Vortx-AI/emem

{
  "annotations": {
    "destructiveHint": false,
    "idempotentHint": true,
    "openWorldHint": false,
    "readOnlyHint": true,
    "title": "What tools exist here, and when to reach for each"
  },
  "capabilities": [
    "read"
  ],
  "input_schema": {
    "properties": {
      "bundle": {
        "description": "Filter by the job you are doing. Call with no arguments first to see each bundle and its size.",
        "enum": [
          "tokenisation",
          "verification",
          "agent_to_agent",
          "long_horizon",
          "robotics",
          "satellites",
          "agriculture",
          "forestry",
          "climate_risk"
        ],
        "type": "string"
      },
      "category": {
        "description": "Filter to one category. This is about the shape of the job, NOT about safety: 13 tools outside `write` declare `readOnlyHint: false` because reading a cold address can materialise or mint as a side effect, so `category: \"read\"` is not a safe-tools filter. Read each result's `annotations.readOnlyHint` for that.",
        "enum": [
          "read",
          "write",
          "verify",
          "introspect",
          "plan"
        ],
        "type": "string"
      },
      "name": {
        "description": "Return the full descriptor for exactly this tool (input schema, runnable example, annotations), e.g. `emem_ndvi`. Use this when you already know the name and want its schema without loading the whole catalog. It SHORT-CIRCUITS: when `name` is set every other argument here is ignored, so `{name, q}` is not a search within one tool. A name this responder does not carry is not an error status, you get a body with `did_you_mean` holding up to five names that share a substring with what you asked for.",
        "type": "string"
      },
      "q": {
        "description": "Free-text filter over tool names, titles and trigger text, e.g. `ndvi`, `cloud`, `flood`, `verify`, `token`. Plain lowercased substring over name + title + description + trigger text, not fuzzy and not stemmed: `ndvi` hits, `vegetation index` only hits tools that spell that phrase. Combines with `shape`/`bundle`/`category`/`tier` as AND, so an over-narrow combination answers with an empty catalog rather than an error.",
        "type": "string"
      },
      "shape": {
        "description": "Filter by what the answer looks like, which is usually the real question. `scalar` is one number at one address; `raster` is a gridded field over an area; `timeseries` is a value per timestep; `vector` is a learned embedding; `identity` is a canonical name for a thing; `token` is a citation handle; `proof` checks one.",
        "enum": [
          "scalar",
          "timeseries",
          "raster",
          "geometry",
          "vector",
          "identity",
          "token",
          "proof",
          "plan",
          "file",
          "catalog"
        ],
        "type": "string"
      },
      "tier": {
        "description": "Which slice to list. Defaults to `all`, so this tool shows the whole surface even when the endpoint advertises only the core loop, and an `extended` tool you find here is callable by name through tools/call whether or not your host listed it. Pass `core` to see only what a default connection advertises.",
        "enum": [
          "core",
          "extended",
          "all"
        ],
        "type": "string"
      }
    },
    "type": "object"
  },
  "risk_flags": []
}

{
  "annotations": {
    "destructiveHint": false,
    "idempotentHint": true,
    "openWorldHint": true,
    "readOnlyHint": true,
    "title": "Resolve place to cell64 + band inventory"
  },
  "capabilities": [
    "read",
    "network"
  ],
  "input_schema": {
    "properties": {
      "lat": {
        "description": "WGS-84 latitude in degrees, paired with `lng`. REQUIRED with `lng` unless `place`/`q` is provided.",
        "type": "number"
      },
      "lng": {
        "description": "WGS-84 longitude in degrees, paired with `lat`. REQUIRED with `lat` unless `place`/`q` is provided.",
        "type": "number"
      },
      "name": {
        "description": "Alias for `place`.",
        "type": "string"
      },
      "place": {
        "description": "Free-text place name (e.g. 'Mount Everest', 'Tokyo'). REQUIRED unless `lat`+`lng` is provided. Aliases also accepted: `q`, `query`, `name`.",
        "type": "string"
      },
      "q": {
        "description": "Alias for `place`, accepted because OSM/Mapbox/Google Geocoding all use `q`. Provide either this or `place` (or `lat`+`lng`).",
        "type": "string"
      },
      "query": {
        "description": "Alias for `place`.",
        "type": "string"
      }
    },
    "type": "object"
  },
  "risk_flags": [
    "arbitrary_network_egress",
    "freeform_input_surface"
  ]
}

{
  "annotations": {
    "destructiveHint": false,
    "idempotentHint": true,
    "openWorldHint": true,
    "readOnlyHint": false,
    "title": "Ask a free-text question about a place"
  },
  "capabilities": [
    "network",
    "financial"
  ],
  "input_schema": {
    "properties": {
      "cell": {
        "description": "cell64 string (alternative to `place`, use when you have one from a prior emem_locate / emem_recall response). Provide this OR `place` OR `lat`+`lng`.",
        "maxLength": 23,
        "minLength": 19,
        "pattern": "^(?:(?:[bcdfghjklmnpqrstvwxyz][aeiouAEIOU]){2}|z[0-9a-f]{4})(?:\\.(?:(?:[bcdfghjklmnpqrstvwxyz][aeiouAEIOU]){2}|z[0-9a-f]{4})){3}$",
        "type": "string"
      },
      "include": {
        "description": "Opt-in heavy response sections. Default response is slim (~5 KB): answer + algorithm key + fact_cids + caveats. Name specific sections to include them. Ignored when verbose=true (which includes everything).",
        "items": {
          "enum": [
            "band_observations",
            "algorithm_outcomes",
            "facts_full",
            "temporal_composition",
            "foundation_embeddings",
            "scene",
            "inventory"
          ],
          "type": "string"
        },
        "type": "array"
      },
      "include_image": {
        "default": false,
        "description": "Bundle a Sentinel-2 RGB scene URL for the resolved cell. Adds ~1-2 s on first call.",
        "type": "boolean"
      },
      "lat": {
        "description": "WGS-84 latitude (paired with `lng`; alternative to `place` / `cell`).",
        "type": "number"
      },
      "lng": {
        "description": "WGS-84 longitude (paired with `lat`).",
        "type": "number"
      },
      "place": {
        "description": "Free-text place name (e.g. \"Mount Fuji\", \"Ashok Nagar, Ranchi\"). REQUIRED unless `cell` or `lat`+`lng` is provided. Extract the noun phrase from the user's turn; the responder geocodes via OSM Nominatim.",
        "type": "string"
      },
      "q": {
        "description": "User's natural-language question about the place (e.g. \"is this neighbourhood flood-prone\").",
        "type": "string"
      },
      "query": {
        "description": "Alias for `q`.",
        "type": "string"
      },
      "question": {
        "description": "Alias for `q`.",
        "type": "string"
      },
      "verbose": {
        "default": false,
        "description": "When true, return the full envelope: per-algorithm formula strings, temporal_recipe blocks, per-fact band_metadata duplicates, and the long _explanation prose. Default (since 2026-05-05) is false so the response fits MCP's 25 KB cap; the signed receipt + fact CIDs + algorithm keys + algorithms_cid are always retained. Pass true to get the full body when debugging.",
        "type": "boolean"
      }
    },
    "required": [
      "q"
    ],
    "type": "object"
  },
  "risk_flags": [
    "arbitrary_network_egress",
    "financial_transaction",
    "freeform_input_surface"
  ]
}

{
  "annotations": {
    "destructiveHint": false,
    "idempotentHint": true,
    "openWorldHint": false,
    "readOnlyHint": true,
    "title": "Compose a memory_token citation handle"
  },
  "capabilities": [
    "read"
  ],
  "input_schema": {
    "properties": {
      "band": {
        "description": "Optional band key. When set, the minted citation carries the band's tamper-provenance block (class, deterministic, tamper_evidence, trust_rank) so the receiving agent sees the trust class without a resolve round-trip.",
        "type": "string"
      },
      "cell": {
        "description": "cell64, neither component may contain `:`.",
        "maxLength": 23,
        "minLength": 19,
        "pattern": "^(?:(?:[bcdfghjklmnpqrstvwxyz][aeiouAEIOU]){2}|z[0-9a-f]{4})(?:\\.(?:(?:[bcdfghjklmnpqrstvwxyz][aeiouAEIOU]){2}|z[0-9a-f]{4})){3}$",
        "type": "string"
      },
      "fact_cid": {
        "description": "52-char base32-nopad-lowercase content-id of the fact (full 32-byte blake3).",
        "type": "string"
      },
      "observed_on": {
        "description": "The fact's source capture date (YYYY-MM-DD) as `/v1/recall` reports it in `sources[].captured_at`. Supplied together with `band` it additionally mints the self-describing `descriptor_token`. A wrong date forges nothing: resolve binds the date to the signed fact and answers 409 on a mismatch.",
        "type": "string"
      }
    },
    "required": [
      "cell",
      "fact_cid"
    ],
    "type": "object"
  },
  "risk_flags": []
}

{
  "annotations": {
    "destructiveHint": false,
    "idempotentHint": true,
    "openWorldHint": false,
    "readOnlyHint": true,
    "title": "Dereference a memory_token in one round-trip"
  },
  "capabilities": [
    "read",
    "secrets"
  ],
  "input_schema": {
    "properties": {
      "token": {
        "description": "A `emem:fact:<cell64>:<fact_cid>` citation handle to dereference.",
        "type": "string"
      }
    },
    "required": [
      "token"
    ],
    "type": "object"
  },
  "risk_flags": [
    "secret_material_access",
    "freeform_input_surface"
  ]
}

{
  "annotations": {
    "destructiveHint": false,
    "idempotentHint": true,
    "openWorldHint": false,
    "readOnlyHint": true,
    "title": "Check a value against the fact it cites, before you publish it"
  },
  "capabilities": [
    "read",
    "secrets"
  ],
  "input_schema": {
    "properties": {
      "claimed_value": {
        "description": "The value you are about to publish, as a string or a number. Send it as a STRING, character for character as you will emit it. A JSON number is stringified before the comparison, so `0.50` arrives as `0.5` and `0.2411000` as `0.2411` (measured against the live responder): the trailing digits this check exists to defend are gone before it runs. Quote `value_verbatim` from resolve as a string and echo the exact characters you will publish."
      },
      "strict": {
        "description": "Require BYTE-IDENTICAL equality. Default false, which also accepts a numerically equal value spelled differently (0.50 for 0.5). It changes exactly one outcome: the numerically-equal-but-respelled case, which passes by default and becomes `drift: \"reformatted\"` here. `rounded` and `wrong` already fail either way, so `strict` never turns a pass into a pass. It is also inert when `claimed_value` came in as a JSON number, because the respelling then happened in the JSON parser, before this tool saw it.",
        "type": "boolean"
      },
      "token": {
        "description": "The citation you used. Any form resolve accepts, including a bare cid, which answers with `degraded: true`: a bare cid asserts no location, so the cell-binding check is skipped and the grade covers the value only. A cid that is not 52 characters is refused as a damaged citation rather than as a missing one, and must not be retried.",
        "type": "string"
      }
    },
    "required": [
      "token",
      "claimed_value"
    ],
    "type": "object"
  },
  "risk_flags": [
    "secret_material_access",
    "freeform_input_surface"
  ]
}

{
  "annotations": {
    "destructiveHint": false,
    "idempotentHint": false,
    "openWorldHint": true,
    "readOnlyHint": false,
    "title": "Compose a signed multi-fact memory bundle"
  },
  "capabilities": [
    "network"
  ],
  "input_schema": {
    "properties": {
      "purpose": {
        "description": "Optional human-readable purpose string. Included in the bundle_cid preimage so the same triples + different purposes produce distinct CIDs.",
        "type": "string"
      },
      "scope": {
        "description": "Multi-tenant scope `{user_id, agent_id, run_id, org_id}`, applied to EVERY triple's underlying recall so the whole bundle cites only facts written under that four-tuple.",
        "type": "object"
      },
      "triples": {
        "description": "One to 256 (cell, band, tslot?) triples to bundle. Each entry is recalled through the standard auto-materialize path; the bundle envelope cites every resulting fact_cid. 257 or more is a typed 400: the token is O(1) in size for any N, but covering N facts costs ceil(N/256) calls, so plan round trips rather than meeting the cap mid-run.",
        "items": {
          "properties": {
            "band": {
              "description": "Band key (e.g. `indices.ndvi`, `copdem30m.elevation_mean`).",
              "type": "string"
            },
            "cell": {
              "description": "cell64 string (or free-text place name; the responder resolves before bundling).",
              "type": "string"
            },
            "tslot": {
              "description": "Optional tslot pin. Omit to use the band's natural latest tslot at the cell.",
              "type": "integer"
            }
          },
          "required": [
            "cell",
            "band"
          ],
          "type": "object"
        },
        "maxItems": 256,
        "minItems": 1,
        "type": "array"
      }
    },
    "required": [
      "triples"
    ],
    "type": "object"
  },
  "risk_flags": [
    "arbitrary_network_egress"
  ]
}

{
  "annotations": {
    "destructiveHint": false,
    "idempotentHint": true,
    "openWorldHint": true,
    "readOnlyHint": false,
    "title": "Mint or get a canonical object identity"
  },
  "capabilities": [
    "network"
  ],
  "input_schema": {
    "properties": {
      "cell": {
        "description": "cell64 to anchor the object directly (no geocode).",
        "type": "string"
      },
      "external_ids": {
        "description": "Stable ids that drive convergence. Caller-supplied values win over geocoder-derived ones.",
        "properties": {
          "gers": {
            "description": "Overture GERS division id (strongest anchor).",
            "type": "string"
          },
          "osm": {
            "description": "OpenStreetMap object as <type>/<id>, e.g. way/717919508.",
            "type": "string"
          },
          "wikidata": {
            "description": "Wikidata QID.",
            "type": "string"
          }
        },
        "type": "object"
      },
      "kind": {
        "description": "Object class: bridge, river, farm_plot, building, admin_division, place, custom, ... Defaults to \"place\".",
        "type": "string"
      },
      "label": {
        "description": "Human name of the object, e.g. \"Golden Gate Bridge\", \"the north dam\". Required.",
        "type": "string"
      },
      "lat": {
        "description": "Latitude anchoring the object to a place, paired with lng. The identity is hashed from this anchor, so two agents anchoring the same object differently mint different entities.",
        "maximum": 90,
        "minimum": -90,
        "type": "number"
      },
      "lng": {
        "description": "Longitude, paired with lat.",
        "maximum": 180,
        "minimum": -180,
        "type": "number"
      },
      "parent": {
        "description": "Optional parent entity_cid (containment).",
        "type": "string"
      },
      "place": {
        "description": "Free-text place to anchor the object (geocoded). Provide place OR cell OR lat+lng.",
        "type": "string"
      }
    },
    "required": [
      "label"
    ],
    "type": "object"
  },
  "risk_flags": [
    "arbitrary_network_egress"
  ]
}

{
  "annotations": {
    "destructiveHint": false,
    "idempotentHint": true,
    "openWorldHint": false,
    "readOnlyHint": true,
    "title": "Resolve a phrase (or emem:entity: token) to a canonical object"
  },
  "capabilities": [
    "read",
    "secrets"
  ],
  "input_schema": {
    "properties": {
      "k": {
        "description": "Max candidates (default 10).",
        "type": "integer"
      },
      "label": {
        "description": "Alias for `text`.",
        "type": "string"
      },
      "near": {
        "description": "Optional place/cell to narrow to objects anchored nearby.",
        "type": "string"
      },
      "text": {
        "description": "Fuzzy phrasing to resolve to an existing canonical object (e.g. \"the damaged bridge near the river\").",
        "type": "string"
      },
      "token": {
        "description": "A `emem:entity:<entity_cid>` handle to dereference directly to its signed object (bypasses the text search).",
        "type": "string"
      }
    },
    "type": "object"
  },
  "risk_flags": [
    "secret_material_access",
    "freeform_input_surface"
  ]
}

{
  "annotations": {
    "destructiveHint": false,
    "idempotentHint": true,
    "openWorldHint": true,
    "readOnlyHint": false,
    "title": "Attest that a phrasing/id denotes an existing object"
  },
  "capabilities": [
    "network",
    "secrets"
  ],
  "input_schema": {
    "properties": {
      "alias": {
        "description": "An alternate label/phrasing that should resolve to this object.",
        "type": "string"
      },
      "entity_cid": {
        "description": "The canonical object to attach an equivalence to. Provide entity_cid OR entity_token.",
        "type": "string"
      },
      "entity_token": {
        "description": "A `emem:entity:<entity_cid>` handle for the same.",
        "type": "string"
      },
      "external_ids": {
        "description": "Stable ids to bind to this object.",
        "properties": {
          "gers": {
            "type": "string"
          },
          "osm": {
            "type": "string"
          },
          "wikidata": {
            "type": "string"
          }
        },
        "type": "object"
      }
    },
    "type": "object"
  },
  "risk_flags": [
    "arbitrary_network_egress",
    "secret_material_access"
  ]
}

{
  "annotations": {
    "destructiveHint": false,
    "idempotentHint": true,
    "openWorldHint": true,
    "readOnlyHint": false,
    "title": "Recall facts at a cell (auto-materializes on miss)"
  },
  "capabilities": [
    "write",
    "network"
  ],
  "input_schema": {
    "properties": {
      "as_of_signed_at": {
        "description": "Bi-temporal transaction-time bound. RFC 3339 string. Returns only facts whose `signed_at` \u2264 as_of_signed_at, answers `what did emem KNOW as of system-date Y`. Malformed strings are rejected with code:`invalid_signed_at_format`.",
        "format": "date-time",
        "type": "string"
      },
      "as_of_tslot": {
        "description": "Bi-temporal valid-time bound. Returns the latest fact per (cell,band) whose tslot \u2264 as_of_tslot, answers `what did this place look like AS OF date X`. Conflicts with an explicit `tslot` when as_of_tslot < tslot (rejected with code:`invalid_temporal_bound`).",
        "minimum": 0,
        "type": "integer"
      },
      "band": {
        "description": "optional single band key, convenience alias for bands:[band]. Use when you want exactly one band (e.g. 'geotessera.2020', 'modis.ndvi_mean') and would otherwise have to wrap it in an array. Both `band` and `bands` are accepted; if both are given they are merged.",
        "type": "string"
      },
      "bands": {
        "description": "optional band keys to filter, e.g. ['indices.ndvi','geotessera']",
        "items": {
          "type": "string"
        },
        "type": "array"
      },
      "cell": {
        "description": "cell64 string, e.g. 'damO.zb000.xUti.zde78'",
        "maxLength": 23,
        "minLength": 19,
        "pattern": "^(?:(?:[bcdfghjklmnpqrstvwxyz][aeiouAEIOU]){2}|z[0-9a-f]{4})(?:\\.(?:(?:[bcdfghjklmnpqrstvwxyz][aeiouAEIOU]){2}|z[0-9a-f]{4})){3}$",
        "type": "string"
      },
      "cell64": {
        "description": "Alias for `cell`.",
        "type": "string"
      },
      "deterministic": {
        "description": "Sugar over `provenance`: true keeps only facts any third party can recompute from the cited raw source (direct_sensor + deterministic_index); false keeps the rest (attested_execution + model_output + human_curated + unclassified). Composable with `provenance` (intersection).",
        "type": "boolean"
      },
      "include": {
        "description": "Opt-in response expansion. include:['provenance'] attaches each fact's tamper-provenance class, which is what `deterministic` and the `provenance` filter select ON: without it you can filter by class and never be told which class a returned fact is. include:['freshness'] attaches an advisory per-fact freshness block: a Q(\u0394t) staleness score from the band's physics decay kernel (the same one /v1/temporal_route ranks bands with), so an agent learns how stale each reading is in the call that returns it. Advisory only; it does NOT enter the receipt. include:['edges'] attaches each fact's typed temporal edges and threads their CIDs into the receipt. Absent leaves the response byte-identical to the pre-v0.0.9 recall.",
        "items": {
          "enum": [
            "freshness",
            "edges",
            "provenance"
          ],
          "type": "string"
        },
        "type": "array"
      },
      "lat": {
        "description": "Explicit latitude, an alternative to `cell`; paired with `lng`.",
        "type": "number"
      },
      "lng": {
        "description": "Explicit longitude, paired with `lat`.",
        "type": "number"
      },
      "place": {
        "description": "Free-text place name, an alternative to `cell`.",
        "type": "string"
      },
      "provenance": {
        "description": "Tamper-provenance filter: return only facts whose band's provenance class is in this list. `attested_execution` is a device reading trusted through its verified OS execution trace and platform attestation (not recomputable). Applied BEFORE the receipt is signed, so the receipt covers exactly the returned facts; `bands_already_attested_at_cell` stays unfiltered so you still see what else exists at the cell.",
        "items": {
          "enum": [
            "direct_sensor",
            "deterministic_index",
            "attested_execution",
            "model_output",
            "human_curated",
            "unclassified"
          ],
          "type": "string"
        },
        "type": "array"
      },
      "scope": {
        "description": "Optional multi-tenant scope {user_id, agent_id, run_id, org_id}. When at least one field is set, the recall is FILTERED to facts written under the same four-tuple (a recall scoped to {user_id:'u1'} sees only u1's facts, never another tenant's and never globally-written facts) AND the signed receipt binds the scope. Omit (or send {}) for the global, pre-v0.0.8 recall.",
        "properties": {
          "agent_id": {
            "type": "string"
          },
          "org_id": {
            "type": "string"
          },
          "run_id": {
            "type": "string"
          },
          "user_id": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "tslot": {
        "description": "optional time slot (band-tempo-relative integer offset from emem epoch)",
        "type": "integer"
      }
    },
    "required": [
      "cell"
    ],
    "type": "object"
  },
  "risk_flags": [
    "arbitrary_network_egress"
  ]
}

{
  "annotations": {
    "destructiveHint": false,
    "idempotentHint": true,
    "openWorldHint": true,
    "readOnlyHint": true,
    "title": "k-NN over the corpus by embedding"
  },
  "capabilities": [
    "read",
    "network"
  ],
  "input_schema": {
    "properties": {
      "as_of_signed_at": {
        "description": "Bi-temporal transaction-time bound (RFC 3339). Also applied to candidates BEFORE cosine. Same Lance-bypass note as as_of_tslot.",
        "format": "date-time",
        "type": "string"
      },
      "as_of_tslot": {
        "description": "Bi-temporal valid-time bound. Applied to candidate cells BEFORE cosine scoring, a cell with no fact whose tslot \u2264 as_of_tslot under the scoring band is dropped from the candidate pool (undecidable\u2192drop). When set, the Lance ANN fast-path is bypassed (the index has no signed_at column); brute-force k-NN runs instead so as_of is honoured truthfully.",
        "minimum": 0,
        "type": "integer"
      },
      "band": {
        "default": "geotessera",
        "description": "vector band to scan (default: 128-D Tessera foundation embedding). For mode=hamming/hamming_then_rerank you can pass either the cosine band (e.g. 'geotessera') or its binary sibling ('geotessera.bin128'), the responder picks the right one.",
        "type": "string"
      },
      "cell": {
        "description": "Alias for `key`.",
        "type": "string"
      },
      "cell64": {
        "description": "Alias for `key`.",
        "type": "string"
      },
      "filter": {
        "description": "Claim-algebra predicate evaluated against every candidate before ranking. A cell with no fact for the filter's band is DROPPED rather than treated as false, so 'places like X where NDVI > 0.5' never silently includes cells with no NDVI.",
        "type": "object"
      },
      "k": {
        "default": 10,
        "description": "How many neighbours to return.",
        "maximum": 1000,
        "minimum": 1,
        "type": "integer"
      },
      "key": {
        "description": "cell64 (look up that cell's vector) or 'inline:[x,y,...]' literal vector",
        "type": "string"
      },
      "mode": {
        "default": "cosine",
        "description": "Scoring mode. cosine = fp32 over full vector (precise, ~256 B/cell scan). hamming = sign-bit popcount over the binary sibling band (~16 B/cell, ~1000\u00d7 faster, ~65% recall@10). hamming_then_rerank = triage with Hamming on 4\u00b7k candidates then re-rank by cosine, matches cosine precision at ~16\u00d7 less work.",
        "enum": [
          "cosine",
          "hamming",
          "hamming_then_rerank"
        ],
        "type": "string"
      },
      "scope": {
        "description": "Multi-tenant scope `{user_id, agent_id, run_id, org_id}`. Setting it bypasses the ANN index entirely, because that index carries no scope column, and runs the brute-force scan instead: the tenant filter is honoured truthfully, and the call is slower.",
        "type": "object"
      }
    },
    "required": [
      "key"
    ],
    "type": "object"
  },
  "risk_flags": [
    "arbitrary_network_egress"
  ]
}

{
  "annotations": {
    "destructiveHint": false,
    "idempotentHint": true,
    "openWorldHint": false,
    "readOnlyHint": true,
    "title": "Scan for multi-attester disagreement"
  },
  "capabilities": [
    "read"
  ],
  "input_schema": {
    "properties": {
      "band": {
        "description": "Band key filter (e.g. `indices.ndvi`). Omit to include all bands.",
        "type": "string"
      },
      "cell_prefix": {
        "description": "Bytewise prefix on cell64 (e.g. `defi.zb5f9`). Omit to scan the whole corpus up to the scan cap.",
        "type": "string"
      },
      "limit": {
        "default": 100,
        "description": "Max contradictions to return.",
        "maximum": 1000,
        "minimum": 1,
        "type": "integer"
      },
      "min_severity": {
        "default": 0.1,
        "description": "Severity floor in [0, 1]. 0 = report every disagreement, 1 = only flagrant. Severity scoring is per band kind: scalar (max-min over band range), vector (1 - mean cosine), categorical (1 - mode share).",
        "maximum": 1,
        "minimum": 0,
        "type": "number"
      },
      "window_unix_s": {
        "description": "[lo, hi] inclusive Unix-seconds filter on attestations' signed_at, all disagreeing attestations must fall in the window.",
        "items": {
          "minimum": 0,
          "type": "integer"
        },
        "maxItems": 2,
        "minItems": 2,
        "type": "array"
      }
    },
    "type": "object"
  },
  "risk_flags": []
}

{
  "annotations": {
    "destructiveHint": false,
    "idempotentHint": true,
    "openWorldHint": false,
    "readOnlyHint": true,
    "title": "Server-side ed25519 receipt verifier"
  },
  "capabilities": [
    "read"
  ],
  "input_schema": {
    "properties": {
      "current_responder_epoch": {
        "description": "The responder key epoch you currently trust, from `/v1/manifests`. Produces an advisory `key_epoch_advisory` comparison against the receipt's epoch; a mismatch is reported, never rejected.",
        "type": "integer"
      },
      "facts": {
        "description": "The fact value(s) you intend to rely on. Each is content-addressed and checked for membership in the receipt's `fact_cids`, so a genuine receipt presented beside a tampered fact answers `valid:false` / `fact_mismatch`. Omit it and only the signature is checked, which a doctored fact survives.",
        "type": "array"
      },
      "pubkey_b32": {
        "description": "Optional explicit responder pubkey (base32). When omitted, uses the receipt's embedded pubkey/responder fields.",
        "type": "string"
      },
      "receipt": {
        "description": "The signed receipt envelope (as returned by any read primitive). Must carry primitive/served_at/request_id/cells/fact_cids and either `signature` byte[] + `responder_pubkey` byte[] or their b32 string forms.",
        "type": "object"
      }
    },
    "required": [
      "receipt"
    ],
    "type": "object"
  },
  "risk_flags": []
}

{
  "annotations": {
    "destructiveHint": false,
    "idempotentHint": true,
    "openWorldHint": true,
    "readOnlyHint": true,
    "title": "Check whether the citations in a draft actually verify"
  },
  "capabilities": [
    "read",
    "network"
  ],
  "input_schema": {
    "properties": {
      "agent": {
        "description": "Optional free-text label for who is asking. Advisory only, never a trust boundary.",
        "type": "string"
      },
      "claim_gating": {
        "default": false,
        "description": "Also flag measurable physical-world claims that carry NO citation (deny code CLAIM_UNGROUNDED, fix cite_observation). Off by default: it reports on the absence of a citation rather than on a failed check. The verdict names the sentence, the magnitude, and the emem band that would answer it.",
        "type": "boolean"
      },
      "messages": {
        "description": "A chat-completions-shaped transcript, read for its text. Accepted so the same body works against a self-hosted emem-guard node and against any OpenAI-shaped client. Each item is {role, content} where content is a string or an array of blocks.",
        "items": {
          "properties": {
            "content": {
              "description": "A string, or an array of {type,text} blocks."
            },
            "role": {
              "type": "string"
            }
          },
          "type": "object"
        },
        "type": "array"
      },
      "shape": {
        "default": "native",
        "description": "Which envelope YOUR payload is in, so you never have to reshape it to ask the question: send the body your own framework produced and name its shape. native reads `texts`/`messages`; `mcp` reads a JSON-RPC tools/call or tool result; `openai` reads a moderations (`input`) or chat-completions body; `cloudevent` reads a CloudEvents 1.0 structured event; `policy` reads {input}. It matters: a CloudEvent whose citation sits at data.text is invisible to the native reader, and a check that read nothing answers `allow`, so confirm `citations_found` matches what you sent. Unrecognised values fall back to native rather than erroring. This selects how the body is READ only \u2014 the verdict always comes back in this tool's declared output shape, because a tool that declares an outputSchema owes conforming structuredContent. To get the ANSWER translated into the same envelope too (an OPA `result:{allow,deny}`, an MCP CallToolResult to substitute on a deny), call POST /v1/guard/verdict?shape=\u2026 directly.",
        "enum": [
          "native",
          "mcp",
          "openai",
          "cloudevent",
          "policy"
        ],
        "type": "string"
      },
      "texts": {
        "description": "Free text to check. Any number of pieces, in any order: a draft answer, a tool result, a whole turn.",
        "items": {
          "type": "string"
        },
        "type": "array"
      }
    },
    "type": "object"
  },
  "risk_flags": [
    "arbitrary_network_egress"
  ]
}

{
  "annotations": {
    "destructiveHint": false,
    "idempotentHint": true,
    "openWorldHint": true,
    "readOnlyHint": false,
    "title": "Intent-routed planner"
  },
  "capabilities": [
    "write",
    "exec",
    "network"
  ],
  "input_schema": {
    "description": "A tagged union: `type` selects the intent and decides which OTHER fields are read. Fields belonging to a different intent are ignored, so send only the ones its row needs.",
    "properties": {
      "a": {
        "description": "is_like only: cell64 of the first place in the pair.",
        "type": "string"
      },
      "b": {
        "description": "is_like only: cell64 of the second place. The answer is a cosine similarity in [-1,1] over the two cells' embeddings.",
        "type": "string"
      },
      "band": {
        "description": "did_change only: which band to test, e.g. \"indices.ndvi\". One band per call; the answer is a delta over `window`, not a whole-cell diff.",
        "type": "string"
      },
      "cell": {
        "description": "cell64 address, e.g. \"damO.zb000.xUti.zde78\". Required by did_change and confirm. Optional for what_is_here and ask: supply it to skip geocoding, omit it and give `place` instead.",
        "type": "string"
      },
      "claim": {
        "description": "confirm only: the claim to test at `cell`, e.g. {\"band\":\"indices.ndvi\",\"op\":\"gt\",\"value\":0.4}. The answer is a verdict plus the signed facts it rests on.",
        "properties": {
          "agg": {
            "description": "How a `window` reduces: any/all quantify over the facts in it; mean/min/max compare the reduced value against `value`.",
            "enum": [
              "any",
              "all",
              "mean",
              "min",
              "max"
            ],
            "type": "string"
          },
          "band": {
            "description": "Band to test, e.g. \"indices.ndvi\".",
            "type": "string"
          },
          "op": {
            "description": "Comparison. These ten spellings and no others: `greater_than`, `>` and `gte` are all rejected. in/ni take an array `value` (member / not member). exists and absent ask only whether the band is attested here.",
            "enum": [
              "eq",
              "ne",
              "lt",
              "le",
              "gt",
              "ge",
              "in",
              "ni",
              "exists",
              "absent"
            ],
            "type": "string"
          },
          "tslot": {
            "description": "Test at one tslot. Omit for the latest. Mutually exclusive with `window`.",
            "type": "integer"
          },
          "value": {
            "description": "Right-hand side. A number for the ordering ops, an array for in/ni. REQUIRED by the parser even for exists/absent, which then ignore it \u2014 omitting it fails the whole intent with `missing field value`."
          },
          "window": {
            "description": "Test across [start, end] tslots instead of one. Requires `agg` to say how the values across the window collapse to a verdict.",
            "items": {
              "type": "integer"
            },
            "maxItems": 2,
            "minItems": 2,
            "type": "array"
          }
        },
        "required": [
          "band",
          "op",
          "value"
        ],
        "type": "object"
      },
      "description": {
        "description": "where_is: the place to resolve, e.g. \"Mount Everest\". ask: the user's question, forwarded verbatim. what_is_here: optional free text used as the question and, if `place` is absent, as the place. Ignored by the other intents.",
        "type": "string"
      },
      "filter": {
        "description": "find_like only: optional claim constraining which cells may be returned. Same object as `claim` below, same ops, same required fields.",
        "properties": {
          "agg": {
            "description": "How a `window` reduces to a single verdict.",
            "enum": [
              "any",
              "all",
              "mean",
              "min",
              "max"
            ],
            "type": "string"
          },
          "band": {
            "description": "Band the neighbour must satisfy, e.g. \"indices.ndvi\".",
            "type": "string"
          },
          "op": {
            "description": "Comparison. Symbolic only: `gt`, not `greater_than` or `>`.",
            "enum": [
              "eq",
              "ne",
              "lt",
              "le",
              "gt",
              "ge",
              "in",
              "ni",
              "exists",
              "absent"
            ],
            "type": "string"
          },
          "tslot": {
            "description": "Test at one tslot. Mutually exclusive with `window`.",
            "type": "integer"
          },
          "value": {
            "description": "Right-hand side. Required by the parser even for exists/absent, which ignore it."
          },
          "window": {
            "description": "Test across [start, end] tslots instead of one. Requires `agg`.",
            "items": {
              "type": "integer"
            },
            "maxItems": 2,
            "minItems": 2,
            "type": "array"
          }
        },
        "required": [
          "band",
          "op",
          "value"
        ],
        "type": "object"
      },
      "k": {
        "description": "find_like only: how many neighbours to return. Defaults to the primitive's own default when omitted.",
        "minimum": 1,
        "type": "integer"
      },
      "key": {
        "description": "find_like only: cell64 to search from. Neighbours are ranked by embedding cosine against this cell.",
        "type": "string"
      },
      "lat": {
        "description": "ask only: latitude, paired with `lng`, when you want to pin the location by coordinate rather than by name or cell64.",
        "maximum": 90,
        "minimum": -90,
        "type": "number"
      },
      "lng": {
        "description": "ask only: longitude, paired with `lat`.",
        "maximum": 180,
        "minimum": -180,
        "type": "number"
      },
      "place": {
        "description": "Free-text place name for what_is_here and ask when you have a name but no cell64, e.g. \"Ashok Nagar, Ranchi\". The responder geocodes it. Ignored when `cell` is present.",
        "type": "string"
      },
      "type": {
        "description": "Which question you are asking, and therefore which other fields apply. where_is: name a place, get its cell64 (needs `description`). what_is_here: summarise a location (needs `cell`, OR `place`/`description` to resolve it first). is_like: pairwise similarity (needs `a` and `b`). did_change: did one band move over a time window (needs `cell`, `band`, `window`). find_like: nearest neighbours to a known cell (needs `key`; optional `k`, `filter`). confirm: is a claim true at a cell (needs `claim` and `cell`). ask: free-text question about a place, runs locate + topic-route + recall server-side (needs `description`; optional `place`/`cell`/`lat`+`lng` to pin the location).",
        "enum": [
          "where_is",
          "what_is_here",
          "is_like",
          "did_change",
          "find_like",
          "confirm",
          "ask"
        ],
        "type": "string"
      },
      "window": {
        "description": "did_change only: exactly two tslots, [start, end], band-tempo-relative integers from the emem epoch (NOT unix seconds or a date string). Get valid tslots for a cell from emem_trajectory.",
        "items": {
          "type": "integer"
        },
        "maxItems": 2,
        "minItems": 2,
        "type": "array"
      }
    },
    "required": [
      "type"
    ],
    "type": "object"
  },
  "risk_flags": [
    "command_execution",
    "arbitrary_network_egress"
  ]
}

• For each high-risk tool (delete, exec, or network-egress capable), add a `confirm`/`dry_run` parameter or a two-step confirmation flow.
• Document the safeguard in the tool's description so clients and agents know confirmation is required before execution.
• Revalidate and confirm `action_safety_probe` reports the safeguard as detected.

• Return `Mcp-Session-Id` and `Mcp-Protocol-Version` headers consistently on streamable HTTP responses.
• Honor `DELETE` session teardown and return `404` when a deleted session is reused.
• Reject invalid protocol-version headers with `400 Bad Request`.

• Publish `/.well-known/oauth-authorization-server` from the issuer.
• Add `registration_endpoint` if DCR is supported.
• Verify issuer, authorization, token, and jwks metadata are all reachable.

• Diff the published `/.well-known/mcp/server-card.json` tool schemas against a live `tools/list` response.
• Fix parameter name mismatches, required-set mismatches, and type mismatches per tool.
• Regenerate or hand-sync the server card whenever the live tool schemas change -- treat drift as a release blocker, not a documentation nit.

• Update the server's advertised protocol version to a current MCP revision (2025-06-18 or later).
• Return the negotiated version consistently in both the `initialize` response and the `MCP-Protocol-Version` header.
• Revalidate and confirm `protocol_version_probe` reports `ok`.

• Advertise the narrowest viable scopes in OAuth metadata.
• Return `WWW-Authenticate` challenges with scope or insufficient-scope hints when additional consent is needed.
• Revalidate with both public discovery and auth-required flows.

• Serve `/.well-known/openid-configuration` with `issuer`, `jwks_uri`, `authorization_endpoint`, and `token_endpoint`.
• List supported grant types in `grant_types_supported` and scopes in `scopes_supported`.
• Revalidate and confirm the `openid_configuration` check returns `ok`.

• Persist session state keyed by `Mcp-Session-Id` so a client can reconnect after a dropped connection.
• Honor `Last-Event-ID` on GET reconnects to replay missed SSE events instead of erroring.
• Revalidate and confirm `session_resume_probe` no longer returns `warning`.