mcpField
F
ForgingStack Mandate Check

ForgingStack Mandate Check

Local
github.com/jdkabattlesSecurity0Updated 1w ago
Repository

About ForgingStack Mandate Check

ForgingStack Mandate Check is a public MCP client for agents that need to verify whether an action fits an issued mandate. It checks agent, principal, expiry, and allowed actions, then returns a reason and hash-chained receipt; the decision service runs separately.

Key features

  1. 01Checks agent and principal identity
  2. 02Validates mandate expiry
  3. 03Checks allowed actions
  4. 04Returns reasons and chained receipts
  5. 05Manages credits and agent keys

Use cases

  1. 01Checking authority before an agent acts
  2. 02Reviewing why a mandate check passed or failed
  3. 03Allocating and revoking agent sub-keys

MCP support

The stdio MCP server exposes `check_mandate`, `get_credits`, and `get_receipt`. It calls ForgingStack's hosted service, which requires an API key and credits.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "jdkabattles-forgingstack-mandate-check": {
      "command": "uvx",
      "args": [
        "forgingstack-mandate-check"
      ],
      "env": {
        "FORGINGSTACK_API_BASE": "<FORGINGSTACK_API_BASE>",
        "FORGINGSTACK_API_KEY": "<FORGINGSTACK_API_KEY>"
      }
    }
  }
}
Run commanduvx forgingstack-mandate-check
Environment variables to set
FORGINGSTACK_API_BASEMandate Check API base URL. Live default.
FORGINGSTACK_API_KEYSecretAPI key for Mandate Check. Sign up via POST /v1/signup (key shown once).

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
pypiforgingstack-mandate-check0.2.1

Tools

3

Saved tool list · updated 1w ago

ParameterTypeRequiredDescription
actionstringYes
mandateobjectYes
mandate.scopestringNo
mandate.agent_idstringYes
mandate.principalstringYes
mandate.expires_atstringYes
mandate.allowed_actionsarrayYes
agent_idstringYes
principalstringYes
idempotency_keystringNo

Details

From the project README

ForgingStack Mandate Check

Before your agent acts, check its mandate. One call, one receipt.

mcp-name: io.github.jdkabattles/forgingstack-mandate-check

This is the public client for Mandate Check. The service itself — the decision logic, the receipt chain, the key store, and billing — runs on ForgingStack's private service and is not in this repo. Copying this repo does not give you the service: you still need an API key and credits, from signup below.

Live API: https://forgingstack-mandate-check.jkbattles.workers.dev

What it checks, in order

  1. Mandate agent matches the calling agent
  2. Mandate principal matches the principal the agent acts for
  3. Mandate expiry is parseable and in the future
  4. Action is in the mandate's allowed actions

Pass or fail, you get a reason and a hash-chained receipt.

What it does not do: decide if an action is wise, legal, or safe. Mandate fit only.

Signup (v1)

curl -X POST https://forgingstack-mandate-check.jkbattles.workers.dev/v1/signup \
  -H "Content-Type: application/json" \
  -d '{"email":"[email protected]"}'

Returns an API key once and 100 starter credits. Save the key immediately — it is stored only as a hash and cannot be shown again. Email verification is pending, and credit-pack billing is not live yet, so do not expect a purchase flow in v1.

Agent sub-keys

A signed-up human creates a key for each agent, capped and revocable:

curl -X POST https://forgingstack-mandate-check.jkbattles.workers.dev/v1/keys \
  -H "X-API-Key: YOUR_PRIMARY_KEY" -H "Content-Type: application/json" \
  -d '{"agent_name":"my-agent","credits":20}'

List with GET /v1/keys, revoke with DELETE /v1/keys/{id} — revoking returns unused credits to the primary account.

Use it (MCP, stdio)

Set the key, then run the MCP server in this repo:

export FORGINGSTACK_API_KEY="your-key-here"
python -m app.mcp_server

Tools: check_mandate, get_credits, get_receipt. See SKILL.md for when to use it and when not to.

Price

1 credit per check call. A failed decision still costs 1 credit — the check was performed. An idempotent replay (same Idempotency-Key) is free and returns the original receipt.

Files in this repo

  • app/mcp_server.py — MCP wrapper client (stdio, stdlib only)
  • SKILL.md — when to use it, how to read pass/fail
  • agent-card.json — A2A-style discovery card
  • server.json — MCP Registry metadata (draft until PyPI publish)
  • pyproject.toml — package metadata for the MCP client

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.