io.github.ndl-systems/kevros

Official9 tools

Kevros — Agentic Identity Trust

Agentic identity trust: precision decisioning, cryptographic release tokens, hash-chained proof

Agentic identity trust with cryptographic tokens and hash-chained proof.

Captured live from the server via tools/list.

verify

Verify an action against policy bounds before executing it. Returns ALLOW (proceed), CONSTRAIN (proceed with modified values; emitted on the wire as the legacy value CLAMP - both refer to the same verdict, CONSTRAIN is the public name), or DENY (stop). Every verification is recorded in a hash-chained provenance ledger. Cost: $0.01 per call.

Parameters (6)

action_typestringrequired
Category of action to verify (e.g. 'deploy', 'trade', 'send_email')
action_payloadobjectrequired
Action parameters to verify against policy bounds
agent_idstringrequired
Unique identifier of the agent requesting verification
policy_contextany
Optional policy overrides such as max_values or forbidden_keys
template_idany
Named policy template (e.g. 'robotics-arm', 'financial-transaction'). Merged with policy_context.
idempotency_keyany
Optional key for idempotent retries - same key returns cached result

attest

Create a hash-chained provenance record for an action you've taken. Each attestation extends the append-only evidence chain. The hash can be independently verified by any third party. Cost: $0.02 per call.

Parameters (4)

agent_idstringrequired
Unique identifier of the attesting agent
action_descriptionstringrequired
Human-readable description of the action taken
action_payloadobjectrequired
Structured data describing the action (hashed into provenance)
contextany
Optional metadata such as environment, trigger, or session info

bind

Declare an intent and cryptographically bind it to a command. Proves that the command was issued in service of the declared intent. Use verify-outcome after execution to close the loop. Cost: $0.02 per call.

Parameters (7)

agent_idstringrequired
Unique identifier of the agent declaring intent
intent_typestringrequired
Category of intent (e.g. 'navigation', 'transaction', 'deployment')
intent_descriptionstringrequired
Human-readable description of what the agent intends to do
command_payloadobjectrequired
The command that will be executed to fulfill this intent
goal_stateany
Expected end state for outcome verification
intent_sourcestring
Origin of intent: AI_PLANNER, HUMAN_OPERATOR, or SYSTEM
parent_intent_idany
ID of parent intent for hierarchical intent chains

verify-outcome

Verify that an executed action achieved its declared intent. Closes the loop: intent -> command -> action -> outcome -> verification. Free (included with bind).

Parameters (5)

agent_idstringrequired
Unique identifier of the agent whose outcome is being verified
intent_idstringrequired
ID of the original intent from governance_bind
binding_idstringrequired
ID of the intent-command binding from governance_bind
actual_stateobjectrequired
Observed end state after action execution, compared against goal_state
tolerancenumber
Numeric tolerance for goal matching (0.1 = 10% deviation allowed)

bundle

Generate a certifier-grade compliance evidence bundle. Contains hash-chained provenance, intent bindings, PQC attestations, and verification instructions. Independently verifiable without Kevros access. Cost: $0.05 per call.

Parameters (7)

agent_idstringrequired
Agent whose provenance records to include in the bundle
time_range_startany
ISO 8601 start time filter (inclusive)
time_range_endany
ISO 8601 end time filter (inclusive)
max_recordsinteger
Maximum number of provenance records to include
include_intent_chainsboolean
Include intent-command binding chains in the bundle
include_pqc_signaturesboolean
Include post-quantum ML-DSA-87 block signatures
include_verification_instructionsboolean
Include step-by-step verification procedure for auditors

health

Check the governance gateway health status. Free.

Parameters (1)

verboseboolean
Return additional details such as chain length and PQC signing status

status

Check your current usage and quota: calls used, calls remaining, tier, rate limits, and billing status. Free.

Parameters (1)

include_chain_detailsboolean
Include hash-chain integrity check and latest provenance epoch

check-peer

Check another agent's trust score and governance history. Returns trust score (0-100), chain length, attestation count, and tier. Free, no API key needed.

Parameters (1)

agent_idstringrequired
ID of the peer agent to look up

verify-token

Verify a release token from another agent. Confirms the token is authentic and was issued by the Kevros gateway. Free, no API key needed.

Parameters (2)

release_tokenstringrequired
Release token string received from governance_verify
token_preimageany
Deprecated. The gateway now performs verification entirely server-side using the release_token alone; any value supplied here is ignored. Field retained for backward compatibility with v1 SDK callers and will be removed in a future release.

Install

claude_desktop_config.json

{
  "mcpServers": {
    "kevros": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://governance.taskhawktech.com/mcp/"
      ]
    }
  }
}

Desktop config is stdio-only; this bridges via mcp-remote. Native remote: Settings > Connectors.