MANDATE Credential Broker

Reliability

Status and outage history · Atom feed · Watch with other listings

How to connect

Add it to any MCP client that supports remote servers.

{
  "mcpServers": {
    "mandate-credential-broker": {
      "type": "http",
      "url": "https://mandate.nanocorp.app/mcp"
    }
  }
}

11 tools

• mandate.discover

  Returns this self-describing tool manifest.

• mandate.mint

  Creates an active human-granted mandate for an agent and records it to the hash-chained ledger.

• mandate.delegate

  Creates a child mandate only when it is a no-escalation subset of the parent mandate.

• mandate.authorize-action

  Submits an action through the Gateway and canonical Policy Engine; returns ALLOW, DENY, or REQUIRE_APPROVAL with ledger proof.

• mandate.verify-proof

  Records a proof payload hash and appends proof evidence to the hash-chained ledger.

• mandate.revoke

  Revokes a mandate subtree and records the revocation to the hash-chained ledger.

• broker.register-credential

  Registers an opaque vault handle/reference only; plaintext secret fields are rejected and never ledgered.

• broker.request-access

  Asks the canonical Policy Engine for an ALLOW decision before issuing a short-lived HMAC-sealed grant bound to credential, mandate, agent, scope, and expiry.

• broker.use

  Redeems a sealed grant for the bound acting agent and executes the bound action through the Gateway and Policy Engine; does not expose plaintext secrets.

• broker.revoke-grant

  Revokes a broker grant by id and records the revocation to the ledger.

• broker.introspect-grant

  Validates a grant token seal, reports active/revoked/expired state, and records introspection to the ledger.

Security scan

Recent checks