{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "protocol": "Model Context Protocol",
  "protocolRevision": "2026-07-28",
  "legacyProtocolRevisions": ["2025-11-25", "2025-06-18"],
  "name": "palo-governance-server",
  "version": "2.7.0",
  "releaseStatus": "developer-preview",
  "productionUse": false,
  "disclaimer": "Full-cycle developer-preview contract for isolated evaluation only. It demonstrates trusted in-process executor and verifier boundaries but is not an audited production authorization service, universal exactly-once executor, authenticated approval service, compliance certification, or production evidence platform.",
  "implementations": {
    "stdio": "packages/palo-mcp-server/index.js",
    "authenticatedStreamableHttp": "packages/palo-mcp-server/http.js",
    "connectorRestGateway": "packages/palo-mcp-server/gateway.js"
  },
  "persistence": "Prototype SQLite WAL store with FULL synchronous commits, durable approval/verification tasks and append-only evidence triggers; multi-replica coordination, backup, retention, and tamper-resistant anchoring are not provided.",
  "authentication": "Streamable HTTP supports an OIDC/JWKS resource-server mode with issuer, audience, expiry, algorithm, scope and role validation. Shared bearer remains an explicit isolated-development fallback and is still the coarse preview control used by the separate REST Gateway. Action Claim 1.3 and 1.4 additionally fail closed unless the runtime host provisions an authorityVerifier for bound human/workload credential digests. PALO does not provide the authorization server, EMA ID-JAG exchange, token rotation, proof-of-possession, workload attestation or TLS termination.",
  "environment": {
    "PALO_OPA_URL": "Required for reference evaluation; absence or outage returns a denial response.",
    "PALO_DATA_DIR": "Private runtime directory containing palo-agentic.sqlite.",
    "PALO_HMAC_KEYS_JSON": "Protected keyId-to-secret map; each secret must contain at least 32 bytes.",
    "PALO_EVIDENCE_ED25519_JSON": "Optional keyId, verificationMethod, privateKey and publicKey object enabling RFC 8785/Ed25519 Evidence Envelope 2.0.",
    "PALO_EVIDENCE_PUBLIC_KEYS_JSON": "Optional keyId or verificationMethod to trusted public-key map used to verify historical Ed25519 envelopes after key rotation.",
    "PALO_IDENTITY_POLICY_JSON": "Optional trusted issuer and audience constraints for identity-bound Action Claim 1.3 and data-governed 1.4.",
    "PALO_RUNTIME_GUARDRAILS_JSON": "Optional maxDelegationDepth, maxActionsPerMinute and maxConcurrentExecutionsPerAgent limits.",
    "PALO_TASK_POLL_INTERVAL_MS": "Gateway-only durable task poll interval; minimum 250 ms and default 1000 ms.",
    "PALO_MCP_HTTP_TOKEN": "Bearer token of at least 24 bytes for Streamable HTTP.",
    "PALO_AUTH_MODE": "Set to oidc for the MCP OIDC/JWKS resource-server path or shared-token for isolated development.",
    "PALO_MCP_PUBLIC_URL": "Canonical externally visible MCP resource URL; required in OIDC mode and bound into RFC 9728 metadata.",
    "PALO_OIDC_ISSUER": "Trusted HTTPS token issuer. When set, OIDC mode is selected unless PALO_AUTH_MODE explicitly selects shared-token.",
    "PALO_OIDC_AUDIENCE": "Required audience for every accepted MCP access token.",
    "PALO_OIDC_JWKS_URI": "HTTPS JWKS endpoint used for signature verification; loopback HTTP is accepted only for development tests.",
    "PALO_OIDC_ALGORITHMS": "Optional space-separated asymmetric algorithm allowlist; defaults to RS256, PS256, ES256 and EdDSA.",
    "PALO_OIDC_CLIENT_ID_CLAIM": "Access-token claim containing the calling OAuth client ID; defaults to azp.",
    "PALO_OIDC_ALLOWED_CLIENT_IDS": "Required non-empty client allowlist for every non-loopback OIDC listener.",
    "PALO_OIDC_TENANT_CLAIM": "Access-token claim containing the tenant ID; defaults to tid.",
    "PALO_OIDC_ALLOWED_TENANTS": "Required non-empty tenant allowlist for every non-loopback OIDC listener.",
    "PALO_OTEL_ENABLED": "Set to true to emit allowlisted assurance spans through a host-registered OpenTelemetry SDK/provider.",
    "PALO_GATEWAY_TOKEN": "Bearer token of at least 24 bytes for the connector REST gateway.",
    "PALO_MCP_EXPOSED_TOOLS": "Optional comma-separated least-privilege allowlist for stdio and Streamable HTTP. Use the documented six-tool Knowledge Reader or ten-tool Knowledge Curator profiles rather than exposing the operational runtime to knowledge copilots.",
    "PALO_KNOWLEDGE_DIR": "Shared runtime workspace for immutable knowledge drafts, terminal reviews and accepted curated-local records.",
    "PALO_KNOWLEDGE_WRITE_ENABLED": "Set to true only on a Curator service that may create and inspect knowledge drafts.",
    "PALO_KNOWLEDGE_REVIEW_ENABLED": "Set to true only on a Curator/reviewer service that may accept or reject knowledge drafts.",
    "PALO_KNOWLEDGE_REQUIRE_REVIEWER_SEPARATION": "When true, the verified reviewer identity must differ from the draft submitter."
  },
  "prompts": [
    { "name": "palo_guide_agent", "contract": "source-grounded host-agent behavior with explicit inference and authority boundaries" }
  ],
  "tools": [
    { "name": "palo_explain_framework", "contract": "read-only explanation over released semantic records and evidence/authority classes" },
    { "name": "palo_infer_governance_route", "contract": "deterministic signal-to-phase starting hypothesis with reasons, artifacts and open questions" },
    { "name": "palo_plan_product_integration", "contract": "least-privilege MCP transport and integration-class plan that separates guidance from protected execution" },
    { "name": "palo_list_knowledge_sources", "contract": "read-only source inventory that separates canonical, source-backed and curated-local knowledge" },
    { "name": "palo_search_knowledge", "contract": "provenance-preserving search over released PALO registries and accepted local contributions" },
    { "name": "palo_get_knowledge_record", "contract": "complete knowledge record retrieval with source and authority boundary" },
    { "name": "palo_submit_knowledge_draft", "contract": "immutable local knowledge contribution that cannot publish itself or modify released PALO files" },
    { "name": "palo_list_knowledge_drafts", "contract": "curator-only draft and terminal review inventory" },
    { "name": "palo_get_knowledge_draft", "contract": "curator-only immutable draft and review retrieval" },
    { "name": "palo_review_knowledge_draft", "contract": "terminal accept/reject review with source, authority and prompt-injection checklist; acceptance creates a curated-local record" },
    { "name": "palo_register_agent", "contract": "locally registered versioned agent and authority profile; publisher identity is not authenticated" },
    { "name": "palo_register_policy", "contract": "locally registered versioned OPA policy manifest; bundle attestation is not provided" },
    { "name": "palo_register_executor", "contract": "versioned executor manifest; executable handler is operator-provisioned" },
    { "name": "palo_register_verifier", "contract": "versioned authoritative verifier manifest; handler is operator-provisioned" },
    { "name": "palo_get_registry", "contract": "secret-free registry inventory including data-assurance policy, contract and AI-system records" },
    { "name": "palo_import_context_evidence", "contract": "immutable payload-minimized external evidence reference from a read-only connector" },
    { "name": "palo_list_context_evidence", "contract": "current external evidence references for one tenant-bound subject" },
    { "name": "palo_register_data_fitness_policy", "contract": "versioned deterministic data-fitness policy" },
    { "name": "palo_evaluate_data_fitness", "contract": "immutable purpose-bound data-fitness decision over exact evidence references" },
    { "name": "palo_get_data_fitness_decision", "contract": "data-fitness decision and continuous-assurance invalidation marker" },
    { "name": "palo_register_disclosure_contract", "contract": "signed purpose/provider/region/row/field/trace-bound disclosure contract" },
    { "name": "palo_get_disclosure_contract", "contract": "single signed disclosure contract" },
    { "name": "palo_register_ai_system", "contract": "versioned AI system and agent inventory graph record" },
    { "name": "palo_get_ai_system", "contract": "current AI system and agent registry record" },
    { "name": "palo_list_ai_systems", "contract": "tenant-scoped AI system registry" },
    { "name": "palo_ingest_assurance_signal", "contract": "external change signal that invalidates fitness decisions and revokes unconsumed capabilities" },
    { "name": "palo_list_assurance_signals", "contract": "tenant and subject-scoped continuous-assurance signal history" },
    { "name": "palo_verify_action_authority", "contract": "normalized Action Claim and bound approval" },
    { "name": "palo_execute_governed_action", "contract": "Action Claim 1.2/1.3 or data-governed identity-bound 1.4 execution through one-time capability, execution/disclosure receipts and outcome verification" },
    { "name": "palo_get_execution_status", "contract": "governed execution, receipt, attestation and linked incident" },
    { "name": "palo_verify_outcome", "contract": "authoritative effect re-verification" },
    { "name": "palo_request_approval", "contract": "exact-digest approval request; OIDC transports replace the supplied requester label with the verified subject/client" },
    { "name": "palo_get_approval_status", "contract": "single approval state" },
    { "name": "palo_list_approvals", "contract": "approval work queue" },
    { "name": "palo_resolve_approval", "contract": "one terminal transition with rationale; OIDC transports bind the reviewer to the verified subject/client" },
    { "name": "palo_get_assurance_task", "contract": "single durable approval or verification task" },
    { "name": "palo_list_assurance_tasks", "contract": "durable assurance work queue filtered by state and type" },
    { "name": "palo_process_due_tasks", "contract": "privileged expiry and authoritative verification task processor" },
    { "name": "palo_get_operational_snapshot", "contract": "redacted task, execution, incident, guardrail and ledger health snapshot" },
    { "name": "palo_submit_evidence", "contract": "deprecated local compatibility path; governed execution produces trusted evidence internally" },
    { "name": "palo_verify_evidence", "contract": "legacy HMAC or RFC 8785/Ed25519 envelope verification" },
    { "name": "palo_verify_ledger", "contract": "complete signature and hash-chain verification" },
    { "name": "palo_list_incidents", "contract": "assurance incident work queue" },
    { "name": "palo_get_incident", "contract": "single mismatch or inconclusive incident" },
    { "name": "palo_resolve_incident", "contract": "acknowledge or resolve without implicit rollback" }
  ]
}