested, operator-completed and evidence-verified retention/deletion states using content and evidence hashes; 0.003 USDC.
rwa_asset_due_diligenceFail-closed issuer, contract, jurisdiction, custody and documentation coverage with independently fetched evidence; 0.019 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Fail-closed issuer, contract, jurisdiction, custody and documentation coverage with independently fetched evidence; 0.019 USDC.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
rwa_complianceFail-closed RWA transfer decision requiring explicit jurisdiction, KYC, allowlist, limit and transfer-window checks; 0.012 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Fail-closed RWA transfer decision requiring explicit jurisdiction, KYC, allowlist, limit and transfer-window checks; 0.012 USDC.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
rwa_corporate_actionsDetect and sign material RWA changes in NAV, income, maturity, redemption or freeze state; 0.012 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Detect and sign material RWA changes in NAV, income, maturity, redemption or freeze state; 0.012 USDC.
rwa_sanctions_screening_evidenceEvidence-based literal subject screening against observed official US/EU sanctions sources; 0.015 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Evidence-based literal subject screening against observed official US/EU sanctions sources; 0.015 USDC. Not legal clearance or wallet attribution.
rwa_transaction_assuranceVerify an RWA asset, payment, delivery and transfer restrictions; 0.020 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Verify an RWA asset, payment, delivery and transfer restrictions; 0.020 USDC.
schema_normalizeSafe alias normalization that refuses ambiguous canonical/alias collisions and never changes payment values; 0.001 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Safe alias normalization that refuses ambiguous canonical/alias collisions and never changes payment values; 0.001 USDC.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
schema_normalize_freeFree, rate-limited payload validation and safe key normalization before payment.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Free, rate-limited payload validation and safe key normalization before payment. Payment-critical values are never changed.
secret_redaction_preflightDetect and redact common secret indicators before transmission; 0.002 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Detect and redact common secret indicators before transmission; 0.002 USDC.
service_failover_selectorService Failover Selector; deterministic signed assessment over supplied input.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Service Failover Selector; deterministic signed assessment over supplied input.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
service_gap_detectorDetect capability shortages using verified demand and verified provider supply.; 0.004 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Detect capability shortages using verified demand and verified provider supply.; 0.004 USDC. Deterministic, evidence-bounded and signed.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
service_sla_attestationSign availability and latency calculations from bounded samples; 0.004 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Sign availability and latency calculations from bounded samples; 0.004 USDC.
sla_risk_predictorEstimate SLA failure probability from bounded success and latency evidence.; 0.004 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Estimate SLA failure probability from bounded success and latency evidence.; 0.004 USDC. Deterministic, evidence-bounded and signed.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
social_source_evidenceAttributable public social-source observations with identity limitations; 0.006 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Attributable public social-source observations with identity limitations; 0.006 USDC.
subscription_spend_guardBind one recurring charge to approval, merchant, due time and per-charge/period budgets; 0.003 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Bind one recurring charge to approval, merchant, due time and per-charge/period budgets; 0.003 USDC.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
sybil_reputation_guardCombine multiple bounded Sybil signals while abstaining without independent evidence.; 0.004 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Combine multiple bounded Sybil signals while abstaining without independent evidence.; 0.004 USDC. Deterministic, evidence-bounded and signed.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
task_checkpoint_evidenceTask Checkpoint Evidence; deterministic signed assessment over supplied input.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Task Checkpoint Evidence; deterministic signed assessment over supplied input.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
task_lease_guardTask Lease Guard; deterministic signed assessment over supplied input.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Task Lease Guard; deterministic signed assessment over supplied input.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
tool_call_policy_guardBind a proposed tool call to declared intent and execution policy; 0.002 USDC.No findings
Why it is in this group
- The name "tool_call_policy_guard" says "call": a word for a change.
Description, as the server wrote it Bind a proposed tool call to declared intent and execution policy; 0.002 USDC.
tool_capability_drift_monitorDetect tool capability or manifest drift; 0.002 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Detect tool capability or manifest drift; 0.002 USDC.
tool_result_schema_validatorTool Result Schema Validator; deterministic signed assessment over supplied input.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Tool Result Schema Validator; deterministic signed assessment over supplied input.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
transaction_assuranceEnd-to-end settlement, timestamp, delivery-hash and deterministic acceptance assurance; 0.015 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it End-to-end settlement, timestamp, delivery-hash and deterministic acceptance assurance; 0.015 USDC.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
transaction_recoveryFailure classification and non-repeating recovery plan with validated attempt history; 0.010 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Failure classification and non-repeating recovery plan with validated attempt history; 0.010 USDC.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
transaction_recovery_v2Recommend bounded recovery and reconcile ambiguous payments before retry.; 0.005 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Recommend bounded recovery and reconcile ambiguous payments before retry.; 0.005 USDC. Deterministic, evidence-bounded and signed.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
transaction_risk_scoreEstimate evidence-supported loss probability without selling insurance or assuming liability.; 0.004 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Estimate evidence-supported loss probability without selling insurance or assuming liability.; 0.004 USDC. Deterministic, evidence-bounded and signed.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
trust_anomaly_detectorDetect material drift between comparable trust vectors without asserting misconduct.; 0.003 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Detect material drift between comparable trust vectors without asserting misconduct.; 0.003 USDC. Deterministic, evidence-bounded and signed.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
try_serviceFree representative preview, exact price and upgrade instructions for any PHION paid service; no wallet required.1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Findings
- Info
The input schema at properties.service.enum[79] mentions "credential".
What this check looks forMatched text
inputSchema.properties.service.enum[79]: "delegated-credential-guard"
Description, as the server wrote it Free representative preview, exact price and upgrade instructions for any PHION paid service; no wallet required.
verified_news_monitorLiteral query evidence across bounded public news sources; 0.006 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Literal query evidence across bounded public news sources; 0.006 USDC.
verified_web_extractBounded public web extraction with source, timestamp and hashes; 0.003 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Bounded public web extraction with source, timestamp and hashes; 0.003 USDC.
verifyFree verification of a PHION signed receipt.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Free verification of a PHION signed receipt.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
webhook_verifierFail-closed RFC 9421-style webhook preflight requiring trusted key, algorithm, nonce, freshness, replay status and signature coverage of method, target and content; 0.003 USDC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Fail-closed RFC 9421-style webhook preflight requiring trusted key, algorithm, nonce, freshness, replay status and signature coverage of method, target and content; 0.003 USDC.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
x402_v2_routerSelect an exactly compatible x402 v2 payment requirement without receiving private keys.; 0.003 USDC.1 finding
Why it is in this group
- The description's first verb is "select": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "x402_v2_router" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "select": a word for a change.
Description, as the server wrote it Select an exactly compatible x402 v2 payment requirement without receiving private keys.; 0.003 USDC. Deterministic, evidence-bounded and signed.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
Only reads 20Claude Code: allow
conflict_resolutionResolve or abstain; every candidate must bind source, value hash, observation time and bounded confidence; 0.003 USDC.No findings
Why it is in this group
- The description's first verb is "resolve": a word for reading.
Description, as the server wrote it Resolve or abstain; every candidate must bind source, value hash, observation time and bounded confidence; 0.003 USDC.
data_egress_preflightInspect outbound agent data and destination before transmission; 0.002 USDC.No findings
Why it is in this group
- The description's first verb is "inspect": a word for reading.
Description, as the server wrote it Inspect outbound agent data and destination before transmission; 0.002 USDC.
fetch_evidenceIndependently fetch bounded public evidence with redirect/DNS/connected-address SSRF checks, hashes and injection screening; 0.004 USDC.No findings
Why it is in this group
- The name "fetch_evidence" says "fetch": a word for reading.
Description, as the server wrote it Independently fetch bounded public evidence with redirect/DNS/connected-address SSRF checks, hashes and injection screening; 0.004 USDC.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
inspect_agentPre-payment agent inspection across x402, A2A, ERC-8004, OpenAPI and MCP; failed inspections are not charged; 0.009 USDC.No findings
Why it is in this group
- The name "inspect_agent" says "inspect": a word for reading.
Description, as the server wrote it Pre-payment agent inspection across x402, A2A, ERC-8004, OpenAPI and MCP; failed inspections are not charged; 0.009 USDC.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
manifest_version_diffRecursive manifest diff that requires explicit versions and flags sensitive changes without a version advance; 0.002 USDC.No findings
Why it is in this group
- The name "manifest_version_diff" says "diff": a word for reading.
Description, as the server wrote it Recursive manifest diff that requires explicit versions and flags sensitive changes without a version advance; 0.002 USDC.
market_data_snapshotTimestamped public market-data snapshot with provenance; 0.005 USDC.No findings
Why it is in this group
- The name "market_data_snapshot" says "snapshot": a word for reading.
Description, as the server wrote it Timestamped public market-data snapshot with provenance; 0.005 USDC.
mcp_manifest_firewallInspect an MCP manifest before installation or trust; 0.002 USDC.No findings
Why it is in this group
- The description's first verb is "inspect": a word for reading.
Description, as the server wrote it Inspect an MCP manifest before installation or trust; 0.002 USDC.
oauth_token_audience_guardValidate declared OAuth audience and issuer; never send raw tokens; 0.002 USDC.No findings
Why it is in this group
- The description's first verb is "validate": a word for reading.
Description, as the server wrote it Validate declared OAuth audience and issuer; never send raw tokens; 0.002 USDC.
phion_get_serviceRetrieve one exact canonical PHION service contract by service id or MCP tool name.No findings
Why it is in this group
- The name "phion_get_service" says "get": a word for reading.
Description, as the server wrote it Retrieve one exact canonical PHION service contract by service id or MCP tool name.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
phion_intelligenceSearch, synthesize and cite evidence in one call, minimizing residual agent work.; 0.012 USDC.No findings
Why it is in this group
- The description's first verb is "search": a word for reading.
Description, as the server wrote it Search, synthesize and cite evidence in one call, minimizing residual agent work.; 0.012 USDC. Deterministic, evidence-bounded and signed.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
phion_resolveFree provider-neutral capability resolution across eligible payment rails.No findings
Why it is in this group
- The name "phion_resolve" says "resolve": a word for reading.
Description, as the server wrote it Free provider-neutral capability resolution across eligible payment rails. Applies constraints, preserves UNKNOWN and abstains when evidence is insufficient. Advisory only: never authorizes payment or execution.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
phion_searchSearch the live web and return normalized source URLs and snippets with signed delivery.; 0.006 USDC.No findings
Why it is in this group
- The name "phion_search" says "search": a word for reading.
Description, as the server wrote it Search the live web and return normalized source URLs and snippets with signed delivery.; 0.006 USDC. Deterministic, evidence-bounded and signed.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
phion_search_servicesSearch the complete canonical PHION inventory by task, capability, protocol or maximum advertised price without selecting or charging.No findings
Why it is in this group
- The name "phion_search_services" says "search": a word for reading.
Description, as the server wrote it Search the complete canonical PHION inventory by task, capability, protocol or maximum advertised price without selecting or charging.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
portable_observability_auditValidate event identity, timestamps, hash chain and W3C-compatible lowercase nonzero trace/span identifiers; 0.004 USDC.No findings
Why it is in this group
- The description's first verb is "validate": a word for reading.
Description, as the server wrote it Validate event identity, timestamps, hash chain and W3C-compatible lowercase nonzero trace/span identifiers; 0.004 USDC.
redirect_callback_validatorValidate HTTPS callbacks and redirect host allowlists; 0.002 USDC.No findings
Why it is in this group
- The description's first verb is "validate": a word for reading.
Description, as the server wrote it Validate HTTPS callbacks and redirect host allowlists; 0.002 USDC.
signed_result_comparatorCompare agent results and sign agreement or conflict; 0.003 USDC.No findings
Why it is in this group
- The description's first verb is "compare": a word for reading.
Description, as the server wrote it Compare agent results and sign agreement or conflict; 0.003 USDC.
source_backed_searchLiteral search over supplied public sources with citations and hashes; 0.004 USDC.No findings
Why it is in this group
- The name "source_backed_search" says "search": a word for reading.
Description, as the server wrote it Literal search over supplied public sources with citations and hashes; 0.004 USDC.
tool_output_firewallInspect untrusted MCP/tool output before it enters agent context or triggers an action; 0.002 USDC.No findings
Why it is in this group
- The description's first verb is "inspect": a word for reading.
Description, as the server wrote it Inspect untrusted MCP/tool output before it enters agent context or triggers an action; 0.002 USDC.
x402_quote_comparatorValidate x402 v2 fields and compare only quotes sharing asset and decimals; 0.002 USDC.No findings
Why it is in this group
- The description's first verb is "validate": a word for reading.
Description, as the server wrote it Validate x402 v2 fields and compare only quotes sharing asset and decimals; 0.002 USDC.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Install
Pinned to version 1.57.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http evidence-engine https://phion.systems/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__evidence-engine__phion_search_services",
"mcp__evidence-engine__phion_get_service",
"mcp__evidence-engine__phion_resolve",
"mcp__evidence-engine__fetch_evidence",
"mcp__evidence-engine__inspect_agent",
"mcp__evidence-engine__tool_output_firewall",
"mcp__evidence-engine__mcp_manifest_firewall",
"mcp__evidence-engine__data_egress_preflight",
"mcp__evidence-engine__oauth_token_audience_guard",
"mcp__evidence-engine__redirect_callback_validator",
"mcp__evidence-engine__signed_result_comparator",
"mcp__evidence-engine__x402_quote_comparator",
"mcp__evidence-engine__manifest_version_diff",
"mcp__evidence-engine__conflict_resolution",
"mcp__evidence-engine__portable_observability_audit",
"mcp__evidence-engine__rwa_nav_reserve",
"mcp__evidence-engine__market_data_snapshot",
"mcp__evidence-engine__source_backed_search",
"mcp__evidence-engine__phion_search",
"mcp__evidence-engine__phion_intelligence"
],
"ask": [
"mcp__evidence-engine__phion_discover",
"mcp__evidence-engine__phion_preflight",
"mcp__evidence-engine__phion_execute",
"mcp__evidence-engine__index_feed",
"mcp__evidence-engine__preflight",
"mcp__evidence-engine__try_service",
"mcp__evidence-engine__schema_normalize_free",
"mcp__evidence-engine__payment_diagnose",
"mcp__evidence-engine__payment_capability_preflight",
"mcp__evidence-engine__verify",
"mcp__evidence-engine__attest",
"mcp__evidence-engine__payment_preflight",
"mcp__evidence-engine__mandate_reserve",
"mcp__evidence-engine__journey_verify",
"mcp__evidence-engine__transaction_assurance",
"mcp__evidence-engine__transaction_recovery",
"mcp__evidence-engine__schema_normalize",
"mcp__evidence-engine__agent_reputation_evidence",
"mcp__evidence-engine__counterparty_risk_preflight",
"mcp__evidence-engine__delegation_scope_guard",
"mcp__evidence-engine__memory_write_guard",
"mcp__evidence-engine__tool_call_policy_guard",
"mcp__evidence-engine__agent_budget_guard",
"mcp__evidence-engine__idempotency_replay_guard",
"mcp__evidence-engine__human_approval_policy",
"mcp__evidence-engine__secret_redaction_preflight",
"mcp__evidence-engine__tool_capability_drift_monitor",
"mcp__evidence-engine__mcp_server_identity_evidence",
"mcp__evidence-engine__agent_task_handoff_receipt",
"mcp__evidence-engine__context_provenance_labeler",
"mcp__evidence-engine__service_sla_attestation",
"mcp__evidence-engine__payment_route_selector",
"mcp__evidence-engine__payment_receipt_reconciler",
"mcp__evidence-engine__duplicate_charge_detector",
"mcp__evidence-engine__subscription_spend_guard",
"mcp__evidence-engine__webhook_verifier",
"mcp__evidence-engine__delivery_evidence",
"mcp__evidence-engine__inter_agent_policy_evaluator",
"mcp__evidence-engine__concurrency_guard",
"mcp__evidence-engine__resource_cycle_guard",
"mcp__evidence-engine__abandoned_tool_detector",
"mcp__evidence-engine__dependency_provenance_assessment",
"mcp__evidence-engine__data_freshness_certificate",
"mcp__evidence-engine__domain_ownership_evidence",
"mcp__evidence-engine__purpose_bound_consent",
"mcp__evidence-engine__retention_deletion_receipt",
"mcp__evidence-engine__interrupted_task_recovery",
"mcp__evidence-engine__rwa_asset_due_diligence",
"mcp__evidence-engine__rwa_compliance",
"mcp__evidence-engine__rwa_transaction_assurance",
"mcp__evidence-engine__rwa_corporate_actions",
"mcp__evidence-engine__rwa_sanctions_screening_evidence",
"mcp__evidence-engine__verified_web_extract",
"mcp__evidence-engine__entity_enrichment_evidence",
"mcp__evidence-engine__social_source_evidence",
"mcp__evidence-engine__onchain_evidence",
"mcp__evidence-engine__verified_news_monitor",
"mcp__evidence-engine__multi_source_fact_bundle",
"mcp__evidence-engine__document_to_verified_json",
"mcp__evidence-engine__live_data_freshness",
"mcp__evidence-engine__person_enrichment_evidence",
"mcp__evidence-engine__company_enrichment_evidence",
"mcp__evidence-engine__contact_enrichment_evidence",
"mcp__evidence-engine__mcp_2026_compatibility_gateway",
"mcp__evidence-engine__durable_agent_task",
"mcp__evidence-engine__task_checkpoint_evidence",
"mcp__evidence-engine__agent_approval_relay",
"mcp__evidence-engine__capability_negotiation_preflight",
"mcp__evidence-engine__mcp_catalog_cache_guard",
"mcp__evidence-engine__oauth_issuer_binding_evidence",
"mcp__evidence-engine__mcp_a2a_task_bridge",
"mcp__evidence-engine__quote_freshness_guard",
"mcp__evidence-engine__delegated_credential_guard",
"mcp__evidence-engine__agent_session_continuity",
"mcp__evidence-engine__task_lease_guard",
"mcp__evidence-engine__tool_result_schema_validator",
"mcp__evidence-engine__agent_memory_provenance",
"mcp__evidence-engine__payment_delivery_atomicity",
"mcp__evidence-engine__service_failover_selector",
"mcp__evidence-engine__agent_rate_limit_negotiator",
"mcp__evidence-engine__execution_cost_estimator",
"mcp__evidence-engine__cross_agent_receipt_bundle",
"mcp__evidence-engine__capability_verification",
"mcp__evidence-engine__capability_benchmark",
"mcp__evidence-engine__sybil_reputation_guard",
"mcp__evidence-engine__agent_behavior_fingerprint",
"mcp__evidence-engine__trust_anomaly_detector",
"mcp__evidence-engine__economic_loop_detector",
"mcp__evidence-engine__provider_quality_predictor",
"mcp__evidence-engine__transaction_risk_score",
"mcp__evidence-engine__payment_optimizer",
"mcp__evidence-engine__x402_v2_router",
"mcp__evidence-engine__erc8004_identity_evidence",
"mcp__evidence-engine__erc8004_reputation_intelligence",
"mcp__evidence-engine__delegated_spend_policy",
"mcp__evidence-engine__ap2_mandate_bridge",
"mcp__evidence-engine__a2a_transaction_bridge",
"mcp__evidence-engine__mcp_transaction_gateway",
"mcp__evidence-engine__proof_of_service",
"mcp__evidence-engine__automated_dispute_bundle",
"mcp__evidence-engine__transaction_recovery_v2",
"mcp__evidence-engine__reputation_update_receipt",
"mcp__evidence-engine__agent_economic_graph",
"mcp__evidence-engine__market_demand_predictor",
"mcp__evidence-engine__service_gap_detector",
"mcp__evidence-engine__price_discovery_engine",
"mcp__evidence-engine__sla_risk_predictor",
"mcp__evidence-engine__dynamic_service_pricing",
"mcp__evidence-engine__autonomous_procurement",
"mcp__evidence-engine__multi_agent_escrow",
"mcp__evidence-engine__cross_protocol_receipt",
"mcp__evidence-engine__phion_inference",
"mcp__evidence-engine__phion_enrich_basic",
"mcp__evidence-engine__phion_enrich"
],
"deny": [
"mcp__evidence-engine__task_cancel_assurance"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as evidence-engine. Review it before you use it.