Search / io.github.projetnanocorp/mandate
protogridR0· no sign-inMCP server for mandates, delegation, policy-gated execution, credential grants, and audit.
v0.1.0 · active · repository · website · descriptor JSON · versions
{
"mcpServers": {
"mandate": {
"type": "http",
"url": "https://mandate.nanocorp.app/mcp"
}
}
}claude mcp add --transport http mandate https://mandate.nanocorp.app/mcp[mcp_servers.mandate]
url = "https://mandate.nanocorp.app/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"mandate": {
"type": "remote",
"url": "https://mandate.nanocorp.app/mcp",
"enabled": true
}
}
}{
"mcpServers": {
"mandate": {
"type": "http",
"url": "https://mandate.nanocorp.app/mcp"
}
},
"deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=mandate&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vbWFuZGF0ZS5uYW5vY29ycC5hcHAvbWNwIn0%3D"
}{
"servers": {
"mandate": {
"type": "http",
"url": "https://mandate.nanocorp.app/mcp"
}
}
}{
"mcpServers": {
"mandate": {
"httpUrl": "https://mandate.nanocorp.app/mcp"
}
}
}extensions:
"mandate":
enabled: true
name: "mandate"
type: streamable_http
uri: "https://mandate.nanocorp.app/mcp"
timeout: 300
protocol.modernnewest supported version is 2025-06-18; 2026-07-28 not supported, older versions are deprecated until 2027-07-28protocol.statelessonly applies to 2026-07-28 serversprotocol.transportstreamable HTTPprotocol.list_ttlonly applies to 2026-07-28 serversauth.prm, auth.as_metadata, auth.cimdno remote uses OAuthauth.secret_in_urlno templated URLtools.descriptionsevery tool has a descriptiontools.description_lengthdescriptions are concisetools.schemasevery tool has an object input schematools.annotationsno tool declares readOnlyHint or destructiveHint, so clients cannot tell safe calls from risky onestools.directory_hintsno tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: mandate.mint (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); mandate.authorize-action (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); broker.request-access (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); …tools.token_costabout 637 tokens to load every tooltools.api_dumptools are not a one-to-one API dumpstability.changesno tool changes in 30 daysstability.rug_pullno tool changed its meaning under the same namedeps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI packageNo tool definition changes recorded. A server's first observation is its baseline; later probes record what changes.
Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.
+repository +namespace-matches-repo +website +reachable +uptime-97% ~updated-45d-ago
Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.
| remote | auth | reachable | uptime 30d | p50 | protocol | last ok |
|---|---|---|---|---|---|---|
https://mandate.nanocorp.app/mcp streamable-http | none | yes | 97% | 896 ms | 2025-06-18 | 2026-10-20 |
broker.introspect-grant | Validates a grant token seal, reports active/revoked/expired state, and records introspection to the ledger. |
broker.register-credential | Registers an opaque vault handle/reference only; plaintext secret fields are rejected and never ledgered. |
broker.request-access | Asks the canonical Policy Engine for an ALLOW decision before issuing a short-lived HMAC-sealed grant bound to credential, mandate, agent, scope, and expiry. |
broker.revoke-grant | Revokes a broker grant by id and records the revocation to the ledger. |
broker.use | Redeems a sealed grant for the bound acting agent and executes the bound action through the Gateway and Policy Engine; does not expose plaintext secrets. |
mandate.authorize-action | Submits an action through the Gateway and canonical Policy Engine; returns ALLOW, DENY, or REQUIRE_APPROVAL with ledger proof. |
mandate.delegate | Creates a child mandate only when it is a no-escalation subset of the parent mandate. |
mandate.discover | Returns this self-describing tool manifest. |
mandate.mint | Creates an active human-granted mandate for an agent and records it to the hash-chained ledger. |
mandate.revoke | Revokes a mandate subtree and records the revocation to the hash-chained ledger. |
mandate.verify-proof | Records a proof payload hash and appends proof evidence to the hash-chained ledger. |
Schemas: list_tools.
{
"name": "io.github.projetnanocorp/mandate",
"_meta": {
"io.modelcontextprotocol.registry/publisher-provided": {
"tools": [
"mandate.discover",
"mandate.mint",
"mandate.delegate",
"mandate.authorize-action",
"mandate.verify-proof",
"mandate.revoke",
"broker.register-credential",
"broker.request-access",
"broker.use",
"broker.revoke-grant",
"broker.introspect-grant"
],
"tools_url": "https://mandate.nanocorp.app/api/v1/tools",
"capabilities": [
"mandate issuance",
"delegation with non-escalation",
"policy-gated action execution",
"tamper-evident append-only audit ledger",
"credential handle registration",
"short-lived credential grants",
"grant redemption without plaintext secret exposure",
"grant revocation",
"grant introspection"
],
"discover_url": "https://mandate.nanocorp.app/api/v1/discover",
"tool_call_url": "https://mandate.nanocorp.app/api/v1/tools/call",
"well_known_url": "https://mandate.nanocorp.app/.well-known/mandate"
}
},
"title": "MANDATE Credential Broker",
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
"remotes": [
{
"url": "https://mandate.nanocorp.app/mcp",
"type": "streamable-http"
}
],
"version": "0.1.0",
"repository": {
"url": "https://github.com/projetnanocorp/mandate",
"source": "github"
},
"websiteUrl": "https://mandate.nanocorp.app/.well-known/mandate",
"description": "MCP server for mandates, delegation, policy-gated execution, credential grants, and audit."
}