Veriswarm Mcp

Get an agent's current trust scores, policy tier, and risk band.

Check if an agent is allowed to perform an action. Returns allow, review, or deny. Uses x-api-key auth. The agent must belong to the tenant that owns the API key.

Get your own trust scores with improvement guidance. Requires agent key auth (VERISWARM_AGENT_KEY). Not available with API key only.

Takes no parameters.

Get score history over time for an agent.

Get detailed score breakdown with contributing factors for an agent.

Get a human-readable explanation of an agent's current trust scores.

Report a generic agent behavioral event to VeriSwarm for scoring. event_type: dot-separated event type, e.g. tool.call.success agent_id: the agent performing the action (required) payload: JSON string of additional event metadata (optional)

Report a tool call event. Shorthand for tool.call.success / tool.call.failure events. agent_id is required by the event ingestion API.

Report an agent-to-agent interaction event. other_agent_id: the agent being interacted with interaction_type: type of interaction, e.g. delegate, collaborate, query outcome: outcome of the interaction, e.g. success, failure, refused agent_id: the acting agent (required)

Report a security incident or anomalous behavior for Guard review. severity: critical, high, medium, or low description: human-readable description of the incident agent_id: the agent involved (required) pattern_type: optional classification, e.g. prompt_injection, data_exfil, abuse

Scan text/tool content for security threats (injection and moderation). tool_name: name of the tool or MCP server to scan tool_config: optional JSON string with tool configuration/schema details

Check whether a tool is permitted under active Guard policies for this workspace. Requires session auth (x-account-access-token). Not available with API key only.

List Guard security findings. Optionally filter by agent_id.

Activate the kill switch for an agent, immediately blocking all trust decisions. Works with an API key that a workspace owner or admin has granted the guard.killswitch.write scope (requires server support for that scope), or with an account session (x-account-access-token). agent_id: the agent to kill-switch reason: human-readable reason for the kill switch activation

Deactivate the kill switch for an agent, restoring normal trust decision processing. Works with an API key that a workspace owner or admin has granted the guard.killswitch.write scope (requires server support for that scope), or with an account session (x-account-access-token).

Remove PII from text, replacing with safe tokens like [VS:EMAIL:a1b2c3]. Use BEFORE sending text containing personal data to an LLM. The LLM will see tokens instead of real emails, phone numbers, SSNs, etc. Tokens carry type information so the LLM knows what kind of data was there. text: the text that may contain PII agent_id: optional agent ID to associate with the tokenization session_id: optional session ID to group tokens (auto-generated if empty)

Scan text for prompt injection patterns. Returns is_injection (bool), confidence score, and matched patterns.

Get details of a PII tokenization session including all tokens created.

Revoke a PII tokenization session, deleting all stored tokens. Requires session auth (x-account-access-token). Not available with API key only.

List all active Guard policies for the workspace. Requires session auth (x-account-access-token). Not available with API key only.

Takes no parameters.

Restore original PII values from VeriSwarm tokens in text. Use AFTER the LLM has processed tokenized text and you need to write the real values back to a database, email, CRM, or other system. text: text containing VeriSwarm tokens like [VS:EMAIL:a1b2c3] session_id: the session ID from the original tokenize_pii call

Score one conversation turn for multi-turn exfiltration risk (Session Sentry). Call this once per turn — after the agent has generated its reply and before you send it to the user. Pass a stable ``session_id`` for the entire conversation and a monotonically increasing ``turn_index`` (0, 1, 2 …). The scorer accumulates canary-token egress and system-prompt extraction signals across turns with time decay. Key response fields: - ``blocked`` (bool) — if True, suppress the reply and halt the turn; the enforcement_level and block_threshold explain why. - ``session_score`` — cumulative exfiltration risk for the session (0.0–1.0). - ``turn_value`` — this turn's raw contribution before decay. - ``highest_severity`` — "none" | "low" | "medium" | "high" | "critical". - ``contributions`` — list of scored signals (type, value, weight). - ``enabled`` — False while the tenant is on the free tier (dormant); blocked will always be False in that state. session_id: stable identifier for this conversation (≤64 chars, alphanumeric / hyphens / underscores). Use the same value for every turn in the same conversation. turn_index: zero-based turn counter; must increase monotonically within a session. The scorer uses ordering to apply time decay. user_text: the user's message for this turn (optional but improves signal). agent_text: the agent's reply for this turn — primary exfil surface; always pass this. system_prompt: the system prompt active for this turn (optional; used to detect system-prompt extraction attempts in agent_text). agent_id: optional VeriSwarm agent ID (`agt_*`) to associate the scan with a registered agent's trust record. actor_id: optional caller / user identifier for audit purposes.

Issue a signed JWT Passport credential for the authenticated agent. Requires agent key auth (VERISWARM_AGENT_KEY). Not available with API key only. Also requires the platform signing key to be configured.

Takes no parameters.

Verify a Passport JWT credential and return the decoded trust claims. credential: the JWT string issued by VeriSwarm Passport

Mark an agent as identity-verified in VeriSwarm Passport (admin action). Requires session auth (x-account-access-token). Not available with API key only. agent_id: the agent to mark as verified

Check active delegation grants for an agent. Requires session auth (x-account-access-token). Not available with API key only. agent_id: the agent whose delegations to check scope: optional scope filter, e.g. read, write, admin

Query the immutable Vault audit ledger. Optionally filter by agent. agent_id: filter ledger entries to a specific agent (optional) limit: maximum number of entries to return (default 50)

Verify the hash-chain integrity of the Vault audit ledger. limit: number of recent entries to verify (default 100)

Create a Vault export job. Returns the job ID and status. export_type: format for the export — json or csv (default json)

Register a new agent in VeriSwarm and return its agent_id. slug: URL-safe unique identifier for the agent, e.g. my-coding-agent display_name: human-readable name shown in dashboards description: optional description of the agent's purpose

Get a full agent profile including current trust scores and metadata. agent_id: the agent's unique identifier

Get an agent's event timeline. agent_id: the agent's unique identifier limit: maximum number of timeline entries (default 50)

Get active moderation flags for an agent. agent_id: the agent's unique identifier

List agents in the workspace. Supports search and filtering by policy tier. query: optional search string to filter agents by name or slug tier: optional policy tier filter — tier_0 (most restricted), tier_1, tier_2, tier_3 (most trusted), or all page: page number for pagination (default 1)

Check VeriSwarm platform health, uptime, and active feature flags.

Takes no parameters.

Get the current workspace's scoring profile and weight configuration. Requires session auth (x-account-access-token). Not available with API key only.

Takes no parameters.

Set the workspace's scoring profile. Requires session auth (x-account-access-token). Not available with API key only. profile_code: one of 'general', 'high_security', 'community', 'enterprise', 'minimal' weight_overrides: optional JSON string of custom weight overrides

List recent notifications for the workspace. Requires session auth (x-account-access-token). Not available with API key only.

Get the current IP allowlist configuration for the workspace. Requires session auth (x-account-access-token). Not available with API key only.

Takes no parameters.

Set the IP allowlist for the workspace. Requires session auth (x-account-access-token). Not available with API key only. cidrs: comma-separated list of CIDR ranges, e.g. '10.0.0.0/8,192.168.1.0/24' enabled: whether to enable the allowlist (default True)

Get the custom domain configuration for the workspace. Requires session auth (x-account-access-token). Not available with API key only.

Takes no parameters.

Set a custom domain for the workspace. Requires session auth (x-account-access-token). Not available with API key only. domain: the custom domain, e.g. 'trust.mycompany.com'

List team members in the current workspace. Requires session auth (x-account-access-token). Not available with API key only.

Takes no parameters.

Invite a new team member to the workspace. Requires session auth (x-account-access-token). Not available with API key only. email: the email address to invite role: 'admin' or 'member' (default 'member')

Get aggregated quality analytics for an agent. agent_id: the agent to analyze days: lookback period (1-365) Returns resolution rate, accuracy, tone, efficiency, security scores, escalation rate, cost, and grade distribution.

Get cost optimization recommendations for an agent. Analyzes conversation patterns and suggests: model downgrades, KB improvements, prompt optimization, and security reviews.

List available adversarial red team attack patterns. Returns attack counts by category: injection, PII extraction, policy boundary, off-topic, and jailbreak.

Takes no parameters.

Check if an agent has trust-gated permission to use a tool. agent_id: the agent requesting the tool tool_name: name of the tool to check (e.g., 'process_refund') Returns whether the tool is allowed based on the agent's trust score.

Compute a security grade (A-F) for a conversation. Uses Guard + Vault audit data to score PII exposure, injection resistance, policy adherence, tool authorization, and grounding.

GDPR: Delete all data associated with a contact. Requires session auth (x-account-access-token). Not available with API key only. contact_identifier: email, phone, or contact ID to purge contact_type: 'email', 'phone', or 'contact_id' dry_run: if True, shows what would be deleted without deleting Purges from PII tokens, events, and KB chunks. Generates a cryptographic deletion proof stored in Vault.

List GDPR deletion records with verification hashes. Requires session auth (x-account-access-token). Not available with API key only.

Takes no parameters.

Verify a GDPR deletion record exists and return its cryptographic proof.

Get an agent's cross-platform reputation score. Returns reputation score (0-100), platform count, positive/negative interaction counts, and per-platform breakdown.

Get agent-to-agent interaction history. agent_id: the agent to query role: 'requesting' (outbound) or 'receiving' (inbound)

Get benchmark results for an agent across versions. Returns scores, pass rates, and promote/review/block recommendations.

Get health status of all LLM providers. Returns per-provider: success rate, P95 latency, active requests, cooldown status, and consecutive failure count.

Takes no parameters.

List all Cortex Workflows for the current tenant. is_active: optional filter — true for active only, false for inactive only

Get details of a specific workflow including recent executions. workflow_id: the workflow ID (starts with wf_)

Create a new Cortex Workflow from a JSON definition. name: display name for the workflow slug: URL-safe identifier (lowercase, hyphens ok) definition: the full workflow definition as a JSON string description: optional description of what the workflow does

Manually trigger a workflow execution. workflow_id: the workflow ID to run

Get the status and step-by-step results of a workflow execution. execution_id: the execution ID (starts with wfx_)

Activate a workflow so its triggers (schedule/event/webhook) start firing. workflow_id: the workflow ID to activate

Deactivate a workflow, stopping all triggers. workflow_id: the workflow ID to deactivate

List available workflow templates (both built-in and custom).

Takes no parameters.

Deploy a workflow template as a new workflow in your workspace. template_id: the template ID (e.g., "builtin:content-pipeline-v2" or a custom template ID)

Get workflow usage statistics: execution counts, success rates, and LLM costs. days: time period in days (default 30, max 90)

Cancel a running or paused workflow execution. execution_id: the execution ID to cancel (starts with wfx_)

Retry a failed workflow execution from where it left off. execution_id: the execution ID to retry (starts with wfx_)

Get a per-tenant OWASP Agentic AI Top 10 (2026) coverage report. Returns covered/partial/gap status for each of the 10 risks, evidence counts from Guard/Vault, and an overall coverage score.

Takes no parameters.

List supported compliance frameworks (eu-ai-act, nist-ai-rmf, iso-42001).

Takes no parameters.

Get a per-tenant compliance report for a specific framework. framework_id: 'eu-ai-act' | 'nist-ai-rmf' | 'iso-42001' Returns pass/warn/fail per control with evidence counts and recommendations.

List active Cedar declarative policies for the tenant.

Takes no parameters.

Validate Cedar policy syntax without persisting. Returns {"valid": true} on success, {"valid": false, "error": "..."} on failure.

Dry-run a Cedar policy against test input. Returns the decision.

Combined SRE dashboard — circuit breakers + SLO + error budget + provider health.

Takes no parameters.

Get current state of all LLM provider circuit breakers (closed/open/half-open).

Takes no parameters.

Manually reset a circuit breaker to closed state (e.g., after fixing a provider outage).

Get error budget status based on tenant SLO targets and recent LLM usage.

Takes no parameters.

Combined context governance dashboard — topics + quality + gaps.

Detect agents with high failure rates and low knowledge base coverage.

Scan MCP tool definitions for security risks (pre-deploy audit). tools_json: JSON string of an array of MCP tool definitions Checks for tool poisoning, typosquatting, schema manipulation, rug-pull patterns, prompt injection, and excessive permissions.

Scan CI workflow YAML + Dockerfiles for secret-exfiltration risk. files_json: JSON string of an array of file objects, each {"path": str, "content"?: str, "diff"?: str}. Pass "content" (full file at head) for Layer 1 vulnerable-config checks and "diff" (unified diff hunks) for Layer 2 exfil-pattern checks. Returns findings plus a "blocked" decision from the tenant's GuardPolicy enforcement level.

Cross-model verification — route a response through multiple LLMs and check consensus. Defends against memory poisoning (OWASP ASI06). Results are logged to Vault.

Provision Ed25519 transport keys for an agent. Returns the public key. After provisioning, the agent's public key appears in agent cards under x-veriswarm-transport. Inter-agent messages can then be cryptographically signed.

Generate an Ed25519-signed provenance manifest for AI-generated content. Returns the manifest (signature, content hash, metadata). Machine-readable format compatible with EU AI Act Article 50 transparency requirements.

Public lookup of a provenance manifest by SHA-256 content hash. Use this to verify whether a piece of content was AI-generated by a VeriSwarm agent. No authentication required on the server side.

Read the tenant-defined ABAC attributes for an agent. These attributes are merged into the Cedar entity at decision time and can be referenced in custom policies as principal.<key>.

Set ABAC attributes for an agent (replaces existing). attributes_json: JSON string of the attributes dict. Values must be strings, numbers, booleans, or lists of those. Reserved keys (policy_tier, risk_score, is_verified) are silently rejected.

Request a just-in-time access grant for an agent. Trusted agents (composite_trust >= 75, risk_score <= 30, verified, ttl <= 10min) are auto-approved. Others go to pending for human review.

Revoke an approved JIT grant immediately.

List JIT grants for the tenant, optionally filtered by agent or status.

List the tenant's trust-ranked A2A agent catalog. Returns agents in descending trust-score order, excluding any agent currently in the kill-switch state. Each entry includes the agent's id, slug, current trust score, and a short description suitable for an A2A discovery flow.

Takes no parameters.

Get an A2A agent card for the given agent. The card is an A2A-compatible JSON document that includes the `x-veriswarm-trust` extension (current trust score + tier), and — when keys are provisioned — the `x-veriswarm-transport` extension carrying the agent's Ed25519 public key for inter-agent message signing. agent_id: VeriSwarm agent id (`agt_*`).

Submit a task to an agent via the A2A protocol. agent_id: the receiving agent (`agt_*`). requesting_agent_id: the calling agent's id (`agt_*`). messages_json: JSON-encoded list of message dicts (A2A message shape). signature_json: optional JSON-encoded Ed25519 signature envelope (`{"key_id": "...", "signature": "...", "algo": "ed25519"}`). Returns the new task id and accepted status, or an error if the receiving agent is killed, paused, or stopped (lifecycle-blocked).

Submit an A2A task to a (trust-ranked) agent and wait for the result. Convenience over submit_a2a_task + get_a2a_task: submits the task, then polls until it reaches a terminal state (completed / failed / canceled) or max_wait_seconds elapses, and returns the final task JSON (status, messages, artifacts). On timeout it returns the latest non-terminal task with "timed_out": true — keep polling with get_a2a_task. All trust / policy enforcement happens server-side; this tool only orchestrates submit + poll.

Get the status + result of an A2A task. agent_id: the receiving agent (`agt_*`). task_id: the task id returned by `submit_a2a_task` (`a2a_*`). Returns the task's status (submitted / running / succeeded / failed / cancelled), the response messages (when complete), and any error context.

Cancel an in-flight A2A task. agent_id: the receiving agent (`agt_*`). task_id: the task id to cancel (`a2a_*`). Returns the updated task state. No-op if the task already terminated.

Submit a new approval request to the operator queue. agent_id: optional VeriSwarm agent id (`agt_*`); omit for system-initiated reviews. requested_action_json: JSON-encoded dict describing the action being approved (free-form per-tenant schema). ttl_seconds: how long the request stays pending before expiring. Server enforces 60 ≤ ttl_seconds ≤ 30 days.

List approval requests for the authenticated tenant. state: one of "pending", "approved", "rejected", "expired", "all". agent_id: optional filter to a single agent (`agt_*`). limit: 1..500 (server-enforced).

Get a single approval request by id (`apr_*`).

Approve a pending approval request. Requires an account-session token (operator role); api-key-only callers get a 401. `reason` is captured in the audit ledger.

Reject a pending approval request. Requires an account-session token (operator role); api-key-only callers get a 401. `reason` is captured in the audit ledger.