{"name":"SecureStamp Action Proof — Public Beta","description":"Proves the chain from a device-signed request to an exact customer-Guardian execution.","endpoint":"https://mcp.securestamp.online/mcp","auth":{"modes":["oauth","api_key","delegated_login"],"header":"Authorization: Bearer <OAuth access token | ss_live_... | ss_sess_...>"},"doctrine":"SecureStamp Cloud never holds provider credentials or executes the provider operation.","warning":"Public Beta — sandbox/test by default. Production opt-in requires a customer-controlled Guardian and signed local policy; the customer accepts responsibility. SecureStamp cannot prevent out-of-band provider actions.","tools":[{"name":"authorize_action","description":"Ask SecureStamp for an Action Verdict before a sensitive digital action. Authorizes only; never executes the action.","inputSchema":{"type":"object","additionalProperties":false,"required":["actionType"],"properties":{"actionType":{"type":"string","enum":["payment_request","bank_account_change","monetary_operation_change","credential_request","mfa_code_request","risky_attachment","support_contact","software_install","document_upload","crypto_transfer","identity_verification_request","unknown_sensitive_action"]},"counterparty":{"type":"string","maxLength":255},"sourceChannel":{"type":"string","enum":["email","whatsapp","telegram","url","document"]},"sourceMessageHash":{"type":"string","maxLength":128},"signals":{"type":"object","additionalProperties":true},"amount":{"type":"number","minimum":0},"currency":{"type":"string","minLength":3,"maxLength":3},"targetInstruction":{"type":"object","additionalProperties":false,"required":["rail","accountRef"],"properties":{"rail":{"type":"string","enum":["bank_transfer","wire","ach","iban","swift","wallet","crypto","payment_link","other"]},"accountRef":{"type":"string","minLength":1,"maxLength":512}}},"evidence":{"type":"array","maxItems":20,"items":{"type":"string","maxLength":200}},"requestFingerprint":{"type":"string","pattern":"^req_v1:[a-f0-9]{64}$"}}}},{"name":"analyze_message_intent","description":"Map abstract message signals to sensitive action intents. Signals only; do not send raw message text.","inputSchema":{"type":"object","additionalProperties":false,"required":["signals"],"properties":{"signals":{"type":"object","additionalProperties":true}}}},{"name":"verify_counterparty","description":"Check whether a counterparty or sender matches the API-key tenant registry. Returns registry facts only.","inputSchema":{"type":"object","additionalProperties":false,"required":["counterparty"],"properties":{"counterparty":{"type":"string","minLength":1,"maxLength":255},"sourceChannel":{"type":"string","enum":["email","whatsapp","telegram","url","document"]},"sender":{"type":"object","additionalProperties":true}}}},{"name":"create_action_challenge","description":"Create a manual dual-control Action Challenge for a known counterparty. Does not send email or execute actions.","inputSchema":{"type":"object","additionalProperties":false,"required":["counterpartyId","actionIntent"],"properties":{"counterpartyId":{"type":"string","minLength":1,"maxLength":120},"actionIntent":{"type":"string","enum":["payment_request","bank_account_change","monetary_operation_change","credential_request","mfa_code_request","risky_attachment","support_contact","software_install","document_upload","crypto_transfer","identity_verification_request","unknown_sensitive_action"]},"receiptId":{"type":"string","maxLength":120},"displayMask":{"type":"string","maxLength":64},"requestFingerprint":{"type":"string","pattern":"^req_v1:[a-f0-9]{64}$"}}}},{"name":"get_safe_next_step","description":"Compute the Safe Next Step from already-known registry and action facts. Authorizes guidance only.","inputSchema":{"type":"object","additionalProperties":false,"required":["actionType"],"properties":{"actionType":{"type":"string","enum":["payment_request","bank_account_change","monetary_operation_change","credential_request","mfa_code_request","risky_attachment","support_contact","software_install","document_upload","crypto_transfer","identity_verification_request","unknown_sensitive_action"]},"confidence":{"type":"number","minimum":0,"maximum":1},"evidence":{"type":"array","maxItems":20,"items":{"type":"string","maxLength":96}},"channelFact":{"type":"string","enum":["PERTENECE","NO_PERTENECE","COUNTERSTAMP","UNKNOWN","DISPUTED"]},"sourceChannel":{"type":"string","enum":["email","whatsapp","telegram","sms","any"]},"counterpartyId":{"type":"string","maxLength":120},"instructionMatch":{"type":"string","enum":["matched","mismatch","unknown"]}}}},{"name":"issue_action_receipt","description":"Re-affirm a SecureStamp Action Receipt already computed and signed by authorize_action (or a resolved Action Challenge), by its receiptId. SecureStamp never signs a caller-declared verdict — this returns only the exact receipt it already computed, after verifying it belongs to the caller’s tenant.","inputSchema":{"type":"object","additionalProperties":false,"required":["receiptId"],"properties":{"receiptId":{"type":"string","minLength":1,"maxLength":64},"detectedIntent":{"type":"string","enum":["payment_request","bank_account_change","monetary_operation_change","credential_request","mfa_code_request","risky_attachment","support_contact","software_install","document_upload","crypto_transfer","identity_verification_request","unknown_sensitive_action"]}}}},{"name":"request_execution_grant","description":"Request a single-use grant for one exact, device-sourced effect. SecureStamp never executes the provider operation.","inputSchema":{"type":"object","additionalProperties":false,"required":["effect","sourceEnvelopeJws","gatewayId","authority"],"properties":{"effect":{"type":"object","additionalProperties":true},"sourceEnvelopeJws":{"type":"string","minLength":32,"maxLength":20000},"gatewayId":{"type":"string","minLength":1,"maxLength":160},"authority":{"type":"string","enum":["policy_delegated","human_mfa","quorum"]},"policyVersion":{"type":"string","minLength":1,"maxLength":80}}}},{"name":"get_execution_status","description":"Read the tenant-scoped status and receipt reference for a customer-controlled execution grant.","inputSchema":{"type":"object","additionalProperties":false,"required":["grantJti"],"properties":{"grantJti":{"type":"string","minLength":1,"maxLength":160}}}},{"name":"get_source_envelope","description":"Read the latest tenant-scoped signed source envelope from an enrolled Gmail device. The envelope contains no message body; use its JWS and digest when requesting an exact execution grant.","inputSchema":{"type":"object","additionalProperties":false,"required":[],"properties":{}}}],"scopes":["openid","offline_access","profile","email"],"capabilityClaim":"urn:securestamp:mcp_access","capabilityProfiles":["inspect","execute"],"docsUrl":"https://securestamp.org/en/docs/action-proof","support":"support@securestamp.online","limits":"Tool calls are tenant-scoped, rate-limited and audited. Grants require device_signed plus MFA or quorum. Production is never inferred from credentials and requires explicit opt-in controls."}