Integrations

Forensics MCP

Seven read-only, proof-carrying tools over the same state authority the Action writes to — and no raw content, ever.

Judge quick test

From a clone of the repository, run:

Shell

uv run --extra mcp python -m examples.judge_mcp_quick_test

This is a fresh protocol run, not saved output. It executes the deterministic pricing agent, creates an ephemeral Ed25519 authority, persists the signed receipt and an impact campaign, then uses the official MCP client to discover and call all seven tools. It needs no credentials and leaves no state behind.

The report explicitly says external_datahub_contacted: false: this command proves the MCP, signature, policy, state, and raw-content boundaries locally. The separate hosted and flagship reports prove the real DataHub write/readback path.

A thin adapter over a neutral service

The logic lives in a protocol-neutral ForensicsService. MCP is a thin adapter that owns no verification, lineage, materiality, approval, or replay policy of its own.

That matters for a specific reason: if the MCP server owned any judgement, an agent querying it could get a different answer than the console or the Action. There is one authority, and three surfaces reading it.

Shell

uv run glassbox-forensics-mcp

The tools

Tool	Answers
`verify_decision_receipt`	Is this receipt intact, signed, and admitted under operator trust?
`get_decision_influence`	What did this decision actually depend on, and how completely do we know?
`get_decision_publication`	What durable DataHub publication obligation and sealed readback evidence exists?
`classify_decision_impact`	If this entity changed, would this decision be affected?
`list_affected_decisions`	Which decisions depend on this entity? A complete reverse scan.
`get_invalidation_campaign`	What did this persisted campaign actually decide, and why?
`list_decision_findings`	What has the Action actually recorded against this receipt?

The last two are deliberately separated from the third. classify_decision_impact is a prospective question answered by the deterministic engine. list_decision_findings returns actual persisted Action findings from the same PostgreSQL state authority. Confusing a prediction with a record is exactly the kind of error this split prevents.

Proof-carrying

Every response carries the evidence for its own claim: contract version, the state authority it read, verification results, and reason codes. A caller never has to take a bare verdict on faith.

Read-only, enforced structurally

Action workers remain the only writers. The MCP process opens the existing schema with initialize_schema=false and exposes read-only operations only.

It cannot create the schema, migrate it, or write to it. That is not a permission setting that could be misconfigured — the code path does not exist.

The raw-content boundary

Every response declares raw_content_returned: false, and that declaration is structural rather than aspirational. The service returns:

Returned

Digests, governed URNs, reason codes, policy versions, verification states, counts, and timestamps.

Never returned

Prompts, model outputs, tool arguments, tool results, field values, credentials, or signing keys.

This is what makes it safe to give an agent access to the forensics surface at all. An agent investigating why a decision went stale does not need to see the data — it needs to see the shape of the dependency and the reason code.

The Action and the MCP server may use the same PostgreSQL schema as their live decision-state authority. That is what lets an agent's answer and the console's answer be the same answer, rather than two independently-derived guesses that drift.

Also available as a Skill