io.github.lonniev/tollbooth-authority-northamerica

Official68 tools

by lonniev · Python

Tollbooth Authority — North America regional certifier

Tollbooth Authority — North America is a regional certifier implemented as an MCP server. It provides an “on-ramp to the Lightning turnpike” context, with supporting identity metadata and a defined relationship to a parent and peer authorities. The repository lists 68 tools and covers topics including model-context-protocol and micropayments.

🛠️ Key Features

Regional certifier for North America
Tool count: 68
Topics: bitcoin, certification, dpyc, fastmcp, lightning, mcp, micropayments, model-context-protocol, nostr, schnorr, tollbooth
Includes identity and authority hierarchy metadata in its excerpt

🚀 Use Cases

Certifying/authorizing within a DPYC prime/authority structure
Supporting Lightning-related “turnpike” workflows in North America

⚡ Developer Benefits

MCP-compatible server with 68 tools
Clear authority relationships: identity, parent, peer authorities, and sub-authority references

⚠️ Limitations

Available details here are limited to catalog metadata and a readme excerpt; specific tool functions are not described.

Topics

bitcoincertificationdpycfastmcplightningmcpmicropaymentsmodel-context-protocolnostrschnorrtollbooth

Captured live from the server via tools/list.

authority_check_balance

Check a patron's credit balance at this operator. This is the patron's spending balance — credits purchased via Lightning for tool calls at this operator. For the operator's own balance at the Authority (needed to certify patron purchases), use authority_check_balance instead. Free — no credits required. Proof of npub ownership is required to prevent anyone-with-the-registry from enumerating balances.

Parameters2

npub	string	required	The Nostr public key (npub1...) whose balance to check.
dpop_token	string	required	Raw JSON of a kind-27235 Nostr event signed by npub — not base64, not NIP-98 'Authorization: Nostr <b64>' framing. Its `u` tag must hold THIS tool's exact name (from tools/list), not the endpoint URL; content:"", created_at within 60s of now, and a random `nonce` tag recommended. Or a cached dpop_token phrase.

Raw schema

{
  "type": "object",
  "properties": {
    "npub": {
      "type": "string",
      "description": "The Nostr public key (npub1...) whose balance to check."
    },
    "dpop_token": {
      "type": "string",
      "description": "Raw JSON of a kind-27235 Nostr event signed by npub —\nnot base64, not NIP-98 'Authorization: Nostr <b64>' framing. Its\n`u` tag must hold THIS tool's exact name (from tools/list), not\nthe endpoint URL; content:\"\", created_at within 60s of now, and a\nrandom `nonce` tag recommended. Or a cached dpop_token phrase."
    }
  },
  "required": [
    "npub",
    "dpop_token"
  ],
  "additionalProperties": false
}

authority_purchase_credits

Buy credits via Bitcoin Lightning. Creates a Lightning invoice. Pay it with any Lightning wallet, then call check_payment to confirm. Proof of npub ownership is required so credits land in the correct ledger. Free — no credits required to call.

Parameters3

npub	string	required	The Nostr public key (npub1...) the credits will fund.
dpop_token	string	required	Raw JSON of a kind-27235 Nostr event signed by npub — not base64, not NIP-98 'Authorization: Nostr <b64>' framing. Its `u` tag must hold THIS tool's exact name (from tools/list), not the endpoint URL; content:"", created_at within 60s of now, and a random `nonce` tag recommended. Or a cached dpop_token phrase.
amount_sats	integer	optional	Satoshis to purchase (default 1000).

Raw schema

{
  "type": "object",
  "properties": {
    "npub": {
      "type": "string",
      "description": "The Nostr public key (npub1...) the credits will fund."
    },
    "dpop_token": {
      "type": "string",
      "description": "Raw JSON of a kind-27235 Nostr event signed by npub —\nnot base64, not NIP-98 'Authorization: Nostr <b64>' framing. Its\n`u` tag must hold THIS tool's exact name (from tools/list), not\nthe endpoint URL; content:\"\", created_at within 60s of now, and a\nrandom `nonce` tag recommended. Or a cached dpop_token phrase."
    },
    "amount_sats": {
      "default": 1000,
      "type": "integer",
      "description": "Satoshis to purchase (default 1000)."
    }
  },
  "required": [
    "npub",
    "dpop_token"
  ],
  "additionalProperties": false
}

authority_check_payment

Check the payment status of a Lightning invoice. Call after paying the invoice from purchase_credits. Free — no credits required. Proof of npub ownership is required to prevent credit-grant front-running by an observer of the invoice ID.

Parameters3

invoice_id	string	required	The invoice ID returned by purchase_credits.
npub	string	required	The Nostr public key (npub1...) that purchased the invoice.
dpop_token	string	required	Raw JSON of a kind-27235 Nostr event signed by npub — not base64, not NIP-98 'Authorization: Nostr <b64>' framing. Its `u` tag must hold THIS tool's exact name (from tools/list), not the endpoint URL; content:"", created_at within 60s of now, and a random `nonce` tag recommended. Or a cached dpop_token phrase.

Raw schema

{
  "type": "object",
  "properties": {
    "invoice_id": {
      "type": "string",
      "description": "The invoice ID returned by purchase_credits."
    },
    "npub": {
      "type": "string",
      "description": "The Nostr public key (npub1...) that purchased the invoice."
    },
    "dpop_token": {
      "type": "string",
      "description": "Raw JSON of a kind-27235 Nostr event signed by npub —\nnot base64, not NIP-98 'Authorization: Nostr <b64>' framing. Its\n`u` tag must hold THIS tool's exact name (from tools/list), not\nthe endpoint URL; content:\"\", created_at within 60s of now, and a\nrandom `nonce` tag recommended. Or a cached dpop_token phrase."
    }
  },
  "required": [
    "invoice_id",
    "npub",
    "dpop_token"
  ],
  "additionalProperties": false
}

authority_restore_credits

Credit a patron's ledger from a BTCPay-settled invoice. **RESTRICTED to the operator** — the operator owns the books and is the only party who can issue a manual credit grant. Patrons who believe they paid but never got credits must escalate to the operator's support, who then invokes this tool on their behalf. Use cases: cold-start vault races during check_payment, ncred delivery hiccups, patrons closing Top-Off sheets before settle, any infrastructure incident that left an invoice settled at BTCPay but uncredited on the operator's ledger. Idempotent — if the invoice is already credited (in the patron's ``credited_invoices``), returns success with credits_granted=0.

Parameters3

invoice_id	string	required	The BTCPay invoice ID to verify and credit.
patron_npub	string	required	The patron's npub whose ledger receives the grant.
dpop_token	string	required	A kind-27235 Nostr event signed by the OPERATOR's nsec for this tool. Patron proofs are rejected.

Raw schema

{
  "type": "object",
  "properties": {
    "invoice_id": {
      "type": "string",
      "description": "The BTCPay invoice ID to verify and credit."
    },
    "patron_npub": {
      "type": "string",
      "description": "The patron's npub whose ledger receives the grant."
    },
    "dpop_token": {
      "type": "string",
      "description": "A kind-27235 Nostr event signed by the OPERATOR's nsec\nfor this tool. Patron proofs are rejected."
    }
  },
  "required": [
    "invoice_id",
    "patron_npub",
    "dpop_token"
  ],
  "additionalProperties": false
}

authority_account_statement

Generate a patron's account statement at this operator. Returns the patron's purchase history, active credit tranches, per-tool usage breakdown, and recent daily usage logs. This is the patron's spending account — not the operator's Authority tax balance. Free — no credits consumed. Proof of npub ownership is required to prevent statement-scraping of arbitrary patrons.

Parameters3

npub	string	required	The patron's Nostr public key (npub1...).
dpop_token	string	required	Raw JSON of a kind-27235 Nostr event signed by npub — not base64, not NIP-98 'Authorization: Nostr <b64>' framing. Its `u` tag must hold THIS tool's exact name (from tools/list), not the endpoint URL; content:"", created_at within 60s of now, and a random `nonce` tag recommended. Or a cached dpop_token phrase.
days	integer	optional	Number of days of daily usage history to include (default 30).

Raw schema

{
  "type": "object",
  "properties": {
    "npub": {
      "type": "string",
      "description": "The patron's Nostr public key (npub1...)."
    },
    "dpop_token": {
      "type": "string",
      "description": "Raw JSON of a kind-27235 Nostr event signed by npub —\nnot base64, not NIP-98 'Authorization: Nostr <b64>' framing. Its\n`u` tag must hold THIS tool's exact name (from tools/list), not\nthe endpoint URL; content:\"\", created_at within 60s of now, and a\nrandom `nonce` tag recommended. Or a cached dpop_token phrase."
    },
    "days": {
      "default": 30,
      "type": "integer",
      "description": "Number of days of daily usage history to include (default 30)."
    }
  },
  "required": [
    "npub",
    "dpop_token"
  ],
  "additionalProperties": false
}

authority_account_statement_infographic

Generate a visual SVG infographic of your account statement. Returns the same data as account_statement, rendered as a dark-themed SVG graphic with balance hero, metrics cards, health gauge, tranche table, and tool usage breakdown. Costs 1 api_sat per call. Proof is verified by ``debit_or_deny`` before any cost is incurred.

Parameters3

npub	string	required	The Nostr public key (npub1...) whose statement to render.
dpop_token	string	required	Raw JSON of a kind-27235 Nostr event signed by npub — not base64, not NIP-98 'Authorization: Nostr <b64>' framing. Its `u` tag must hold THIS tool's exact name (from tools/list), not the endpoint URL; content:"", created_at within 60s of now, and a random `nonce` tag recommended. Or a cached dpop_token phrase.
days	integer	optional	Number of days of daily usage history to include (default 30).

Raw schema

{
  "type": "object",
  "properties": {
    "npub": {
      "type": "string",
      "description": "The Nostr public key (npub1...) whose statement to render."
    },
    "dpop_token": {
      "type": "string",
      "description": "Raw JSON of a kind-27235 Nostr event signed by npub —\nnot base64, not NIP-98 'Authorization: Nostr <b64>' framing. Its\n`u` tag must hold THIS tool's exact name (from tools/list), not\nthe endpoint URL; content:\"\", created_at within 60s of now, and a\nrandom `nonce` tag recommended. Or a cached dpop_token phrase."
    },
    "days": {
      "default": 30,
      "type": "integer",
      "description": "Number of days of daily usage history to include (default 30)."
    }
  },
  "required": [
    "npub",
    "dpop_token"
  ],
  "additionalProperties": false
}

authority_report_issue

File a field report about this service as a GitHub issue on the operator's repo. Found a tool's metadata or response wrong or confusing? Report it where the tool lives. The **author of record is your npub** — no npub / no proof, no issue — and it is stamped into the issue so the report is attributed to you, not the operator. Costs a small fee (a free write to an issue tracker would be abused). The report is PUBLIC and goes to the maintainers' normal triage; nothing is verified here. Returns the filed issue's repo, number, and url. If this operator has not enabled field reports, returns an "issue reporting not configured" situation and you are not charged.

Parameters5

npub	string	required	Your Nostr public key (npub1...); the report's author of record.
dpop_token	string	required	Raw JSON of a kind-27235 Nostr event signed by npub — not base64, not NIP-98 'Authorization: Nostr <b64>' framing. Its `u` tag must hold THIS tool's exact name (from tools/list), not the endpoint URL; content:"", created_at within 60s of now, and a random `nonce` tag recommended. Or a cached dpop_token phrase.
title	string	required	One-line summary of the problem.
body	string	required	The details — which tool, what was wrong, what you expected.
tool_name	string	optional	Optional: the specific tool the report is about (e.g. "schwab_get_option_chain").

Raw schema

{
  "type": "object",
  "properties": {
    "npub": {
      "type": "string",
      "description": "Your Nostr public key (npub1...); the report's author of record."
    },
    "dpop_token": {
      "type": "string",
      "description": "Raw JSON of a kind-27235 Nostr event signed by npub —\nnot base64, not NIP-98 'Authorization: Nostr <b64>' framing. Its\n`u` tag must hold THIS tool's exact name (from tools/list), not\nthe endpoint URL; content:\"\", created_at within 60s of now, and a\nrandom `nonce` tag recommended. Or a cached dpop_token phrase."
    },
    "title": {
      "type": "string",
      "description": "One-line summary of the problem."
    },
    "body": {
      "type": "string",
      "description": "The details — which tool, what was wrong, what you expected."
    },
    "tool_name": {
      "default": "",
      "type": "string",
      "description": "Optional: the specific tool the report is about\n(e.g. \"schwab_get_option_chain\")."
    }
  },
  "required": [
    "npub",
    "dpop_token",
    "title",
    "body"
  ],
  "additionalProperties": false
}

authority_service_status

Check the health and configuration of this service. Free.

Parameters

No parameters.

Raw schema

{
  "type": "object",
  "properties": {},
  "additionalProperties": false
}

authority_get_operator_onboarding_status

Report this operator's configuration readiness. Shows which operator settings are configured, which are missing, and how to deliver each missing value. For patron-level credential status, use get_patron_onboarding_status instead. Free.

Parameters

No parameters.

Raw schema

{
  "type": "object",
  "properties": {},
  "additionalProperties": false
}

authority_get_patron_onboarding_status

Report a patron's credential readiness for this operator. For set-once services (eXcalibur, TheBrain), shows which patron secrets are configured and which are missing. For dynamic/OAuth2 services (Schwab), reports that no patron credentials are needed. Free. Proof of npub ownership is required because credential presence is sensitive information about the patron's setup.

Parameters2

patron_npub	string	required	The patron's Nostr public key (npub1...).
dpop_token	string	required	A kind-27235 Nostr event signed by patron_npub for this tool.

Raw schema

{
  "type": "object",
  "properties": {
    "patron_npub": {
      "type": "string",
      "description": "The patron's Nostr public key (npub1...)."
    },
    "dpop_token": {
      "type": "string",
      "description": "A kind-27235 Nostr event signed by patron_npub for this tool."
    }
  },
  "required": [
    "patron_npub",
    "dpop_token"
  ],
  "additionalProperties": false
}

authority_session_status

Check operator readiness. Returns the operator lifecycle state and clear guidance on what to do next. Free. Lifecycle states: - ready: Operator is warm and fully operational — vault AND pricing model verified. Proceed with tool calls. - warming_up: Operator is initializing (cold start). Try a tool call — it will warm up on demand. - misconfigured: Persistence rejected a query with a permanent SQL error (permission denied, missing relation). Paid tools will fail until the operator repairs the database — retrying does not help. - quota_exceeded: The persistence provider (Neon) answered HTTP 402 — the operator's database has exhausted its compute/storage quota, so the books are locked for billing. Paid tools fail; retrying does NOT help. The operator's Authority must restore capacity (upgrade the plan or wait for the quota reset). Free tools remain available. - not_registered: Operator has no Authority relationship yet. Call register_operator first. - no_identity: Operator nsec is not configured. Deployment issue.

Parameters1

patron_npub

string

optional

Optional. If supplied, the response includes an ``upstream_oauth`` block with the patron's stored OAuth token expiry (runtime-derived from vault state) so a client can refresh proactively rather than reactively after a stale-token failure.

Raw schema

{
  "type": "object",
  "properties": {
    "patron_npub": {
      "default": "",
      "type": "string",
      "description": "Optional. If supplied, the response includes an\n``upstream_oauth`` block with the patron's stored OAuth\ntoken expiry (runtime-derived from vault state) so a\nclient can refresh proactively rather than reactively\nafter a stale-token failure."
    }
  },
  "additionalProperties": false
}

authority_request_credential_channel

Open a Secure Courier channel for credential delivery. This is the CREDENTIAL-DELIVERY flow — use it to hand over a service secret (API keys, tokens). To merely prove you control an npub (the usual answer to a ``proof_required`` error), use ``request_npub_proof`` instead. Note: dynamic/OAuth2 services (e.g. Schwab) need NO couriered secret — check ``service_status`` first. Sends a welcome DM with a credential template. The recipient must read the DM in their Nostr client, fill in the fields, and reply manually. **This is a human-in-the-loop flow.** After calling this tool, STOP and tell the user what to do. Wait for the user to confirm they have replied before calling ``receive_credentials``. Do NOT poll or retry — each ``receive_credentials`` call destructively drains the relay mailbox.

Parameters2

sender_npub	string	optional	Required. The npub to send the template to.
service	string	optional	Required. The credential service name (e.g., from get_operator_onboarding_status or get_patron_onboarding_status).

Raw schema

{
  "type": "object",
  "properties": {
    "sender_npub": {
      "default": "",
      "type": "string",
      "description": "Required. The npub to send the template to."
    },
    "service": {
      "default": "",
      "type": "string",
      "description": "Required. The credential service name (e.g.,\nfrom get_operator_onboarding_status or get_patron_onboarding_status)."
    }
  },
  "additionalProperties": false
}

authority_receive_credentials

Pick up credentials from the Secure Courier. Completes the CREDENTIAL-DELIVERY flow (the ownership-proof counterpart is ``receive_npub_proof``). **Call this only after the user confirms they have replied.** Deterministic, one-shot retrieval: name the response you want with ``(sender_npub, service, dpop_token)`` and the tool drains ONLY the rendezvous relay that channel was pinned to. Every popped DM with the wrong session phrase is deleted and its sender is NACK'd; the first DM with the matching phrase is accepted (ACK'd) and the scan stops. If none match, the queue is drained and a ``courier_not_found`` result is returned. Do NOT poll, loop, or retry. If a credential_card (ncred1...) is provided, it is redeemed directly without any relay access (dpop_token not required for that path). On success, the payment processor client is reinitialized from the new credentials — no server restart needed.

Parameters4

sender_npub	string	optional	Required. The npub that sent the credentials.
service	string	optional	Required. The credential service name (must match the service used in request_credential_channel).
dpop_token	string	optional	Required. The session phrase returned by request_credential_channel for this exact channel.
credential_card	string	optional	Optional. An ncred1... card to redeem directly (bypasses the relay drain; dpop_token not needed).

Raw schema

{
  "type": "object",
  "properties": {
    "sender_npub": {
      "default": "",
      "type": "string",
      "description": "Required. The npub that sent the credentials."
    },
    "service": {
      "default": "",
      "type": "string",
      "description": "Required. The credential service name (must match\nthe service used in request_credential_channel)."
    },
    "dpop_token": {
      "default": "",
      "type": "string",
      "description": "Required. The session phrase returned by\nrequest_credential_channel for this exact channel."
    },
    "credential_card": {
      "default": "",
      "type": "string",
      "description": "Optional. An ncred1... card to redeem directly\n(bypasses the relay drain; dpop_token not needed)."
    }
  },
  "additionalProperties": false
}

authority_forget_credentials

Delete vaulted credentials for a specific service and npub. For operator credentials, pass the operator's own npub. For patron credentials, pass the patron's npub. Always requires proof of npub ownership — a deletion is as destructive as a write.

Parameters3

service	string	required	The credential service to forget.
npub	string	required	The Nostr public key (npub1...) whose credentials to forget.
dpop_token	string	required	Raw JSON of a kind-27235 Nostr event signed by npub — not base64, not NIP-98 'Authorization: Nostr <b64>' framing. Its `u` tag must hold THIS tool's exact name (from tools/list), not the endpoint URL; content:"", created_at within 60s of now, and a random `nonce` tag recommended. Or a cached dpop_token phrase.

Raw schema

{
  "type": "object",
  "properties": {
    "service": {
      "type": "string",
      "description": "The credential service to forget."
    },
    "npub": {
      "type": "string",
      "description": "The Nostr public key (npub1...) whose credentials to forget."
    },
    "dpop_token": {
      "type": "string",
      "description": "Raw JSON of a kind-27235 Nostr event signed by npub —\nnot base64, not NIP-98 'Authorization: Nostr <b64>' framing. Its\n`u` tag must hold THIS tool's exact name (from tools/list), not\nthe endpoint URL; content:\"\", created_at within 60s of now, and a\nrandom `nonce` tag recommended. Or a cached dpop_token phrase."
    }
  },
  "required": [
    "service",
    "npub",
    "dpop_token"
  ],
  "additionalProperties": false
}

authority_update_patron_credential

Add or update a single patron credential field. Merges into existing stored credentials without affecting other fields. Useful for setting an account identifier after OAuth, changing a default brain, etc. Free. Proof of npub ownership is required — this is a write to the patron's sensitive credential vault.

Parameters4

npub	string	required	The patron's Nostr public key (npub1...).
dpop_token	string	required	Raw JSON of a kind-27235 Nostr event signed by npub — not base64, not NIP-98 'Authorization: Nostr <b64>' framing. Its `u` tag must hold THIS tool's exact name (from tools/list), not the endpoint URL; content:"", created_at within 60s of now, and a random `nonce` tag recommended. Or a cached dpop_token phrase.
field	string	required	The credential field name to set.
value	string	required	The value to store.

Raw schema

{
  "type": "object",
  "properties": {
    "npub": {
      "type": "string",
      "description": "The patron's Nostr public key (npub1...)."
    },
    "dpop_token": {
      "type": "string",
      "description": "Raw JSON of a kind-27235 Nostr event signed by npub —\nnot base64, not NIP-98 'Authorization: Nostr <b64>' framing. Its\n`u` tag must hold THIS tool's exact name (from tools/list), not\nthe endpoint URL; content:\"\", created_at within 60s of now, and a\nrandom `nonce` tag recommended. Or a cached dpop_token phrase."
    },
    "field": {
      "type": "string",
      "description": "The credential field name to set."
    },
    "value": {
      "type": "string",
      "description": "The value to store."
    }
  },
  "required": [
    "npub",
    "dpop_token",
    "field",
    "value"
  ],
  "additionalProperties": false
}

authority_update_operator_credential

Add or update a single operator secret field. Merges into the operator's stored credentials without touching the others — the field-level counterpart to re-delivering the whole bundle over Secure Courier. Use it to rotate one secret (a reissued ``btcpay_api_key``, say) without restating the six you did not change, where any field omitted from a courier reply is destroyed. The value is never echoed back. RESTRICTED to the operator — requires proof (nsec-signed kind-27235 or a cached dpop_token phrase); patron proofs are rejected.

Parameters3

field	string	required	The operator credential field to set. Must be declared in the operator's credential template.
value	string	required	The value to store.
dpop_token	string	required	Operator proof for this tool.

Raw schema

{
  "type": "object",
  "properties": {
    "field": {
      "type": "string",
      "description": "The operator credential field to set. Must be declared\nin the operator's credential template."
    },
    "value": {
      "type": "string",
      "description": "The value to store."
    },
    "dpop_token": {
      "type": "string",
      "description": "Operator proof for this tool."
    }
  },
  "required": [
    "field",
    "value",
    "dpop_token"
  ],
  "additionalProperties": false
}

authority_delete_patron_credential

Remove a single patron credential field. Deletes one field from stored credentials without affecting other fields. Free. Proof of npub ownership is required — this is a write to the patron's sensitive credential vault.

Parameters3

npub	string	required	The patron's Nostr public key (npub1...).
dpop_token	string	required	Raw JSON of a kind-27235 Nostr event signed by npub — not base64, not NIP-98 'Authorization: Nostr <b64>' framing. Its `u` tag must hold THIS tool's exact name (from tools/list), not the endpoint URL; content:"", created_at within 60s of now, and a random `nonce` tag recommended. Or a cached dpop_token phrase.
field	string	required	The credential field name to remove.

Raw schema

{
  "type": "object",
  "properties": {
    "npub": {
      "type": "string",
      "description": "The patron's Nostr public key (npub1...)."
    },
    "dpop_token": {
      "type": "string",
      "description": "Raw JSON of a kind-27235 Nostr event signed by npub —\nnot base64, not NIP-98 'Authorization: Nostr <b64>' framing. Its\n`u` tag must hold THIS tool's exact name (from tools/list), not\nthe endpoint URL; content:\"\", created_at within 60s of now, and a\nrandom `nonce` tag recommended. Or a cached dpop_token phrase."
    },
    "field": {
      "type": "string",
      "description": "The credential field name to remove."
    }
  },
  "required": [
    "npub",
    "dpop_token",
    "field"
  ],
  "additionalProperties": false
}

authority_delete_operator_credential

Remove a single operator secret field. Deletes one key from the operator's encrypted credential blob without touching the others — the field-level counterpart to ``forget_credentials``, which wipes the whole row. Use it to retire a leftover after an SDK cutover (a Prefect key after Modal, or a stored but untemplated orphan like ``anthropic_api_key``) without taking the operator down for a full re-delivery. Stored-but-untemplated fields are first-class: the delete is keyed on what is vaulted, not on what the current template declares. Idempotent — already-absent fields report ``removed: false`` without rewriting the vault. RESTRICTED to the operator — requires proof (nsec-signed kind-27235 or a cached dpop_token phrase); patron proofs are rejected. A deletion is as destructive as a write.

Parameters2

field	string	required	The operator credential field to remove (templated or not).
dpop_token	string	required	Operator proof for this tool.

Raw schema

{
  "type": "object",
  "properties": {
    "field": {
      "type": "string",
      "description": "The operator credential field to remove (templated or not)."
    },
    "dpop_token": {
      "type": "string",
      "description": "Operator proof for this tool."
    }
  },
  "required": [
    "field",
    "dpop_token"
  ],
  "additionalProperties": false
}

authority_get_patron_credential_fields

List stored patron credential field names (not values). Returns the names of fields stored for a patron, plus each field's ``delivered_at`` ISO-8601 timestamp when known (null for secrets vaulted before timestamps were recorded). Values are never exposed — use this to verify which fields are configured and how old each one is. Free. Proof of npub ownership is required: the list of configured fields is itself sensitive (reveals which integrations a patron has set up).

Parameters2

npub	string	required	The patron's Nostr public key (npub1...).
dpop_token	string	required	Raw JSON of a kind-27235 Nostr event signed by npub — not base64, not NIP-98 'Authorization: Nostr <b64>' framing. Its `u` tag must hold THIS tool's exact name (from tools/list), not the endpoint URL; content:"", created_at within 60s of now, and a random `nonce` tag recommended. Or a cached dpop_token phrase.

Raw schema

{
  "type": "object",
  "properties": {
    "npub": {
      "type": "string",
      "description": "The patron's Nostr public key (npub1...)."
    },
    "dpop_token": {
      "type": "string",
      "description": "Raw JSON of a kind-27235 Nostr event signed by npub —\nnot base64, not NIP-98 'Authorization: Nostr <b64>' framing. Its\n`u` tag must hold THIS tool's exact name (from tools/list), not\nthe endpoint URL; content:\"\", created_at within 60s of now, and a\nrandom `nonce` tag recommended. Or a cached dpop_token phrase."
    }
  },
  "required": [
    "npub",
    "dpop_token"
  ],
  "additionalProperties": false
}

authority_request_npub_proof

Request npub ownership proof from a patron via Nostr DM. This is the npub-OWNERSHIP-PROOF flow — use it when a call returns ``proof_required``. It proves the caller controls an npub; it does NOT deliver any service secret. To hand an operator its API keys or OAuth secrets, use ``request_credential_channel`` instead. Sends a challenge DM that the patron must sign and reply to using their Nostr client. **This is a human-in-the-loop flow.** After calling this tool, STOP and tell the user to check their Nostr client and reply to the challenge. Wait for the user to confirm they have replied before calling ``receive_npub_proof``. Do NOT poll or retry — each ``receive_npub_proof`` call destructively drains the relay mailbox. **Returns** a ``dpop_token`` — the demonstrated-proof-of-possession token that the calling application MUST remember and pass as the ``dpop_token`` parameter on every subsequent paid tool call. The MCP does not retain this value across restarts. **Lifecycle:** The cached proof expires after the patron's chosen duration. When it expires, call ``request_npub_proof`` again for a fresh challenge, then wait for the user, then call ``receive_npub_proof``. Free.

Parameters3

patron_npub	string	optional	Required. The patron's npub to request proof from.
reason	string	optional	Optional. A human-readable purpose for the request ("I'm working on your request XYZ and need the Operator to do ABC for you"). Signed into the provenance attestation and shown in the DM, so the recipient sees why they are being asked — especially useful when the signer is unknown to them.
verify_at	string	optional	Optional. A free-form statement of WHERE you (the initiating agent) already showed this proof's one-time code to the user — a URL, or "your Claude.ai conversation", "the Grok session". The OAuth 2.0 Device Grant ``verification_uri``, generalized: the user approves only if the code in the DM matches the one you displayed there, so an unsolicited request they've never seen is refused. Signed into the attestation.

Raw schema

{
  "type": "object",
  "properties": {
    "patron_npub": {
      "default": "",
      "type": "string",
      "description": "Required. The patron's npub to request proof from."
    },
    "reason": {
      "default": "",
      "type": "string",
      "description": "Optional. A human-readable purpose for the request\n(\"I'm working on your request XYZ and need the Operator to do\nABC for you\"). Signed into the provenance attestation and shown\nin the DM, so the recipient sees *why* they are being asked —\nespecially useful when the signer is unknown to them."
    },
    "verify_at": {
      "default": "",
      "type": "string",
      "description": "Optional. A free-form statement of WHERE you (the\ninitiating agent) already showed this proof's one-time code to\nthe user — a URL, or \"your Claude.ai conversation\", \"the Grok\nsession\". The OAuth 2.0 Device Grant ``verification_uri``,\ngeneralized: the user approves only if the code in the DM matches\nthe one you displayed there, so an unsolicited request they've\nnever seen is refused. Signed into the attestation."
    }
  },
  "additionalProperties": false
}

authority_receive_npub_proof

Receive npub ownership confirmation from a patron. Completes the npub-OWNERSHIP-PROOF flow (the credential-delivery counterpart is ``receive_credentials``). **Call this only after the user confirms they have replied.** Deterministic, one-shot retrieval: name the response with ``(patron_npub, dpop_token)`` — the ``dpop_token`` being the value returned by ``request_npub_proof``. The tool drains ONLY the pinned rendezvous relay that challenge was published on, stopping at the DM whose phrase matches. Mismatched DMs are deleted and NACK'd (without revealing the expected phrase). If called before the user replies, their message will never be found. Do NOT poll, loop, or retry. The signed DM itself proves npub ownership (the patron's nsec signed it). On success, returns the ``dpop_token`` — the same token. The calling application MUST remember it and pass it as the ``dpop_token`` parameter on every subsequent paid tool call. The proof (a hash of the token) is stored in the vault keyed by that hash — the MCP never stores the raw token itself. Free.

Parameters2

patron_npub	string	optional	Required. The patron's npub to receive proof from.
dpop_token	string	optional	Required. The dpop_token returned by request_npub_proof.

Raw schema

{
  "type": "object",
  "properties": {
    "patron_npub": {
      "default": "",
      "type": "string",
      "description": "Required. The patron's npub to receive proof from."
    },
    "dpop_token": {
      "default": "",
      "type": "string",
      "description": "Required. The dpop_token returned by request_npub_proof."
    }
  },
  "additionalProperties": false
}

authority_check_proof_status

Check whether a previously-cached dpop_token is still valid. Mirrors ``check_oauth_status`` for the npub-proof flow: a calling agent can ask "will my next paid call accept this dpop_token?" before burning credits on a guaranteed failure. Free, no side effects — does not evict the cache or touch relays.

Parameters2

patron_npub	string	optional	Required. The patron's npub (npub1...).
dpop_token	string	optional	Required. The dpop_token phrase returned by ``request_npub_proof`` / ``receive_npub_proof``.

Raw schema

{
  "type": "object",
  "properties": {
    "patron_npub": {
      "default": "",
      "type": "string",
      "description": "Required. The patron's npub (npub1...)."
    },
    "dpop_token": {
      "default": "",
      "type": "string",
      "description": "Required. The dpop_token phrase returned by\n``request_npub_proof`` / ``receive_npub_proof``."
    }
  },
  "additionalProperties": false
}

authority_oracle_how_to_join

Get DPYC onboarding instructions from the Oracle. Free.

Parameters

No parameters.

Raw schema

{
  "type": "object",
  "properties": {},
  "additionalProperties": false
}

authority_oracle_get_tax_rate

Get the current DPYC certification tax rate. Free.

Parameters

No parameters.

Raw schema

{
  "type": "object",
  "properties": {},
  "additionalProperties": false
}

authority_oracle_lookup_member

Look up a DPYC community member by npub. Free.

Parameters1

npub

string

required

Raw schema

{
  "type": "object",
  "properties": {
    "npub": {
      "type": "string"
    }
  },
  "required": [
    "npub"
  ],
  "additionalProperties": false
}

authority_oracle_about

Describe the DPYC ecosystem via the Oracle. Free.

Parameters

No parameters.

Raw schema

{
  "type": "object",
  "properties": {},
  "additionalProperties": false
}

authority_oracle_network_advisory

Get active network advisories from the Oracle. Free.

Parameters

No parameters.

Raw schema

{
  "type": "object",
  "properties": {},
  "additionalProperties": false
}

authority_check_authority_balance

Check this operator's tax balance at the Authority. Returns the sats available for certifying patron credit purchases. When this balance reaches zero, patron top-ups cannot be certified and the operator must call purchase_credits on the Authority. This is the operator's own funding — not a patron balance. Free.

Parameters

No parameters.

Raw schema

{
  "type": "object",
  "properties": {},
  "additionalProperties": false
}

authority_get_pricing_model

Get the active pricing model for this operator. Free. If no model exists, self-initializes a scaffold with all registered tools at 0 sats. No economic data from code.

Parameters

No parameters.

Raw schema

{
  "type": "object",
  "properties": {},
  "additionalProperties": false
}

authority_set_pricing_model

Set the active pricing model. RESTRICTED to operator. Requires a valid proof (Schnorr-signed kind-27235 event) proving the caller holds the operator's nsec.

Parameters2

model_json	string	required
dpop_token	string	optional

Raw schema

{
  "type": "object",
  "properties": {
    "model_json": {
      "type": "string"
    },
    "dpop_token": {
      "default": "",
      "type": "string"
    }
  },
  "required": [
    "model_json"
  ],
  "additionalProperties": false
}

authority_reset_pricing_model

Erase all pricing models and restore a viable default. Deletes every stored model, then self-initializes a fresh one from the tool registry — all tools at 0 sats with proper UUIDs. Returns the new model. RESTRICTED to operator — requires proof (nsec-signed).

Parameters1

dpop_token

string

optional

Raw schema

{
  "type": "object",
  "properties": {
    "dpop_token": {
      "default": "",
      "type": "string"
    }
  },
  "additionalProperties": false
}

authority_request_adoption

Ask a chosen Authority to adopt this operator (deferred courtship). RESTRICTED to the operator — requires proof the caller controls this operator's npub. Resolves the Authority's MCP endpoint from the community registry, mints an inline ownership proof with this operator's nsec, and delivers the request MCP-to-MCP. The Authority records it as pending; its owner approves on their own time. Poll ``adoption_status`` for progress; the operator flips to ``ready`` once the Authority provisions it.

Parameters4

authority_npub	string	required	npub of the Authority to request adoption from.
dpop_token	string	optional	operator-npub ownership proof (inline kind-27235 or cached token).
service_url	string	optional	this operator's MCP endpoint (advertised to the Authority).
note	string	optional	optional message for the Authority owner.

Raw schema

{
  "type": "object",
  "properties": {
    "authority_npub": {
      "type": "string",
      "description": "npub of the Authority to request adoption from."
    },
    "dpop_token": {
      "default": "",
      "type": "string",
      "description": "operator-npub ownership proof (inline kind-27235 or cached token)."
    },
    "service_url": {
      "default": "",
      "type": "string",
      "description": "this operator's MCP endpoint (advertised to the Authority)."
    },
    "note": {
      "default": "",
      "type": "string",
      "description": "optional message for the Authority owner."
    }
  },
  "required": [
    "authority_npub"
  ],
  "additionalProperties": false
}

authority_adoption_status

Check this operator's adoption-request status at a chosen Authority. Free. Polls the Authority MCP-to-MCP for the status of this operator's request (pending / approved / rejected / provisioned).

Parameters2

authority_npub	string	required
dpop_token	string	optional

Raw schema

{
  "type": "object",
  "properties": {
    "authority_npub": {
      "type": "string"
    },
    "dpop_token": {
      "default": "",
      "type": "string"
    }
  },
  "required": [
    "authority_npub"
  ],
  "additionalProperties": false
}

authority_restore_neon_schema

Re-run ``ensure_schema()`` on every NeonVault this operator uses. Diagnostic / recovery tool for the case where the Neon HTTP SQL API is returning persistent 4xx errors and the operator suspects the schema isn't there or grants are wrong. Idempotent — uses ``CREATE TABLE IF NOT EXISTS`` so a successful re-run is harmless. Returns the per-step result. If any step raises, surfaces the Neon error message inline (0.31.0 reads the SQL error body that earlier wheels swallowed behind ``raise_for_status``). RESTRICTED to operator — requires proof (nsec-signed).

Parameters1

dpop_token

string

optional

Raw schema

{
  "type": "object",
  "properties": {
    "dpop_token": {
      "default": "",
      "type": "string"
    }
  },
  "additionalProperties": false
}

authority_list_canonical_identities

Return canonical (tool_id, mcp_name, …) for every tool the wheel exposes. The authoritative source for any client (Studio, agents, FE) that needs to know how this MCP identifies its tools. Reconcile uses this output to UUID-join against the stored pricing model — no name-based UUID derivation, no guessing. Includes both ToolIdentity-seeded tools and any UUID recorded by ``@paid_tool`` that is missing from the registry. The latter appear with ``registered: false`` (and in the top-level ``unregistered`` array) so Reconcile can flag deploy drift instead of silently reporting clean when a live tool was never seeded (#174). If the operator renames a function or rebrands a slug, the mcp_name in this output changes but tool_id stays. That's the whole point of the canonical-UUID design. Also diffs the live FastMCP wire surface against the registry. Tools exposed on the wire but absent from the registry appear in ``unregistered`` so Reconcile can flag deploy drift instead of silently under-reporting (issue #175). Free, no side effects.

Parameters

No parameters.

Raw schema

{
  "type": "object",
  "properties": {},
  "additionalProperties": false
}

authority_get_nostr_profile

Read an npub's public Nostr profile (NIP-01 kind-0 metadata). Free, no proof — the data is already public on relays. Returns the latest metadata fields (name, display_name, about, picture, banner, nip05, website, lud16) or an empty profile if none is published.

Parameters1

npub

string

optional

Raw schema

{
  "type": "object",
  "properties": {
    "npub": {
      "default": "",
      "type": "string"
    }
  },
  "additionalProperties": false
}

authority_publish_nostr_profile

Publish a CLIENT-SIGNED kind-0 profile to relays for an npub. The wheel never holds a patron nsec. The frontend signs the kind-0 metadata event with the patron's session key or a NIP-07 extension and passes the signed event (JSON) here; the wheel verifies the signature matches the npub, then relays it to public relays. The signature is the authorization — no proof token, no key custody. Free.

Parameters2

npub	string	optional	The patron's Nostr public key the event must be signed by.
signed_event	string	optional	A JSON-encoded, client-signed kind-0 event.

Raw schema

{
  "type": "object",
  "properties": {
    "npub": {
      "default": "",
      "type": "string",
      "description": "The patron's Nostr public key the event must be signed by."
    },
    "signed_event": {
      "default": "",
      "type": "string",
      "description": "A JSON-encoded, client-signed kind-0 event."
    }
  },
  "additionalProperties": false
}

authority_check_price

Preview the effective cost of a tool call. Shows the base cost and any constraint effects (discounts, free trials, surge pricing). Free — no credits required.

Parameters4

tool_id	string	required	Either the tool's UUID (from the pricing model) or a bare capability string (e.g. ``"deal_scenario"``). FE callers usually have the capability name; this resolves both so the FE doesn't need to derive UUIDs locally.
npub	string	optional
dpop_token	string	optional
tool_kwargs	string	optional	Optional JSON object with tool call parameters for ad valorem / categorical-multiplier pricing preview (e.g. '{"amount_sats": 5000}' or '{"difficulty": "sovereign", "mode": "live"}').

Raw schema

{
  "type": "object",
  "properties": {
    "tool_id": {
      "type": "string",
      "description": "Either the tool's UUID (from the pricing model) or a\nbare capability string (e.g. ``\"deal_scenario\"``). FE\ncallers usually have the capability name; this resolves\nboth so the FE doesn't need to derive UUIDs locally."
    },
    "npub": {
      "default": "",
      "type": "string"
    },
    "dpop_token": {
      "default": "",
      "type": "string"
    },
    "tool_kwargs": {
      "default": "",
      "type": "string",
      "description": "Optional JSON object with tool call parameters\nfor ad valorem / categorical-multiplier pricing preview\n(e.g. '{\"amount_sats\": 5000}' or\n'{\"difficulty\": \"sovereign\", \"mode\": \"live\"}')."
    }
  },
  "required": [
    "tool_id"
  ],
  "additionalProperties": false
}

authority_list_constraint_types

List all available constraint types and their parameter schemas. Returns the type, category, description, and parameter specs for every constraint that can be used in a pricing pipeline. Free — no credits required.

Parameters

No parameters.

Raw schema

{
  "type": "object",
  "properties": {},
  "additionalProperties": false
}

authority_mint_coupon

Create a new operator-owned discount coupon.

Parameters7

name	string	required	The catchy code patrons type to redeem (operator-scoped uniqueness).
discount_percent	number	required	Percentage off the base price (0-100).
valid_from	string	required	ISO-8601 datetime when the coupon becomes active.
valid_until	string	required	ISO-8601 datetime when the coupon expires.
uses_per_patron	any	optional	How many tool calls one patron can claim the discount on (default 1; pass null/None for unlimited within the window).
total_uses	any	optional	Aggregate cap across all patrons (default None = unlimited).
dpop_token	string	optional

Raw schema

{
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "description": "The catchy code patrons type to redeem\n(operator-scoped uniqueness)."
    },
    "discount_percent": {
      "type": "number",
      "description": "Percentage off the base price (0-100)."
    },
    "valid_from": {
      "type": "string",
      "description": "ISO-8601 datetime when the coupon becomes active."
    },
    "valid_until": {
      "type": "string",
      "description": "ISO-8601 datetime when the coupon expires."
    },
    "uses_per_patron": {
      "anyOf": [
        {
          "type": "integer"
        },
        {
          "type": "null"
        }
      ],
      "default": 1,
      "description": "How many tool calls one patron can claim the\ndiscount on (default 1; pass null/None for unlimited\nwithin the window)."
    },
    "total_uses": {
      "anyOf": [
        {
          "type": "integer"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Aggregate cap across all patrons (default None =\nunlimited)."
    },
    "dpop_token": {
      "default": "",
      "type": "string"
    }
  },
  "required": [
    "name",
    "discount_percent",
    "valid_from",
    "valid_until"
  ],
  "additionalProperties": false
}

authority_list_coupons

List every coupon this operator has minted (newest first). Each row carries the current ``times_redeemed`` counter — the Studio renders a progress bar from this against ``total_uses``. RESTRICTED to operator — requires proof.

Parameters1

dpop_token

string

optional

Raw schema

{
  "type": "object",
  "properties": {
    "dpop_token": {
      "default": "",
      "type": "string"
    }
  },
  "additionalProperties": false
}

authority_update_coupon

Patch a coupon's editable fields. Pass only the fields you want to change. To set a cap to unlimited (NULL in the schema), pass ``clear_uses_per_patron=true`` or ``clear_total_uses=true``. Renaming the code is allowed — existing patron redemption rows survive (they key on coupon id). RESTRICTED to operator — requires proof.

Parameters10

coupon_id	string	required
name	any	optional
discount_percent	any	optional
valid_from	any	optional
valid_until	any	optional
uses_per_patron	any	optional
total_uses	any	optional
clear_uses_per_patron	boolean	optional
clear_total_uses	boolean	optional
dpop_token	string	optional

Raw schema

{
  "type": "object",
  "properties": {
    "coupon_id": {
      "type": "string"
    },
    "name": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null
    },
    "discount_percent": {
      "anyOf": [
        {
          "type": "number"
        },
        {
          "type": "null"
        }
      ],
      "default": null
    },
    "valid_from": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null
    },
    "valid_until": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null
    },
    "uses_per_patron": {
      "anyOf": [
        {
          "type": "integer"
        },
        {
          "type": "null"
        }
      ],
      "default": null
    },
    "total_uses": {
      "anyOf": [
        {
          "type": "integer"
        },
        {
          "type": "null"
        }
      ],
      "default": null
    },
    "clear_uses_per_patron": {
      "default": false,
      "type": "boolean"
    },
    "clear_total_uses": {
      "default": false,
      "type": "boolean"
    },
    "dpop_token": {
      "default": "",
      "type": "string"
    }
  },
  "required": [
    "coupon_id"
  ],
  "additionalProperties": false
}

authority_delete_coupon

Delete a coupon. Cascades to all patron redemptions. Any chain step referencing the deleted coupon_id becomes a no-op (the constraint returns neutral on unknown ids) — the Studio surfaces orphan references as warnings. RESTRICTED to operator — requires proof.

Parameters2

coupon_id	string	required
dpop_token	string	optional

Raw schema

{
  "type": "object",
  "properties": {
    "coupon_id": {
      "type": "string"
    },
    "dpop_token": {
      "default": "",
      "type": "string"
    }
  },
  "required": [
    "coupon_id"
  ],
  "additionalProperties": false
}

authority_redeem_coupon

Claim a coupon by its name (the code the operator shared). Looks up the operator's coupon by ``code``, validates the window and total cap, and records a per-patron redemption row. Subsequent paid tool calls on this MCP auto-apply the discount until ``uses_per_patron`` is exhausted. Free — no credits required. Requires proof of ``npub``. Idempotent: redeeming the same code twice returns the existing redemption.

Parameters3

npub	string	required
code	string	required
dpop_token	string	optional

Raw schema

{
  "type": "object",
  "properties": {
    "npub": {
      "type": "string"
    },
    "code": {
      "type": "string"
    },
    "dpop_token": {
      "default": "",
      "type": "string"
    }
  },
  "required": [
    "npub",
    "code"
  ],
  "additionalProperties": false
}

authority_list_my_coupons

List the coupons this patron has redeemed on this operator. Returns both active and exhausted redemptions with a per-row ``status`` (``active`` / ``window_closed`` / ``patron_limit`` / ``total_limit``). Free — requires proof of ``npub``.

Parameters2

npub	string	required
dpop_token	string	optional

Raw schema

{
  "type": "object",
  "properties": {
    "npub": {
      "type": "string"
    },
    "dpop_token": {
      "default": "",
      "type": "string"
    }
  },
  "required": [
    "npub"
  ],
  "additionalProperties": false
}

authority_forget_coupon

Remove a coupon from this patron's redemption list. Cosmetic only — the coupon itself still exists at the operator, and the patron can re-redeem the same code later while the window allows. Free — requires proof of ``npub``.

Parameters3

npub	string	required
coupon_id	string	required
dpop_token	string	optional

Raw schema

{
  "type": "object",
  "properties": {
    "npub": {
      "type": "string"
    },
    "coupon_id": {
      "type": "string"
    },
    "dpop_token": {
      "default": "",
      "type": "string"
    }
  },
  "required": [
    "npub",
    "coupon_id"
  ],
  "additionalProperties": false
}

authority_notarize_ledger

Build a Merkle tree of all patron balances and submit the root to Bitcoin via OpenTimestamps. Operator-only background task. Bitcoin confirmation takes 1-6 hours. Free — no credits required.

Parameters

No parameters.

Raw schema

{
  "type": "object",
  "properties": {},
  "additionalProperties": false
}

authority_get_notarization_proof

Generate a Merkle inclusion proof that a patron's balance was included in a Bitcoin-notarized snapshot.

Parameters2

notarization_id	string	required	The notarization record ID.
npub	string	required	The patron's Nostr public key (npub1...).

Raw schema

{
  "type": "object",
  "properties": {
    "notarization_id": {
      "type": "string",
      "description": "The notarization record ID."
    },
    "npub": {
      "type": "string",
      "description": "The patron's Nostr public key (npub1...)."
    }
  },
  "required": [
    "notarization_id",
    "npub"
  ],
  "additionalProperties": false
}

authority_list_notarizations

List recent Bitcoin notarization records.

Parameters2

limit	integer	optional	Maximum records to return (default 20).
status	string	optional	Optional filter (e.g., 'submitted', 'confirmed').

Raw schema

{
  "type": "object",
  "properties": {
    "limit": {
      "default": 20,
      "type": "integer",
      "description": "Maximum records to return (default 20)."
    },
    "status": {
      "default": "",
      "type": "string",
      "description": "Optional filter (e.g., 'submitted', 'confirmed')."
    }
  },
  "additionalProperties": false
}

authority_register_operator

Provision an operator in the Authority ledger. Creates a ledger entry so the operator can purchase credits and certify purchase orders. Idempotent — safe to call again. Requires TWO independent identity proofs: 1. ``proof`` — Schnorr proof signed by the candidate operator's ``npub``. Proves the requester really controls that npub. The operator typically calls ``request_npub_proof`` / ``receive_npub_proof`` against this Authority first to mint a cached dpop_token. 2. ``authority_proof`` — Schnorr proof signed by the Authority's own npub. This is the Authority's human consent — only an agent with the Authority's nsec on hand can produce it. Apps generate this inline when the human admin clicks 'adopt'; otherwise an Authority-side proof can be minted the same way an operator-side one is. Next step: Call purchase_credits to fund your credit balance.

Parameters5

npub	string	optional	Your Nostr npub (bech32). Get one from the dpyc-oracle's how_to_join() tool.
dpop_token	string	optional
service_url	string	optional	Your MCP endpoint URL (e.g. 'https://my-service.fastmcp.app/mcp').
display_name	string	optional	Human-readable name for the Operator service, shown in the community roster (e.g. 'my-service'). If empty, the roster falls back to a truncated npub.
authority_proof	string	optional	Identity proof signed by the Authority's OWN npub — the Authority's discretionary consent to adopt this Operator. Apps with the Authority's nsec in their keystore (e.g. the Pricing Studio) produce this proof automatically when the user clicks 'adopt'.

Raw schema

{
  "type": "object",
  "properties": {
    "npub": {
      "default": "",
      "description": "Your Nostr npub (bech32). Get one from the dpyc-oracle's how_to_join() tool.",
      "type": "string"
    },
    "dpop_token": {
      "default": "",
      "type": "string"
    },
    "service_url": {
      "default": "",
      "description": "Your MCP endpoint URL (e.g. 'https://my-service.fastmcp.app/mcp').",
      "type": "string"
    },
    "display_name": {
      "default": "",
      "description": "Human-readable name for the Operator service, shown in the community roster (e.g. 'my-service'). If empty, the roster falls back to a truncated npub.",
      "type": "string"
    },
    "authority_proof": {
      "default": "",
      "description": "Identity proof signed by the Authority's OWN npub — the Authority's discretionary consent to adopt this Operator. Apps with the Authority's nsec in their keystore (e.g. the Pricing Studio) produce this proof automatically when the user clicks 'adopt'.",
      "type": "string"
    }
  },
  "additionalProperties": false
}

authority_update_operator

Update an existing Operator's community registry entry. Requires the same two proofs as ``register_operator``: - ``proof`` proves the caller controls the Operator's ``npub``. - ``authority_proof`` proves the Authority's human admin consents to the change. Without the Authority proof, anyone with the Operator's nsec could redirect their own ``service_url`` under this Authority's signature without the Authority's awareness.

Parameters5

npub	string	optional	Nostr npub of the Operator to update.
dpop_token	string	optional
service_url	string	optional	New MCP endpoint URL (leave empty to keep current).
display_name	string	optional	New display name (leave empty to keep current).
authority_proof	string	optional	Identity proof signed by the Authority's OWN npub — the Authority's consent to modify this Operator's registry entry.

Raw schema

{
  "type": "object",
  "properties": {
    "npub": {
      "default": "",
      "description": "Nostr npub of the Operator to update.",
      "type": "string"
    },
    "dpop_token": {
      "default": "",
      "type": "string"
    },
    "service_url": {
      "default": "",
      "description": "New MCP endpoint URL (leave empty to keep current).",
      "type": "string"
    },
    "display_name": {
      "default": "",
      "description": "New display name (leave empty to keep current).",
      "type": "string"
    },
    "authority_proof": {
      "default": "",
      "description": "Identity proof signed by the Authority's OWN npub — the Authority's consent to modify this Operator's registry entry.",
      "type": "string"
    }
  },
  "additionalProperties": false
}

authority_deregister_operator

Remove an Operator from the DPYC community registry. Requires the same two proofs as ``register_operator``: - ``proof`` proves the caller controls the Operator's ``npub``. - ``authority_proof`` proves the Authority's human admin consents to the removal. Without the Authority proof, anyone who knew an Operator's public npub and held its nsec could remove themselves from this Authority's roster without the Authority noticing.

Parameters3

npub	string	optional	Nostr npub of the Operator to deregister.
dpop_token	string	optional
authority_proof	string	optional	Identity proof signed by the Authority's OWN npub — the Authority's consent to remove this Operator from the community registry under its signature.

Raw schema

{
  "type": "object",
  "properties": {
    "npub": {
      "default": "",
      "description": "Nostr npub of the Operator to deregister.",
      "type": "string"
    },
    "dpop_token": {
      "default": "",
      "type": "string"
    },
    "authority_proof": {
      "default": "",
      "description": "Identity proof signed by the Authority's OWN npub — the Authority's consent to remove this Operator from the community registry under its signature.",
      "type": "string"
    }
  },
  "additionalProperties": false
}

authority_get_operator_config

Retrieve operator bootstrap configuration (Neon URL, schema). Gated by Schnorr signature proving ownership of the requested npub.

Parameters2

npub	string	optional	Your Nostr npub (bech32).
dpop_token	string	optional

Raw schema

{
  "type": "object",
  "properties": {
    "npub": {
      "default": "",
      "description": "Your Nostr npub (bech32).",
      "type": "string"
    },
    "dpop_token": {
      "default": "",
      "type": "string"
    }
  },
  "additionalProperties": false
}

authority_operator_status

View registration status, balance summary, and the Authority's Nostr npub. When an explicit ``npub`` is provided, requires a Schnorr proof of ownership — without it, anyone could enumerate balances by walking the community registry. When ``npub`` is empty, falls back to the Authority's own operator identity and skips the proof check (self- inspection is always allowed).

Parameters2

npub	string	optional	Nostr public key (npub1...). Defaults to operator identity if empty.
dpop_token	string	optional

Raw schema

{
  "type": "object",
  "properties": {
    "npub": {
      "default": "",
      "description": "Nostr public key (npub1...). Defaults to operator identity if empty.",
      "type": "string"
    },
    "dpop_token": {
      "default": "",
      "type": "string"
    }
  },
  "additionalProperties": false
}

authority_certify_credits

Certify a purchase order: return a Schnorr-signed Nostr event certificate. The paid_tool decorator handles the ad valorem fee debit and stores the cost in runtime._last_debit_cost. No recomputation needed. Called by operator MCP servers (not end users) when a patron purchases credits.

Parameters3

npub	string	optional	The operator's DPYC npub (from register_operator response).
dpop_token	string	optional
amount_sats	integer	optional	The total purchase amount in satoshis. Must be positive.

Raw schema

{
  "type": "object",
  "properties": {
    "npub": {
      "default": "",
      "description": "The operator's DPYC npub (from register_operator response).",
      "type": "string"
    },
    "dpop_token": {
      "default": "",
      "type": "string"
    },
    "amount_sats": {
      "default": 0,
      "description": "The total purchase amount in satoshis. Must be positive.",
      "type": "integer"
    }
  },
  "additionalProperties": false
}

authority_check_dpyc_membership

Look up an npub in the DPYC community registry.

Parameters1

npub

string

required

Raw schema

{
  "type": "object",
  "properties": {
    "npub": {
      "type": "string"
    }
  },
  "required": [
    "npub"
  ],
  "additionalProperties": false
}

authority_receive_adoption_request

Inbound: record an operator's request to be adopted by this Authority. Called MCP-to-MCP by the operator's ``request_adoption``. Verifies the operator controls ``operator_npub`` (inline Schnorr bound to the adoption sentinel — no relay round-trip), records a durable ``pending`` row, and fires a best-effort owner-notification DM. Does NOT provision — provisioning waits for the owner's ``approve_adoption``.

Parameters3

operator_npub	string	optional	The operator's Nostr npub requesting adoption.
dpop_token	string	optional	Inline kind-27235 proof signed by the operator's nsec, bound to the canonical adoption sentinel. request_adoption mints this automatically.
service_url	string	optional	The operator's MCP endpoint URL.

Raw schema

{
  "type": "object",
  "properties": {
    "operator_npub": {
      "default": "",
      "description": "The operator's Nostr npub requesting adoption.",
      "type": "string"
    },
    "dpop_token": {
      "default": "",
      "description": "Inline kind-27235 proof signed by the operator's nsec, bound to the canonical adoption sentinel. request_adoption mints this automatically.",
      "type": "string"
    },
    "service_url": {
      "default": "",
      "description": "The operator's MCP endpoint URL.",
      "type": "string"
    }
  },
  "additionalProperties": false
}

authority_list_adoption_requests

Owner queue: list pending operator-adoption requests. Restricted to the Authority owner (consent proof). This is the review-on-your-own-time surface the Pricing Studio renders.

Parameters1

authority_proof

string

optional

Proof signed by the Authority's OWN npub (owner consent).

Raw schema

{
  "type": "object",
  "properties": {
    "authority_proof": {
      "default": "",
      "description": "Proof signed by the Authority's OWN npub (owner consent).",
      "type": "string"
    }
  },
  "additionalProperties": false
}

authority_receive_neon_402_alert

Inbound: an operator reports its Neon store is 402-locked. Called MCP-to-MCP by the operator's runtime the instant it catches a Neon HTTP 402 on its own database. Verifies the operator controls ``npub`` (inline Schnorr bound to this tool's wire name), records a durable latest-state row, and fires a best-effort owner-notification DM. This is how the Authority learns the store is dark BEFORE a patron files a complaint.

Parameters3

npub	string	optional	The reporting operator's Nostr npub (the one whose store is locked).
dpop_token	string	optional	Inline kind-27235 proof signed by the operator's nsec, bound to this tool's wire name. The operator's runtime mints and sends this automatically when it catches a Neon 402.
detail	string	optional	Short, credential-free error summary (the Neon 402 message).

Raw schema

{
  "type": "object",
  "properties": {
    "npub": {
      "default": "",
      "description": "The reporting operator's Nostr npub (the one whose store is locked).",
      "type": "string"
    },
    "dpop_token": {
      "default": "",
      "description": "Inline kind-27235 proof signed by the operator's nsec, bound to this tool's wire name. The operator's runtime mints and sends this automatically when it catches a Neon 402.",
      "type": "string"
    },
    "detail": {
      "default": "",
      "description": "Short, credential-free error summary (the Neon 402 message).",
      "type": "string"
    }
  },
  "additionalProperties": false
}

authority_list_neon_alerts

Owner queue: operators that reported a Neon-402 (store locked). Restricted to the Authority owner. A companion to network_persistence_health: this is the reactive list (operators that already went dark); the health tool adds the proactive per-project compute posture.

Parameters1

authority_proof

string

optional

Proof signed by the Authority's OWN npub (owner consent).

Raw schema

{
  "type": "object",
  "properties": {
    "authority_proof": {
      "default": "",
      "description": "Proof signed by the Authority's OWN npub (owner consent).",
      "type": "string"
    }
  },
  "additionalProperties": false
}

authority_network_persistence_health

Owner view: the health of the DPYC economy's accounting store (Neon). Restricted to the Authority owner. Three layers, from most to least proactive: 1. ``projects`` — if a Neon API key is configured (NEON_API_KEY), the per-project compute-quota posture across the org: hours used, %, reset date, and a status ladder (ok/warning/critical/exhausted) so a project can be topped up BEFORE it 402s. ``configured=false`` when no key is present (deliver one to enable the proactive watch). 2. ``own_store`` — reactive self-detection: whether the Authority's OWN database answers, or is itself 402-locked. Always available. 3. ``operator_alerts`` — operators that reported a 402 (from receive_neon_402_alert). Reactive, but immediate.

Parameters1

authority_proof

string

optional

Proof signed by the Authority's OWN npub (owner consent).

Raw schema

{
  "type": "object",
  "properties": {
    "authority_proof": {
      "default": "",
      "description": "Proof signed by the Authority's OWN npub (owner consent).",
      "type": "string"
    }
  },
  "additionalProperties": false
}

authority_approve_adoption

Approve a pending request and provision the operator. The deferred-courtship counterpart to register_operator: same ``authority_proof`` consent, same provisioning effect (``_provision_operator``) — just supplied later, after review.

Parameters2

operator_npub	string	optional	The operator npub to approve and provision.
authority_proof	string	optional	Proof signed by the Authority's OWN npub (owner consent).

Raw schema

{
  "type": "object",
  "properties": {
    "operator_npub": {
      "default": "",
      "description": "The operator npub to approve and provision.",
      "type": "string"
    },
    "authority_proof": {
      "default": "",
      "description": "Proof signed by the Authority's OWN npub (owner consent).",
      "type": "string"
    }
  },
  "additionalProperties": false
}

authority_reject_adoption

Reject a pending operator-adoption request (owner consent).

Parameters3

operator_npub	string	optional	The operator npub to reject.
authority_proof	string	optional	Proof signed by the Authority's OWN npub (owner consent).
reason	string	optional	Optional human-readable reason.

Raw schema

{
  "type": "object",
  "properties": {
    "operator_npub": {
      "default": "",
      "description": "The operator npub to reject.",
      "type": "string"
    },
    "authority_proof": {
      "default": "",
      "description": "Proof signed by the Authority's OWN npub (owner consent).",
      "type": "string"
    },
    "reason": {
      "default": "",
      "description": "Optional human-readable reason.",
      "type": "string"
    }
  },
  "additionalProperties": false
}

authority_repair_operator_schema

Owner repair: reassign every table in an operator's tenant schema to the operator's own role, then re-grant DML. For tenants whose tables were created/owned by the provisioning role — the operator role then cannot CREATE INDEX on them ("must be owner"), which aborts the whole vault bootstrap. Unlike register_operator this does NOT rotate the operator's DB password or re-send the bootstrap DM; it only fixes ownership + grants in place. Idempotent.

Parameters2

operator_npub	string	optional	The operator npub whose tenant-schema ownership to repair.
authority_proof	string	optional	Proof signed by the Authority's OWN npub (owner consent).

Raw schema

{
  "type": "object",
  "properties": {
    "operator_npub": {
      "default": "",
      "description": "The operator npub whose tenant-schema ownership to repair.",
      "type": "string"
    },
    "authority_proof": {
      "default": "",
      "description": "Proof signed by the Authority's OWN npub (owner consent).",
      "type": "string"
    }
  },
  "additionalProperties": false
}

authority_get_adoption_status

Read an operator's adoption-request status (free, no proof). Status (pending/approved/rejected/provisioned) isn't sensitive — it's the operator's own request — so the operator can poll it openly via its ``adoption_status`` tool.

Parameters1

operator_npub

string

optional

The operator npub whose request status to read.

Raw schema

{
  "type": "object",
  "properties": {
    "operator_npub": {
      "default": "",
      "description": "The operator npub whose request status to read.",
      "type": "string"
    }
  },
  "additionalProperties": false
}

authority_register_authority_npub

Step 1/3 of Authority onboarding — send a Nostr DM challenge to the candidate.

Parameters1

candidate_npub

string

required

The Nostr npub of the candidate who wants to become the curator.

Raw schema

{
  "type": "object",
  "properties": {
    "candidate_npub": {
      "description": "The Nostr npub of the candidate who wants to become the curator.",
      "type": "string"
    }
  },
  "required": [
    "candidate_npub"
  ],
  "additionalProperties": false
}

authority_confirm_authority_claim

Step 2/3 of Authority onboarding — verify candidate DM, escalate to parent Authority. The parent Authority is resolved from THIS Authority's own entry in dpyc-community: whatever its ``upstream_authority_npub`` names. For Lonnie-Authority and NorthAmerica that's Prime; for NewEngland it's NorthAmerica; chain depth is transparent.

Parameters1

candidate_npub

string

required

The Nostr npub of the candidate who replied to the DM challenge.

Raw schema

{
  "type": "object",
  "properties": {
    "candidate_npub": {
      "description": "The Nostr npub of the candidate who replied to the DM challenge.",
      "type": "string"
    }
  },
  "required": [
    "candidate_npub"
  ],
  "additionalProperties": false
}

authority_check_authority_approval

Step 3/3 of Authority onboarding — check parent approval, activate Authority.

Parameters1

candidate_npub

string

required

The Nostr npub of the candidate awaiting parent Authority approval.

Raw schema

{
  "type": "object",
  "properties": {
    "candidate_npub": {
      "description": "The Nostr npub of the candidate awaiting parent Authority approval.",
      "type": "string"
    }
  },
  "required": [
    "candidate_npub"
  ],
  "additionalProperties": false
}

README.md4 KBView on GitHub

Tollbooth Authority — North America

Milo drives the Lightning Turnpike — Don't Pester Your Customer

The North American on-ramp to the Lightning turnpike.

Identity: npub1zummm5awn88kw2hz6deeyjprpw0fzuv9rvzrxf3vu453yyqzvdss49xd2t Parent: DPYC Prime Authority (npub1l94pd…mq8pf) Peer Authorities under Prime: tollbooth-authority (Lonnie-Authority) Sub-Authority: tollbooth-authority-newengland Service: https://tollbooth-authority-northamerica.fastmcp.app/mcp Neon region: aws-us-west-2 (Oregon)

A peer-level Authority under DPYC Prime, serving North American operators. Operators may choose this Authority to keep certification latency and audit trails in-region.

The metaphors in this project are drawn with admiration from The Phantom Tollbooth by Norton Juster, illustrated by Jules Feiffer (1961). We just built the payment infrastructure.

Architecture

This repository is a thin consumer of the tollbooth-dpyc wheel's tollbooth.authority extension (wheel ≥ 0.22.1). The entire deployable surface lives in src/tollbooth_authority/server.py (~90 lines): a FastMCP instance, an OperatorRuntime, and two register_*_tools(mcp, runtime) calls. Onboarding state machine, Schnorr signer, replay tracker, Neon tenant provisioning, and the 16 Authority @tool definitions are wheel-resident and shared with every other Authority MCP in the ecosystem.

For the protocol semantics, certificate format (Schnorr/NIP-33 kind 30079), fee cascade, registry enforcement, and tool catalog, see the canonical tollbooth-authority README — this repo is identical in behavior, distinct only in identity, region, and Neon tenant.

Deploy

Two secrets required by Horizon:

Env var	Value
`TOLLBOOTH_NOSTR_OPERATOR_NSEC`	This Authority's nsec
`NEON_DATABASE_URL`	A pooled Neon connection string in `aws-us-west-2`

Everything else — BTCPay credentials for the cashier, operator credential templates — arrives via Secure Courier post-deploy (see docs/how-to-add-authority.md in the community repo).

The DPYC Ecosystem

DPYC is a federation of independent, SSE-based MCP servers sharing one Lightning-funded economy. This Authority certifies operators across the network. Sibling repos:

Core & governance

tollbooth-dpyc — shared Python SDK (crypto, vault, auth, pricing, audit)
dpyc-community — governance registry (members, rulebook, CI validation)
dpyc-oracle — free community concierge (membership, onboarding, tax-rate questions)
tollbooth-authority — canonical certification Authority
tollbooth-sample — reference Operator implementation
tollbooth-pricing-studio — native pricing editor (Swift/iOS)

Operators (paid MCP services)

cypher-mcp — monetized graph answers via named Cypher templates over Neo4j/AuraDB (certified under this Authority)
schwab-mcp — Charles Schwab brokerage data
thebrain-mcp — TheBrain knowledge-graph access
excalibur-mcp — X/Twitter posting
taxsort-mcp — tax classification + Cloudflare Pages UI
optionality-mcp — options analytics

Utilities & advocates

tollbooth-oauth2-collector — shared OAuth2 callback collector
tollbooth-shortlinks — URL shortener

License

Apache-2.0

Install

Tools (68)

authority_check_balanceauthority_purchase_creditsauthority_check_paymentauthority_restore_creditsauthority_account_statementauthority_account_statement_infographicauthority_report_issueauthority_service_status

Remote endpoint

Streamable HTTP

Hosted server - connect over the network, no local install.

url

https://tollbooth-authority-northamerica.fastmcp.app/mcp

Add to VS Code Add to Cursor

claude_desktop_config.json

json

{
  "mcpServers": {
    "tollbooth-authority-northamerica": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://tollbooth-authority-northamerica.fastmcp.app/mcp"
      ]
    }
  }
}

Desktop config is stdio-only; this bridges via mcp-remote. Native remote: Settings > Connectors.