Tool coverage

signafAIde records the tool calls that go through it. Two things make that cover what an agent can do, and let an auditor see where it does not:

• The gateway sits in front of an MCP server and records every tool call that passes through it. Nobody has to wrap each tool.
• The tool list is a signed statement, in the agent's own chain, of the tools the agent has and which of them are recorded. The verifier, the console and the auditor view show it.

The gateway #

Put signafaide gateway -- in front of the command that starts an MCP server. Where the agent's MCP settings said:

{ "command": "npx", "args": ["-y", "@acme/payments-mcp"] }

write:

{ "command": "npx", "args": ["-y", "signafaide", "gateway", "--agent", "claims-bot", "--", "npx", "-y", "@acme/payments-mcp"] }

The agent talks to the gateway exactly as it talked to the server. For every tool call the gateway writes a signed decision before it forwards the call, and an outcome when the answer comes back, including errors, a cancelled call and a server that stops mid-call. It also writes the server's tool list as the agent's tool list.

• Fail closed. A call that cannot be recorded is not run: the agent gets an error that says so.
• Local first. Like the SDK, the gateway sends nothing until the project has run signafaide init or has an API key.
• Remote servers. The gateway wraps a command. For a server reached over HTTP, wrap a stdio bridge such as mcp-remote: signafaide gateway -- npx -y mcp-remote https://mcp.example.com/mcp.

The tool list #

For tools that are not MCP tools, the SDK writes the tool list:

• wrap_tools (Python) and wrapTools (TypeScript), and the framework adapters, declare the tools they wrap as recorded.
• declare_tools and declareTools take the agent's full tool list. A tool the SDK has wrapped is declared as recorded; any other is declared as not recorded.

import signafaide

signafaide.declare_tools(["retrieve_claim", "fraud_score", "approve_payout", "send_notification"])

import { declareTools } from "signafaide";

declareTools(["retrieve_claim", "fraud_score", "approve_payout", "send_notification"]);

The list is written as signed notes in the agent's chain: one that starts the list and one for each tool. Only tool names are in them, so it works for hash-only records. They are ordinary records and count towards the plan's records. The list is written again when the tools change. A program that stops drops out of the list within 24 hours.

What an auditor sees #

signafaide verify adds one or two lines for each agent, under the twelve checks:

coverage: claims-bot: all 4 declared tools are recorded

coverage: claims-bot: 1 declared tool is not recorded: send_notification
coverage: claims-bot: 1 recorded tool is not in the declared tool list: refund

coverage: claims-bot: no tool list was declared, so the pack cannot show which of the agent's tools are recorded

Coverage never fails a check: it is a statement to read, not a pass or a fail. The console shows the same on each agent's page, the auditor view has it for every agent in the link, and a verification report has a "Tool coverage" line.

What it proves, and what it does not #

• The tool list is the agent's own statement, signed with its key and fixed in time like every record. It shows what the program said its tools were.
• The gateway records every call that goes through it. A call the application makes around it is still not recorded, so the deployment has to make the gateway the only route to those tools: for example, only the gateway holds the credentials of the server behind it.
• A tool the program never declared does not appear. Records are evidence, not certification.