Agent Trust Firewall

Evaluate a proposed action against evidence, source allowlists, data constraints and payment limits, returning ALLOW/BLOCK with reason codes. All enabled checks must pass: evidence cannot override an over-budget payment. Set action.type to payment to activate spending checks and pass its amount with remaining_budget; contract applies to data, not action. Use this gate before execution, trust_check_spend for budget alone, or trust_validate_data for structure alone. Enforce BLOCK and fail closed on errors. Source labels are unauthenticated; instruction scanning is a limited phrase heuristic. No action execution, wallet access, policy storage or decision history. Free, unauthenticated, stateless pilot: rules apply only to this call. Usage metadata is recorded; request bodies are not stored.

{
  "type": "object",
  "properties": {
    "action": {
      "type": "object",
      "description": "Proposed action; payment additionally requires amount and remaining_budget.",
      "properties": {
        "type": {
          "type": "string",
          "description": "Exact action type. Use payment to enable spend checks; every other non-empty value uses the non-payment checks.",
          "minLength": 1
        },
        "amount": {
          "type": "number",
          "minimum": 0,
          "description": "Proposed non-negative amount. Use the same currency/unit as both limits."
        },
        "merchant": {
          "type": "string",
          "description": "Merchant identifier; required when allowed_merchants is supplied."
        }
      },
      "required": [
        "type"
      ],
      "additionalProperties": true
    },
    "data": {
      "type": "object",
      "description": "JSON object to inspect; do not submit secrets or personal data.",
      "additionalProperties": true
    },
    "contract": {
      "type": "object",
      "description": "Map of dot-separated field paths to constraints, e.g. {\"order.total\":{\"type\":\"number\",\"min\":0,\"required\":true}}. Inline rules apply only to this request.",
      "additionalProperties": {
        "type": "object",
        "description": "A field constraint. Optional missing values are skipped; required rejects missing, null and empty string.",
        "properties": {
          "type": {
            "type": "string",
            "enum": [
              "string",
              "number",
              "integer",
              "boolean",
              "array",
              "object"
            ],
            "description": "Expected JSON type; no coercion is performed."
          },
          "required": {
            "type": "boolean",
            "description": "Require a non-null, non-empty value.",
            "default": false
          },
          "min": {
            "type": "number",
            "description": "Inclusive lower bound, applied only to numeric values."
          },
          "max": {
            "type": "number",
            "description": "Inclusive upper bound, applied only to numeric values."
          },
          "enum": {
            "type": "array",
            "items": {
              "type": [
                "string",
                "number",
                "boolean",
                "null"
              ]
            },
            "description": "Allowed primitive values, compared without coercion."
          }
        },
        "required": [],
        "additionalProperties": false
      }
    },
    "allow_extra": {
      "type": "boolean",
      "description": "With a contract, false rejects top-level data keys not present in the contract. For nested dot paths keep true and enumerate leaf constraints.",
      "default": true
    },
    "evidence": {
      "type": "array",
      "description": "Caller-supplied evidence labels. Presence is required by default; content and authenticity are not verified.",
      "items": {
        "type": "object",
        "description": "Evidence label; extra metadata is ignored.",
        "properties": {
          "source": {
            "type": "string",
            "description": "Exact source identifier to match against trusted_sources."
          }
        },
        "required": [
          "source"
        ],
        "additionalProperties": true
      }
    },
    "trusted_sources": {
      "type": "array",
      "description": "Optional exact source allowlist. Every evidence source must be listed.",
      "items": {
        "type": "string"
      }
    },
    "require_evidence": {
      "type": "boolean",
      "description": "Require at least one evidence item. Setting false intentionally skips the presence check.",
      "default": true
    },
    "detect_instructions": {
      "type": "boolean",
      "description": "Scan JSON-serialized data for a small fixed phrase heuristic, with possible false positives and negatives.",
      "default": true
    },
    "remaining_budget": {
      "type": "number",
      "minimum": 0,
      "description": "Caller-supplied remaining budget; never read from a wallet or persisted by this service."
    },
    "per_transaction_limit": {
      "type": "number",
      "minimum": 0,
      "description": "Optional inclusive maximum amount per transaction."
    },
    "allowed_merchants": {
      "type": "array",
      "description": "Optional exact, case-sensitive merchant allowlist. An empty list blocks every merchant.",
      "items": {
        "type": "string"
      }
    }
  },
  "required": [
    "action"
  ],
  "description": "Action plus the inline policy to evaluate. Nothing is executed.",
  "additionalProperties": false
}

{
  "type": "object",
  "properties": {
    "ok": {
      "type": "boolean",
      "const": true,
      "description": "The operation completed; does not imply the verdict is ALLOW."
    },
    "service": {
      "type": "string",
      "description": "Service that evaluated the request."
    },
    "version": {
      "type": "string",
      "description": "Deployed implementation version."
    },
    "verdict": {
      "type": "string",
      "enum": [
        "ALLOW",
        "BLOCK"
      ],
      "description": "Advisory verdict. The integrator must prevent execution on BLOCK or any error."
    },
    "reasons": {
      "type": "array",
      "description": "All failed checks; empty when ALLOW.",
      "items": {
        "type": "object",
        "description": "A deterministic finding; codes identify the violated check.",
        "properties": {
          "code": {
            "type": "string",
            "description": "Machine-readable reason code."
          },
          "field": {
            "type": "string",
            "description": "Affected field path, when applicable."
          },
          "expected": {
            "type": "string",
            "description": "Expected type, when applicable."
          },
          "message": {
            "type": "string",
            "description": "Explanation, when applicable."
          },
          "note": {
            "type": "string",
            "description": "Qualification, when applicable."
          },
          "row": {
            "type": "integer",
            "minimum": 0,
            "description": "Zero-based input row index, when applicable."
          }
        },
        "required": [
          "code"
        ],
        "additionalProperties": false
      }
    },
    "checks": {
      "type": "array",
      "description": "Names of the check families supported by this gate; optional checks run only when their inputs are present.",
      "items": {
        "type": "string"
      }
    },
    "warning": {
      "type": "string",
      "description": "Security and enforcement limitations."
    }
  },
  "required": [
    "ok",
    "service",
    "version",
    "verdict",
    "reasons",
    "checks",
    "warning"
  ],
  "description": "Structured result, also serialized in the text content block.",
  "additionalProperties": false
}

Compare a proposed spend with a remaining budget, transaction ceiling and merchant allowlist, returning ALLOW/BLOCK with reasons. Budget and ceiling are independent: amount=4, remaining_budget=10, per_transaction_limit=3 returns BLOCK; equality passes. Use one currency/unit, and update remaining_budget in your application after each actual purchase: this tool neither tracks cumulative spending nor converts currencies. Omitting allowed_merchants skips merchant checks; supplying it requires an exact merchant match, and [] blocks all merchants. Use trust_check_action to include evidence or data checks. Enforce BLOCK before paying; this tool never accesses a wallet or executes payment. Free, unauthenticated, stateless pilot: rules apply only to this call. Usage metadata is recorded; request bodies are not stored.

{
  "type": "object",
  "properties": {
    "amount": {
      "type": "number",
      "minimum": 0,
      "description": "Proposed non-negative amount. Use the same currency/unit as both limits."
    },
    "remaining_budget": {
      "type": "number",
      "minimum": 0,
      "description": "Caller-supplied remaining budget; never read from a wallet or persisted by this service."
    },
    "per_transaction_limit": {
      "type": "number",
      "minimum": 0,
      "description": "Optional inclusive maximum amount per transaction."
    },
    "merchant": {
      "type": "string",
      "description": "Merchant identifier; required when allowed_merchants is supplied."
    },
    "allowed_merchants": {
      "type": "array",
      "description": "Optional exact, case-sensitive merchant allowlist. An empty list blocks every merchant.",
      "items": {
        "type": "string"
      }
    }
  },
  "required": [
    "amount",
    "remaining_budget"
  ],
  "description": "One proposed spend and its numeric constraints.",
  "additionalProperties": false
}

{
  "type": "object",
  "properties": {
    "ok": {
      "type": "boolean",
      "const": true,
      "description": "The operation completed; does not imply the verdict is ALLOW."
    },
    "service": {
      "type": "string",
      "description": "Service that evaluated the request."
    },
    "version": {
      "type": "string",
      "description": "Deployed implementation version."
    },
    "verdict": {
      "type": "string",
      "enum": [
        "ALLOW",
        "BLOCK"
      ],
      "description": "Advisory verdict. The integrator must prevent execution on BLOCK or any error."
    },
    "reasons": {
      "type": "array",
      "description": "All failed checks; empty when ALLOW.",
      "items": {
        "type": "object",
        "description": "A deterministic finding; codes identify the violated check.",
        "properties": {
          "code": {
            "type": "string",
            "description": "Machine-readable reason code."
          },
          "field": {
            "type": "string",
            "description": "Affected field path, when applicable."
          },
          "expected": {
            "type": "string",
            "description": "Expected type, when applicable."
          },
          "message": {
            "type": "string",
            "description": "Explanation, when applicable."
          },
          "note": {
            "type": "string",
            "description": "Qualification, when applicable."
          },
          "row": {
            "type": "integer",
            "minimum": 0,
            "description": "Zero-based input row index, when applicable."
          }
        },
        "required": [
          "code"
        ],
        "additionalProperties": false
      }
    },
    "warning": {
      "type": "string",
      "description": "Advisory-only payment limitation."
    }
  },
  "required": [
    "ok",
    "service",
    "version",
    "verdict",
    "reasons",
    "warning"
  ],
  "description": "Structured result, also serialized in the text content block.",
  "additionalProperties": false
}

Validate JSON field presence, exact types, primitive enums and inclusive numeric bounds, returning ALLOW/BLOCK, field reasons and checked_fields. Combine required:true, type:"integer" and min:1 for a positive mandatory quantity: min alone neither requires a value nor rejects numeric strings. Missing, null or empty optional values skip the other constraints; 0 and false do not. For nested data, fields["order.total"] addresses a leaf; allow_extra:false compares top-level keys, so keep it true for dot-path rules. Use trust_clean_data for transformations or trust_check_action for evidence/spending checks. This validates structure, not facts or provenance. Free, unauthenticated, stateless pilot: rules apply only to this call. Usage metadata is recorded; request bodies are not stored.

{
  "type": "object",
  "properties": {
    "data": {
      "type": "object",
      "description": "JSON object to inspect; do not submit secrets or personal data.",
      "additionalProperties": true
    },
    "fields": {
      "type": "object",
      "description": "Map of dot-separated field paths to constraints, e.g. {\"order.total\":{\"type\":\"number\",\"min\":0,\"required\":true}}. Inline rules apply only to this request.",
      "additionalProperties": {
        "type": "object",
        "description": "A field constraint. Optional missing values are skipped; required rejects missing, null and empty string.",
        "properties": {
          "type": {
            "type": "string",
            "enum": [
              "string",
              "number",
              "integer",
              "boolean",
              "array",
              "object"
            ],
            "description": "Expected JSON type; no coercion is performed."
          },
          "required": {
            "type": "boolean",
            "description": "Require a non-null, non-empty value.",
            "default": false
          },
          "min": {
            "type": "number",
            "description": "Inclusive lower bound, applied only to numeric values."
          },
          "max": {
            "type": "number",
            "description": "Inclusive upper bound, applied only to numeric values."
          },
          "enum": {
            "type": "array",
            "items": {
              "type": [
                "string",
                "number",
                "boolean",
                "null"
              ]
            },
            "description": "Allowed primitive values, compared without coercion."
          }
        },
        "required": [],
        "additionalProperties": false
      }
    },
    "allow_extra": {
      "type": "boolean",
      "description": "False rejects top-level keys absent from fields. With nested dot paths use true; this flag is not a recursive additional-properties check.",
      "default": true
    }
  },
  "required": [
    "data",
    "fields"
  ],
  "description": "Object and field rules to validate.",
  "additionalProperties": false
}

{
  "type": "object",
  "properties": {
    "ok": {
      "type": "boolean",
      "const": true,
      "description": "The operation completed; does not imply the verdict is ALLOW."
    },
    "service": {
      "type": "string",
      "description": "Service that evaluated the request."
    },
    "version": {
      "type": "string",
      "description": "Deployed implementation version."
    },
    "verdict": {
      "type": "string",
      "enum": [
        "ALLOW",
        "BLOCK"
      ],
      "description": "Advisory verdict. The integrator must prevent execution on BLOCK or any error."
    },
    "reasons": {
      "type": "array",
      "description": "All failed checks; empty when ALLOW.",
      "items": {
        "type": "object",
        "description": "A deterministic finding; codes identify the violated check.",
        "properties": {
          "code": {
            "type": "string",
            "description": "Machine-readable reason code."
          },
          "field": {
            "type": "string",
            "description": "Affected field path, when applicable."
          },
          "expected": {
            "type": "string",
            "description": "Expected type, when applicable."
          },
          "message": {
            "type": "string",
            "description": "Explanation, when applicable."
          },
          "note": {
            "type": "string",
            "description": "Qualification, when applicable."
          },
          "row": {
            "type": "integer",
            "minimum": 0,
            "description": "Zero-based input row index, when applicable."
          }
        },
        "required": [
          "code"
        ],
        "additionalProperties": false
      }
    },
    "checked_fields": {
      "type": "integer",
      "minimum": 0,
      "description": "Number of field rules evaluated."
    }
  },
  "required": [
    "ok",
    "service",
    "version",
    "verdict",
    "reasons",
    "checked_fields"
  ],
  "description": "Structured result, also serialized in the text content block.",
  "additionalProperties": false
}

Audit and optionally clean up to 500 JSON rows, returning cleaned_rows, original zero-based issues and counts. Processing order is trim, primary-key deduplication, then required/range checks: keys " a " and "a" collide after trimming. Duplicate removal keeps the first row and skips later-row field checks; missing keys are retained and flagged. REVIEW persists even after repair, so inspect issues before use; [] returns ALLOW. Numeric strings are not converted or range-checked; use trust_validate_data for type enforcement. Only top-level strings are trimmed; inputs are not mutated. Free, unauthenticated, stateless pilot: rules apply only to this call. Usage metadata is recorded; request bodies are not stored.

{
  "type": "object",
  "properties": {
    "rows": {
      "type": "array",
      "maxItems": 500,
      "description": "JSON object rows; at most 500. An empty array is valid.",
      "items": {
        "type": "object",
        "additionalProperties": true
      }
    },
    "primary_key": {
      "type": "string",
      "description": "Top-level key used for duplicate detection; defaults to id. Keys compare by JSON serialization, so 1 differs from \"1\".",
      "default": "id",
      "minLength": 1
    },
    "required_fields": {
      "type": "array",
      "description": "Top-level field names that must be present and non-null/non-empty. Checked after optional trimming.",
      "items": {
        "type": "string"
      }
    },
    "numeric_ranges": {
      "type": "array",
      "description": "Inclusive bounds for top-level fields that already contain numbers. Use validation for numeric type enforcement.",
      "items": {
        "type": "object",
        "description": "One numeric field range.",
        "properties": {
          "field": {
            "type": "string",
            "description": "Top-level field name."
          },
          "min": {
            "type": "number",
            "description": "Inclusive minimum."
          },
          "max": {
            "type": "number",
            "description": "Inclusive maximum."
          }
        },
        "required": [
          "field"
        ],
        "additionalProperties": false
      }
    },
    "trim_strings": {
      "type": "boolean",
      "description": "Trim leading/trailing whitespace from top-level strings; nested values are unchanged.",
      "default": false
    },
    "remove_duplicates": {
      "type": "boolean",
      "description": "Drop later rows with the same primary key; missing keys are flagged and retained. Duplicate rows are skipped before required/range checks.",
      "default": false
    }
  },
  "required": [
    "rows"
  ],
  "description": "Rows and optional deterministic cleanup settings.",
  "additionalProperties": false
}

{
  "type": "object",
  "properties": {
    "ok": {
      "type": "boolean",
      "const": true,
      "description": "The operation completed; does not imply the verdict is ALLOW."
    },
    "service": {
      "type": "string",
      "description": "Service that evaluated the request."
    },
    "version": {
      "type": "string",
      "description": "Deployed implementation version."
    },
    "verdict": {
      "type": "string",
      "enum": [
        "ALLOW",
        "REVIEW",
        "BLOCK"
      ],
      "description": "ALLOW: no findings. REVIEW: inspect issues, including removed duplicates. BLOCK: invalid row input."
    },
    "issues": {
      "type": "array",
      "items": {
        "type": "object",
        "description": "A deterministic finding; codes identify the violated check.",
        "properties": {
          "code": {
            "type": "string",
            "description": "Machine-readable reason code."
          },
          "field": {
            "type": "string",
            "description": "Affected field path, when applicable."
          },
          "expected": {
            "type": "string",
            "description": "Expected type, when applicable."
          },
          "message": {
            "type": "string",
            "description": "Explanation, when applicable."
          },
          "note": {
            "type": "string",
            "description": "Qualification, when applicable."
          },
          "row": {
            "type": "integer",
            "minimum": 0,
            "description": "Zero-based input row index, when applicable."
          }
        },
        "required": [
          "code"
        ],
        "additionalProperties": false
      },
      "description": "Audit findings with original zero-based row positions."
    },
    "cleaned_rows": {
      "type": "array",
      "items": {
        "type": "object",
        "additionalProperties": true
      },
      "description": "New row objects after the selected transformations."
    },
    "input_count": {
      "type": "integer",
      "minimum": 0,
      "description": "Original row count."
    },
    "output_count": {
      "type": "integer",
      "minimum": 0,
      "description": "Returned row count."
    },
    "warning": {
      "type": "string",
      "description": "Deterministic cleanup limitations."
    }
  },
  "required": [
    "ok",
    "service",
    "version",
    "verdict",
    "issues",
    "cleaned_rows",
    "input_count",
    "output_count",
    "warning"
  ],
  "description": "Structured result, also serialized in the text content block.",
  "additionalProperties": false
}

Discover the deployed version, request/row limits, tool names, legacy call aliases and check-clean-recheck workflow before integrating. Pass {}: this inventory endpoint accepts no action, policy or filter arguments; use tools/list for callable schemas and trust_check_action for a verdict. The response explains enforcement and limitations, not stored policy or decision history: rules must accompany each check. Free and unauthenticated, with operational usage metadata recorded but no request-body storage. Re-read after a deployment to detect capability changes.

{
  "type": "object",
  "properties": {},
  "required": [],
  "description": "No arguments.",
  "additionalProperties": false
}

{
  "type": "object",
  "properties": {
    "ok": {
      "type": "boolean",
      "const": true,
      "description": "The operation completed; does not imply the verdict is ALLOW."
    },
    "service": {
      "type": "string",
      "description": "Service that evaluated the request."
    },
    "version": {
      "type": "string",
      "description": "Deployed implementation version."
    },
    "mode": {
      "type": "string",
      "const": "free-pilot",
      "description": "Current access mode."
    },
    "authentication": {
      "type": "string",
      "const": "none",
      "description": "No credentials required."
    },
    "payments_enabled": {
      "type": "boolean",
      "const": false,
      "description": "No billing or payment execution."
    },
    "policy_mode": {
      "type": "string",
      "const": "stateless-inline",
      "description": "Supply rules with each call."
    },
    "limits": {
      "type": "object",
      "description": "Request limits.",
      "properties": {
        "request_body_bytes": {
          "type": "integer",
          "description": "Maximum JSON request size in UTF-8 bytes."
        },
        "clean_rows": {
          "type": "integer",
          "description": "Maximum cleaner row count."
        }
      },
      "required": [
        "request_body_bytes",
        "clean_rows"
      ],
      "additionalProperties": false
    },
    "workflow": {
      "type": "array",
      "description": "Recommended integration steps.",
      "items": {
        "type": "string"
      }
    },
    "tools": {
      "type": "array",
      "description": "Canonical tools and backward compatible call aliases.",
      "items": {
        "type": "object",
        "description": "A callable operation.",
        "properties": {
          "name": {
            "type": "string",
            "description": "Canonical MCP name."
          },
          "path": {
            "type": "string",
            "description": "REST route, if available."
          },
          "legacy_aliases": {
            "type": "array",
            "description": "Accepted but unadvertised historical MCP names.",
            "items": {
              "type": "string"
            }
          }
        },
        "required": [
          "name",
          "legacy_aliases"
        ],
        "additionalProperties": false
      }
    },
    "limitations": {
      "type": "array",
      "description": "Explicit service limitations.",
      "items": {
        "type": "string"
      }
    },
    "telemetry": {
      "type": "string",
      "description": "Operational metadata handling."
    }
  },
  "required": [
    "ok",
    "service",
    "version",
    "mode",
    "authentication",
    "payments_enabled",
    "policy_mode",
    "limits",
    "workflow",
    "tools",
    "limitations",
    "telemetry"
  ],
  "description": "Structured result, also serialized in the text content block.",
  "additionalProperties": false
}