io.github.projetnanocorp/mandate

up checked 2026-11-11T07:39:30.121Z

Unclaimed · Unverified

Publisher-provided title

MANDATE Credential Broker

Publisher-provided description

MCP server for mandates, delegation, policy-gated execution, credential grants, and audit.

Summary by lookupd

Issues, delegates, revokes and verifies scoped agent mandates and credential grants, gating actions by policy and recording an audit ledger.

Install

Claude Code, remote (streamable-http)

claude mcp add --transport http mandate https://mandate.nanocorp.app/mcp

Codex, remote (streamable-http)

codex mcp add mandate --url https://mandate.nanocorp.app/mcp

Cursor, remote (streamable-http) → .cursor/mcp.json

{
  "mcpServers": {
    "mandate": {
      "url": "https://mandate.nanocorp.app/mcp"
    }
  }
}

Other clients: docs. Or tell your agent: Set up lookupd for me: read https://lookupd.com/agent.md and follow it.

Publisher-provided text

mandate.discover Returns this self-describing tool manifest.
mandate.mint Creates an active human-granted mandate for an agent and records it to the hash-chained ledger.
mandate.delegate Creates a child mandate only when it is a no-escalation subset of the parent mandate.
mandate.authorize-action Submits an action through the Gateway and canonical Policy Engine; returns ALLOW, DENY, or REQUIRE_APPROVAL with ledger proof.
mandate.verify-proof Records a proof payload hash and appends proof evidence to the hash-chained ledger.
mandate.revoke Revokes a mandate subtree and records the revocation to the hash-chained ledger.
broker.register-credential Registers an opaque vault handle/reference only; plaintext secret fields are rejected and never ledgered.
broker.request-access Asks the canonical Policy Engine for an ALLOW decision before issuing a short-lived HMAC-sealed grant bound to credential, mandate, agent, scope, and expiry.
broker.use Redeems a sealed grant for the bound acting agent and executes the bound action through the Gateway and Policy Engine; does not expose plaintext secrets.
broker.revoke-grant Revokes a broker grant by id and records the revocation to the ledger.
broker.introspect-grant Validates a grant token seal, reports active/revoked/expired state, and records introspection to the ledger.

Shows this live status and links here; updates hourly.

[![lookupd status](https://lookupd.com/badge/io.github.projetnanocorp/mandate.svg)](https://lookupd.com/servers/io.github.projetnanocorp/mandate)