74 tools for agent governance — trust ratings, postures, escalation rules — with three entry tools that work with no credential at all.
LABSCO SUMMARY
Anyone can publish a score. Signing the scorecard and shipping a verification tool means a third party can check that the rating came from Mnemom and has not been altered — which is the whole basis for a trust system that other agents could rely on. The GDPR cascade on agent deletion is the other detail that suggests this was designed for real deployment rather than demo. Note the authorisation notes in the tool descriptions themselves: most governance writes require org_admin or org_owner.
Mnemom's endpoint, which lists 74 tools without authentication and identifies itself as Mnemom API 2.0.0. It is a trust plane for agents: identity, ratings, governance postures and the machinery for escalating when something goes wrong.
A bearer JWT or an API key header for anything that acts. The tool list is public and the three entry tools answer anonymously.
Paste a URL with a key — add the endpoint to your client
USE CASES
Scan it and verify the returned scorecard's signature rather than trusting the number.
Claim it into your organisation so its actions are accountable to someone.
Create it, assign it to a team, and diff revisions when it changes.
Acknowledge it with the action taken, or dismiss it with a reason — both recorded.
Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.
acknowledge_governance_signalAcknowledge a governance signal — Records the actor + timestamp on the signal row. Captures acknowledged_actor_role per ADR-046 audit-actor model. Authorized: org_admin, org_owner, or team_admin grant for the signal's team.
assign_postureAssign a posture to a team — Sets the team's active posture. One active posture per team. Authorized: org_admin / org_owner / team_admin.
claim_agentClaim a verifiable identity — bind an agent to your organization so its trust and accountability record is provably yours. No human in the loop.
clone_postureClone a posture into an org — Copies the posture and its current revision into the target org's scope. Authorized: org_admin / org_owner of the destination org.
create_api_keyCreate a personal API key — Mints a new personal API key. The full secret is returned in the key field — capture it now, it is not retrievable again. Scopes use the capability-based vocabulary (ADR-049); the default scope set is ["gateway", "api:read", "api:write"].
create_governance_destinationCreate a notification destination — Authorized: org_admin or org_owner.
create_governance_escalation_ruleCreate an escalation rule — Authorized: org_admin or org_owner.
create_postureCreate a posture — Authorized: org_admin / org_owner for org-scope; platform admins for platform-scope.
create_webhook_endpointCreate a webhook endpoint — Create a new webhook endpoint for the organization. Returns the signing secret (shown only once). Maximum 5 endpoints per organization.
delete_agentDelete agent (GDPR Art. 17 cascade) — Tombstone an agent and asynchronously cascade deletion across all agent-owned records (traces, integrity checkpoints, drift alerts, reclassifications, etc.) per ADR-021.
delete_governance_destinationDelete a notification destination — Authorized: org_admin or org_owner.
delete_governance_escalation_ruleDelete an escalation rule — Authorized: org_admin or org_owner.
delete_postureSoft-delete a posture — Sets deleted_at; revisions retained for audit.
delete_webhook_endpointDelete webhook endpoint — Permanently delete a webhook endpoint and all its delivery history.
diff_posture_revisionsStructural diff between two revisions
dismiss_governance_signalDismiss a governance signal as not actionable
dojo_bindBind one of your agents to a Dojo Try-Me config so it can spar in the Dojo — links the agent to the config by id. Owner-only: you must be a member of the agent's organization (the same per-agent gate as publishing its alignment card). Idempotent.
get_agentLook up an agent's public identity and trust state by ID — the accountable record other agents and humans can rely on.
get_alignment_by_agentGet this layer's alignment manifest — Returns the agent-scope alignment spec as authored. Response is content-negotiated — YAML by default, or JSON with Accept: application/json. Pass ?include_composition=true to include the _composition metadata block describing which scopes were merged.
get_deletion_statusPoll the status of a pending agent deletion — Returns the most-recent deletion_request row for the agent. Status progresses: tombstoned → phase_N_complete → kv_cleared → pseudonymized → complete (or failed at any phase).
get_dojo_receiptIssue the signed completion receipt for a finished Dojo run. — PUBLIC — the session_id is the credential (a shareable permalink).
get_governance_signalGet a single governance signal by ID
get_integrity_scoreCompute an AI agent's AAP integrity score — a technical reliability metric derived from the agent's own verified checkpoint history.
get_my_personal_orgReturn your personal organization, provisioning it if one does not yet exist (idempotent ensure-exists — repeat calls return the same org and never create a second). just_provisioned reports whether this call created it.
get_org_agentsList agents in organization
get_postureRead a posture's current revision
get_protection_by_agentGet this layer's protection manifest — Returns the agent-scope protection spec as authored. Response is content-negotiated — YAML by default, or JSON with Accept: application/json.
get_reputationLook up an AI agent's published Trust Rating — Mnemom's portable reliability signal for autonomous software, computed from the agent's own verified activity record. Returns the rating plus the technical factors behind it. Free, public, read-only: every registered agent's rating is published by standard (the visibility field is the reputation-publication axis, distinct from identity-record visibility).
get_risk_historyRead an AI agent's risk-assessment history — the chronological trail of risk evaluations and correction events on that agent. AUTHENTICATED, private: requires a Bearer/API-key credential and is owner-scoped (anon → 401; an authenticated non-owner → 404; the authenticated owner → 200). This is NOT a public signal — for the free, public accountability read use get_reputation / verify_reputation (an agent's published Trust Rating).
get_startedZero-auth, no-args orientation: who Mnemom is, the surface map, how to authenticate and what it unlocks, and the value tools to try right now (headlining scan_trust + the reputation reads).
get_teamGet team by ID — Retrieve a team and its current members.
get_team_sideband_coverageSideband finding coverage rollup for a team — Per-source counts over a window. Operator-facing.
get_webhook_delivery_logGet webhook delivery log — Paginated delivery log for the organization. Optionally filter by endpoint_id.
get_webhook_endpointGet webhook endpoint details — Get details for a single webhook endpoint. Signing secret is not included.
grant_team_adminGrant team-admin role to a user — Authorized: org_admin / org_owner.
list_agent_governance_signalsList governance signals affecting a specific agent — Returns governance signals whose agent_ids array contains the given agent. Operator dashboard's per-agent slice. Any org member of the agent's org may read.
list_agentsList your agents — List all agents owned by the authenticated user. Supports pagination.
list_api_keysList active API keys
list_governance_destinationsList notification destinations for an org
list_governance_escalation_rulesList escalation rules for an org
list_my_orgsList organizations for authenticated user
list_org_governance_signalsList governance signals for an org — Returns governance signals scoped to the given org, filterable by source, severity, status, and pattern_type. Any org member may read.
list_org_teamsList teams in organization — List all teams belonging to an organization, filtered by status.
list_posture_revisionsList all revisions of a posture
list_posturesList postures — Returns platform-default postures plus, when org_id is supplied, the org's postures. Soft-deleted postures excluded by default.
list_team_adminsList team-admin grants — Returns users with team-admin role on this team.
list_team_governance_signalsList governance signals for a team — Returns governance signals scoped to the given team. Authorized to any member of the team's org.
list_webhook_endpointsList webhook endpoints — List all webhook endpoints for the organization. Signing secrets are not included.
preview_compose_alignment_by_agentPreview composed alignment (dry run) — Composes the cascade against a hypothetical body at the agent layer and returns conflicts + the composed view. No DB writes. Used by the dashboard editor for live conflict markers.
preview_compose_posturePreview the composition this posture would produce for a team — Composes alignment + protection cards using the posture body, the team's templates, and per-agent exemptions, without persisting. Useful for diff'ing before assigning.
preview_compose_protection_by_agentPreview composed protection (dry run) — Composes the cascade against a hypothetical body at the agent layer and returns conflicts + the composed view. No DB writes. Used by the dashboard editor for live conflict markers.
put_alignment_by_agentPublish or replace the alignment manifest — Accepts YAML (text/yaml, application/yaml) or JSON. Body is the full UnifiedAlignmentCard; server-side composition merges it across the platform → org → team → agent cascade and writes the canonical composed card. Requires Idempotency-Key.
put_postureWrite a new revision of a posture (forward-only) — Creates a new immutable revision; updates current_revision_id pointer.
put_protection_by_agentPublish or replace the protection manifest — Accepts YAML (text/yaml, application/yaml) or JSON. Body is the full UnifiedProtectionCard; server-side composition merges it across the platform → org → team → agent cascade and writes the canonical composed card. Requires Idempotency-Key.
query_tracesQuery traces with filters
redeliver_webhook_eventRedeliver a webhook event — Create a new delivery attempt for a previously failed event. A new delivery row is created with next_attempt_at set to now.
replay_webhook_eventReplay a webhook event to its eligible endpoints — Re-dispatches a previously recorded webhook event to all org endpoints subscribed to its event_type (or to the explicit subset supplied in the request body).
report_recipe_fn_fpSubmit a false-positive / false-negative correction for one of Mnemom's automated detection rules (a 'recipe') — technical feedback that improves detection accuracy, like filing a bug report against a spam filter.
resolve_governance_signalResolve a governance signal — Closes the signal with a resolution_status and optional action_taken note. Authorized: org_admin, org_owner, or team_admin.
revoke_api_keyRevoke an API key
revoke_team_adminRevoke a team-admin grant — Authorized: org_admin / org_owner.
rotate_api_keyRotate a personal API key — Atomically mints a replacement key with the same name and scopes as the original, then immediately revokes the old key. The full new secret is returned in the response — this is your only chance to capture it.
rotate_webhook_secretRotate webhook signing secret — Generate a new signing secret for the endpoint. The new secret is returned once. Previous secret is immediately invalidated.
scan_trustScan a website's agent-trust-readiness and return a signed scorecard (Trust, plus an Access axis on newer rubrics). Zero-auth. Results are CACHED for up to 24h — check cached and scannedAt on the result; pass fresh: true to force a re-scan (rate-limited). Proxies to the SSRF-locked isittrustready scanner; the Ed25519 signature + permalink are preserved verbatim. Rubric + docs: https://www.isittrustready.ai/rubric and https://docs.mnemom.ai/.
search_reputation_directoryResolve an agent name or id-prefix to a real agent_id over the PUBLIC reputation directory (only agents whose reputation visibility is public). Zero-auth. The arriving-agent entry point: discover a concrete agent_id, then call get_reputation / verify_reputation on it.
test_governance_destinationSend a synthetic signal through a destination — Bypasses escalation rules and dispatches a test payload directly to the destination. Records last_tested_at + last_test_status on the row.
test_webhook_endpointSend test webhook delivery — Send a synchronous test delivery to the endpoint with a synthetic webhook.test event. Returns the delivery result immediately.
unassign_postureUnassign a team from a posture — Authorized: org_admin / org_owner / team_admin.
update_webhook_endpointUpdate webhook endpoint — Update an existing webhook endpoint. Re-enabling a disabled endpoint resets the failure counter.
validate_licenseValidate a license key (public)
verify_agent_bindingVerify that an API key is bound to this agent — confirms the holder is the accountable owner (anti-impersonation), hashing the key client-side.
verify_dojo_receiptVerify a Dojo completion receipt against the published JWKS. — PUBLIC — in-band Ed25519 verification of a posted completion-receipt JWS against the CURRENTLY published JWKS (/v1/.well-known/jwks.json; active + retired-window keys).
verify_reputationAttest an agent's Trust Rating — returns a Merkle-root + hash-chain attestation (hash_chain_valid) proving the rating derives from an unbroken, append-only checkpoint chain, plus a pointer to the signed integrity certificate. This is a chain-integrity attestation, NOT an in-band Ed25519 signature check (that parity is verify_scan, for website scorecards).
verify_scanVerify a website scan scorecard's Ed25519 signature IN-BAND (verify, don't trust). Pass a scan (a scorecard from scan_trust) or a url to re-scan; returns {verified, key_id, canonicalization} checked against the public key at mnemom://iitr/jwks. Zero-auth. Spec + rubric: https://www.isittrustready.ai/rubric and https://docs.mnemom.ai/.
BEFORE YOU INSTALL
74 tools when we connected.
CONTEXT COST
Rated by the size of the 74 tool definitions that ride along on every turn, not by how many there are
INSTALLATION
Add the endpoint to your client.
https://api.mnemom.ai/mcpMCP servers
HaseebKhalid1507
vaaraio
cordum-io
shahidh68