# Tool coverage

signafAIde records the tool calls that go through it. Two things make that cover what an agent can do, and let an auditor see where it does not:

- **The gateway** sits in front of an MCP server and records every tool call that passes through it. Nobody has to wrap each tool.
- **The tool list** is a signed statement, in the agent's own chain, of the tools the agent has and which of them are recorded. The verifier, the console and the auditor view show it.

## The gateway

Put `signafaide gateway --` in front of the command that starts an MCP server. Where the agent's MCP settings said:

```json
{ "command": "npx", "args": ["-y", "@acme/payments-mcp"] }
```

write:

```json
{ "command": "npx", "args": ["-y", "signafaide", "gateway", "--agent", "claims-bot", "--", "npx", "-y", "@acme/payments-mcp"] }
```

The agent talks to the gateway exactly as it talked to the server. For every tool call the gateway writes a signed `decision` before it forwards the call, and an `outcome` when the answer comes back, including errors, a cancelled call and a server that stops mid-call. It also writes the server's tool list as the agent's tool list.

| Option | What it does |
|---|---|
| `--agent <name>` | the agent whose chain the records join |
| `--strict` | wait for the witness's receipt before each call is forwarded |
| `--strict-tools a,b` | the same, for the named tools only |
| `--name-prefix <text>` | put a prefix on recorded tool names, for an agent with several servers |
| `--store-content` | send inputs and outputs to the service, encrypted (Team); hash-only without it |

- **Fail closed.** A call that cannot be recorded is not run: the agent gets an error that says so.
- **Local first.** Like the SDK, the gateway sends nothing until the project has run `signafaide init` or has an API key.
- **Remote servers.** The gateway wraps a command. For a server reached over HTTP, wrap a stdio bridge such as `mcp-remote`: `signafaide gateway -- npx -y mcp-remote https://mcp.example.com/mcp`.

## The tool list

For tools that are not MCP tools, the SDK writes the tool list:

- `wrap_tools` (Python) and `wrapTools` (TypeScript), and the framework adapters, declare the tools they wrap as recorded.
- `declare_tools` and `declareTools` take the agent's full tool list. A tool the SDK has wrapped is declared as recorded; any other is declared as not recorded.

```python
import signafaide

signafaide.declare_tools(["retrieve_claim", "fraud_score", "approve_payout", "send_notification"])
```

```ts
import { declareTools } from "signafaide";

declareTools(["retrieve_claim", "fraud_score", "approve_payout", "send_notification"]);
```

The list is written as signed notes in the agent's chain: one that starts the list and one for each tool. Only tool names are in them, so it works for hash-only records. They are ordinary records and count towards the plan's records. The list is written again when the tools change. A program that stops drops out of the list within 24 hours.

## What an auditor sees

`signafaide verify` adds one or two lines for each agent, under the twelve checks:

```text
coverage: claims-bot: all 4 declared tools are recorded
```

```text
coverage: claims-bot: 1 declared tool is not recorded: send_notification
coverage: claims-bot: 1 recorded tool is not in the declared tool list: refund
```

```text
coverage: claims-bot: no tool list was declared, so the pack cannot show which of the agent's tools are recorded
```

Coverage never fails a check: it is a statement to read, not a pass or a fail. The console shows the same on each agent's page, the auditor view has it for every agent in the link, and a verification report has a "Tool coverage" line.

## What it proves, and what it does not

- The tool list is the agent's own statement, signed with its key and fixed in time like every record. It shows what the program said its tools were.
- The gateway records every call that goes through it. A call the application makes around it is still not recorded, so the deployment has to make the gateway the only route to those tools: for example, only the gateway holds the credentials of the server behind it.
- A tool the program never declared does not appear. Records are evidence, not certification.