Inquire +

ALEETH Authority · com.aleeth/authority-mcp

The first MCP that cannot act without permission.

Other MCP servers expose tools. This one governs them. Every call is risk-checked by Rail Guard before it runs and sealed with a signed L7 receipt after. Denied and halted calls never execute. Anonymous POST returns 401. That is the product, not an error.

Open the live door POST /mcp healthz unread

Tools

51

26 read · 16 write · 9 control

Registry

com.aleeth/​authority-mcp

version 1.1.0

Endpoint

mcp.aleeth.com/mcp

Streamable HTTP · TLS

Auth

OAuth 2.0

anonymous POST returns 401

What it actually does

Gate the call. Seal the result. Stop the agent.

Rail Guard

Before the act

Every tool call is intercepted, risk-scored per principal, and authorized before it reaches a sensitive system. Quarantine latches until human review. Nothing waits out its own containment.

L7 receipt

After the act

Successful work executes only inside a live ICA governance context. The receipt attests to the payload delivered, not a summary. What the auditor reads is what the agent received.

Fail closed

Or nothing returns

If governance cannot run, the call does not complete. A refusal is a DENIED receipt. There is no silent pass, and no fabricated seal.

The catalog · 51 tools · v1.1.0

Not a wrapper. A control surface.

This list matches the live door at mcp.aleeth.com, 51 tools, as of 2026-09-08. The public interface repository is generated from production so a caller can verify names and schemas without source access.

Containment

Stop a live agent. Hold it. Release only on purpose.

04

  • stop_agent Halt a running agent through ICA. Next steps quarantine at ingest.
  • release_agent Lift containment so a halted agent can run again. Deliberate, receipted.
  • list_active_halts Agents currently halted, with reasons. Read-only.
  • simulate_governed_call Dry-run a tool call. Verdict, scope, risk. No side effect.

Evidence

Write a receipt. Verify a receipt. Walk the chain.

05

  • issue_receipt Attest a statement to the L7 ledger. Signed, verifiable.
  • verify_receipt Recompute the hash and check the Ed25519 signature on one receipt.
  • verify_receipt_chain Walk the full hash-chained lineage, every link, every signature.
  • get_ledger_entries Read L7 evidence entries, optionally by entity and period.
  • run_l7_audit Standing self-audit: chain head, hash-chain integrity, live.

Payments

Money moves only through the Payments Assurance Fabric.

01

  • execute_governed_payment Authorize an agentic payment. Genome pre-check, Rail Guard, signed AIR. A refusal is a DENIED receipt, never a fabricated seal.

Academy and roster

Intake, graduate, equip. Fail closed on anything ungoverned.

08

  • intake_recruit Mint a did:web identity and run Academy intake. Fail closed.
  • graduate_agent Graduate a qualified recruit into the official agent registry.
  • equip_agent Equip an Academy-Governed graduate with a registry skill or tool.
  • get_academy_file Read a graduate file by DID: identity, training, equipment, seals.
  • get_agent_registry Academy-Governed graduates, keyed by immutable did:web.
  • list_skills_and_tools Academy registry: every skill and tool, six ICA dimensions.
  • get_catalog_entry One skill or tool: clearance, domains, signed attestation.
  • get_capability_matrix Agent-by-skill-by-tool control surface with per-status counts.

Authority

What an agent may do, what it did, what it tried outside the grant.

03

  • get_agent_scope Authority scope granted to one agent identity.
  • get_authority_uses Authorized actions agents took, for a customer.
  • get_authority_violations Actions attempted outside granted authority.

Incidents

Triage, contain, close, disclose. The ledger refuses a skip.

05

  • triage_incident Open the lifecycle: named accountable person and severity.
  • contain_incident Advance to containment with a documented action.
  • close_incident Close only when every required phase is sealed.
  • disclose_incident Record the disclosure decision, or a documented determination not to.
  • get_incident_lifecycle Full lifecycle: phase, owner, TTP clock, sealed phases.

Findings and rules

Disposition is a write. Every write is receipted.

06

  • ratify_finding Accept a finding as real and record the fix plan.
  • dismiss_finding Dismiss as a false positive, with the reason recorded.
  • escalate_finding Escalate for deeper review.
  • suppress_finding Time-boxed suppress until a date.
  • approve_rule_candidate Promote a proposed compliance rule to active.
  • reject_rule_candidate Reject a proposed rule. Governed write.

ATC

The sensor plane: health, coverage, incidents, raw signals.

05

  • get_atc_overview Health, coverage, recent incidents, and raw signals in one call.
  • get_atc_health Is the sensor polling loop alive and ticking.
  • get_atc_coverage Which sensors are reporting and healthy.
  • get_atc_incidents Recent ATC incidents raised by the sensors.
  • get_atc_signals Recent raw signals, before they correlate into incidents.

Posture

Trust score, fingerprint, frameworks, governed APIs.

04

  • get_trust_score Ledger-derived trust score, 0 to 1000, and band.
  • get_governance_fingerprint One snapshot: trust, operations, coverage, drift.
  • list_frameworks Regulatory frameworks ICA maps to, with coverage.
  • list_governed_apis External APIs an agent may use, each with policy.

Astra plane

Task contracts, holds, payments, downstream proxy. Live on mcp.aleeth.com.

10

  • get_task_contract Read a task contract. Bound purpose, not an open session.
  • open_task_contract Open a task contract. Governed write.
  • list_holds Holds currently latched, awaiting human review.
  • approve_hold Approve a hold so the act may proceed. Two-person where required.
  • reject_hold Reject a hold. The act does not run.
  • get_payment_case Read a governed payment case.
  • request_destination_change Request a destination change. Review before the rail moves.
  • reconcile_payment_intent Reconcile a payment intent against what actually moved.
  • lift_payment_freeze Lift a payment freeze. Deliberate, receipted.
  • proxy_downstream_tool Proxy a downstream tool through Rail Guard. No bypass.

Connect

Point a host at the gate.

Streamable HTTP. TLS only. OAuth 2.0 bearer. Discovery per RFC 9728. Anonymous POST returns 401. Read-only evaluation credentials on request. You do not fork your stack. You put a gate in front of one MCP host and one consequential tool class.

# Live door
https://mcp.aleeth.com/

# Remote MCP · production
https://mcp.aleeth.com/mcp

# Discovery
https://mcp.aleeth.com/.well-known/oauth-protected-resource

# Registry
com.aleeth/authority-mcp

The contract

No receipt, no tool.

Fail closed.
If Rail Guard cannot decide, or the receipt cannot be written, the call does not return a result. Ambiguity is not authorization.
Before and after.
Intent is recorded before a side effect. A signed L7 receipt is sealed after. A crash leaves a trail, not a hole.
Per principal.
Risk is scored by the authenticated caller. No shared pools. No diluted attribution.
Signed, chained, immutable.
Ed25519. Canonical JSON. Hash-chained sequence. A hash without a signature is a note, not an attestation.

Proof, not a scan

Verify the running server yourself.

None of this requires permission from ALEETH or access to the source. Publication is not a precondition for verification.

  1. 01

    The live door is public

    Open mcp.aleeth.com. The catalog, the connect block, and healthz are there without a token. POST /mcp without a bearer is 401. That refusal is the product.

  2. 02

    Protocol grade A

    Independent spec check against the live endpoint: 7 pass, 0 fail, 1 warn. Re-verified 2026-07-24. Read-only credentials: [email protected].

  3. 03

    Receipts verify in public

    Any receipt hash from a governed call verifies at the public verifier, and offline against the published trust anchor, with zero calls back to us.

  4. 04

    Interface cannot drift

    The tool manifest in the public interface repository is generated from production. Fifty-one tools, names, descriptions, input schemas. Implementation stays private. Verification does not.

Live door Public interface repo Verify a receipt The full proof surface Gate a tool in a day

The 2026-07-28 specification

The spec removed the session. It did not remove the accountability.

On 28 July 2026 the Model Context Protocol went stateless: no initialize handshake, no session identifier, no server-held session state. The blast radius at the protocol layer shrank. The responsibility at the implementation layer grew. ALEETH Authority was already running that contract in production, published in the official registry, independently graded A. Of the reachable servers in the registry at that scan, it was the only one ready. It is still the only one governed.

AI has met its match. Truth.

Request evaluation credentials.

Read-only access to the live Authority MCP. No demo wall. Bring one host and one consequential tool class. Leave with a receipt you verified yourself.

Open mcp.aleeth.com Request credentials Inquire