Every tool on this shelf earned its place.

The White Report MCP

Free read-only crypto + AI news for agents: search articles, get full article text, the live markets ticker, and a graded prediction scoreboard. Remote MCP — no install, just connect your client to the endpoint. Also a Muse custom connector — one-paste setup at thewhitereport.com/agents.

get_latest · search_articles · get_article · get_ticker · get_scoreboard

Test Bench: CERTIFIED(live) — 10/11 checks · live host

Usage 30d: 1 calls · MEASURED · upd 2026-10-26

Eclipse Agent Wallet MCP

The agent wallet where responsibility follows scope — per-transaction and daily caps, recipient allowlist, human approvals, instant kill switch, append-only audit trail. Sandbox: runs on simulated test USDC — no real funds.

create_wallet · set_policy · check_payment · pay · approve_payment · revoke · audit_log

Test Bench: CERTIFIED(sandbox) — 12/13 checks · simulated USDC · CI smoke-tested

Usage: not collected — by design

Eclipse Bazaar MCP

This marketplace, as an MCP server. Agents discover tools by the problem they need solved — search by capability, compare side by side, and read each listing's status before trusting it.

search_products · find_solutions · get_product · compare_products · get_certification · list_categories

Test Bench: CERTIFIED(local) — 15/16 checks · local build

Usage: not collected — by design

AgentReady MCP

Can an AI agent actually buy from your store? Score any public storefront 0–100 for agent readiness — UCP profile, MCP endpoints, structured product data — with the evidence and the top fixes.

Test Bench: CERTIFIED(local) — 13/14 checks · local build

Usage: not collected — by design

CertBridge MCP

The padlock, without the paywall — agent-native ACME certificate issuance, HTTP-01 challenge placement, install, and renewal watching for shared-hosting sites.

Test Bench: CERTIFIED(staging) — 12/13 checks · Let's Encrypt staging env · live issuance proven 2026-10-25 (dogfood run — not a bench verdict)

Usage: not collected — by design

HostBridge MCP

The sanctioned path for agents to deploy websites to shared hosting — docroot-scoped deploys, snapshot before every deploy, one-call rollback, plain-language deploy receipts.

Test Bench: CERTIFIED(simulator) — 15/16 checks · local simulator docroot

Usage: not collected — by design

Florida Bid Intel MCP

Florida bid intelligence with honest deadlines — real competitions and real due dates from MyFloridaMarketPlace, with a transparent fit score. Gaps are stated, never guessed.

Test Bench: CERTIFIED(local) — 13/14 checks · local build

Usage: not collected — by design

Eclipse Apply MCP

The auto-apply tool that shows its work — applies only inside a human-granted written policy (target roles, salary floor, allowlist + blocklist, daily cap, expiry, kill switch), review-first, with a receipt for everything. Tailored resumes re-order verbatim real experience only, each with a machine-verifiable diff proving zero invented facts. Discovery is live against the public Greenhouse / Lever / Ashby / Workable feeds. v0.1 submission is DRY-RUN ONLY — nothing is transmitted to any employer.

ingest_resume · set_policy · get_policy · search_jobs · match_jobs · prepare_application · approve_application · reject_application · list_receipts · get_tracker · pause · resume · delete_my_data

Test Bench: CERTIFIED(sandbox) — 17/18 checks · sandbox environment

Usage: not collected — by design

Eclipse Herald MCP

Signed Agent Cards, policy-gated delegation, certification before hire.

card_build · card_sign · card_verify · gateway_delegate · receipt_list

Test Bench: CERTIFIED(local) — 18/19 checks · local build

Usage: not collected — by design

Eclipse Beacon MCP

The insurance watcher — signals your policies' expiries before they happen. It does not insure, bind, or advise.

policy_ingest · policy_list · policy_get · radar_report · gap_report

Test Bench: CERTIFIED(local) — 16/17 checks · local build

Usage: not collected — by design

Eclipse Cluster MCP

Signed images, governed runtimes — the gate runs first: no verified signature and provenance, no workload.

verify_image · policy_show · receipt_list

Test Bench: CERTIFIED(simulator) — 18/19 checks · local simulator

Usage: not collected — by design

Eclipse Thread MCP

On-prem bridges for the legacy software-engineering toolchain, plus the Evidence Weaver that joins their records into one traceable thread. v0.1: simulator scope, honestly labeled.

ingest_fixture · graph_query · trace_gaps · evidence_build · evidence_verify

Test Bench: CERTIFIED(simulator) — 13/14 checks · simulator build

Usage: not collected — by design

Eclipse Constellation MCP

The governed, vendor-neutral VM fleet layer for agents: one policy, one receipt ledger, every cloud and hypervisor underneath.

target_list · policy_evaluate · probe_target · fleet_snapshot · receipt_list

Test Bench: CERTIFIED(local) — 15/16 checks · local build

Usage: not collected — by design

Eclipse Deep Field MCP

The governed database layer for agents — every store in one look, under policy: read-only by default, writes only under mandate, every query receipted.

db_list · schema_read · query_read · query_explain · write_dryrun · write_execute · receipt_list

Test Bench: CERTIFIED(local) — 16/17 checks · local build

Usage: not collected — by design

Eclipse Pantry MCP

The unattended-retail module — reads vending fleets' own telemetry and predicts stock-outs. It never touches card data.

dex_ingest · inventory_read · sales_summary · stockout_forecast · fault_read · receipt_list

Test Bench: CERTIFIED(simulator) — 14/15 checks · simulator fixtures

Usage: not collected — by design

Eclipse Marquee MCP

The live-events agent: it finds the event, watches the price, buys only inside your mandate, and keeps the receipt for every ticket. It does not scalp, bypass, or bet.

event_search · listing_read · watch_create · watch_list · watch_evaluate · receipt_list

Test Bench: CERTIFIED(simulator) — 15/16 checks · local stub feed

Usage: not collected — by design

Eclipse Dispatch MCP

Drafts once, syndicates drafts everywhere sanctioned, unifies the analytics. Never publishes without approval; never scrapes.

draft_create · draft_preview · draft_approve · syndicate_drafts · analytics_report · receipt_list

Test Bench: CERTIFIED(local) — 13/14 checks · local stub adapters

Usage: not collected — by design

Eclipse Social Core MCP

One canonical, hash-bound package behind every Eclipse social adapter. It publishes nothing itself — it makes sure nothing unapproved moves.

account_set · account_inventory · content_ingest · content_get · adapt_preview · adaptation_diff · variant_revise · approval_pack · approve_variant · approval_check · policy_check · engagement_log · engagement_report · adapter_kill_switch · receipt_list

Test Bench: CERTIFIED(local) — 15/16 checks · local build

Usage: not collected — by design

Eclipse Aperture MCP

The Instagram adapter, formalized: capability-declared, hash-bound native variants for Feed, Carousel, Story, and Reel. The descriptor travels with the mode.

capability_probe · variant_build · preview_pack · receipt_list

Test Bench: CERTIFIED(local) — 11/12 checks · formalization — no live calls

Usage: not collected — by design

Eclipse Zephyr MCP

The Bluesky adapter: real public reads over the open AT Protocol, with review-first and house caps fully in force. No posting surface exists in v0.1.

profile_read · actor_search · author_feed_read · post_thread_read · receipt_list

Test Bench: CERTIFIED(live-read) — 12/13 checks · live public reads

Usage: not collected — by design

Eclipse Environment MCP

The smart-environment module — scopes an agent's authority to actuate a home, tier by tier, and receipts only what the device itself confirms.

registry_list · state_snapshot · policy_evaluate · command_execute · receipt_list

Test Bench: CERTIFIED(simulator) — 14/15 checks · local HA-shaped stub

Usage: not collected — by design

Eclipse Procure MCP

Intent to receipt in one fail-closed pipeline — policy before payment, abort on drift, proof for everything.

intent_create · quote_get · policy_check · order_execute · order_track · receipt_list

Test Bench: CERTIFIED(simulator) — 14/15 checks · simulator end to end

Usage: not collected — by design

Eclipse Gig Core MCP

One approved Task Brief, every marketplace: hash-bound briefs, all-in quotes, and a hire that runs only inside a mandate.

brief_create · brief_update · brief_approve · brief_read · quote_normalize · quote_read · hire_check · completion_verify · review_draft · receipt_list

Test Bench: CERTIFIED(local) — 18/19 checks · local build

Usage: not collected — by design

Eclipse Compass MCP

The Thumbtack adapter: one approved Task Brief becomes a native Thumbtack request, and a hire runs only inside a Procure mandate.

tt_capability_probe · tt_category_map · tt_form_preview · tt_pro_search · tt_request_lifecycle · tt_quotes_read · receipt_list

Test Bench: CERTIFIED(simulator) — 14/15 checks · Thumbtack fixture adapter

Usage: not collected — by design

Eclipse Stage MCP

The console bridge — deploy and playtest AI-built games on your own Dev Mode console, with receipts.

console_list · device_info · app_list · app_install_sim · remote_input · screenshot_get · power_control · receipt_list

Test Bench: CERTIFIED(simulator) — 15/16 checks · console simulator

Usage: not collected — by design

Eclipse Zenith MCP

The fitness module of Eclipse Procure — reads the machine, turns the dial under a safety ladder, and stops the belt when the controller goes silent.

registry_list · telemetry_read · session_start · session_control · session_end · workout_list · receipt_list

Test Bench: CERTIFIED(simulator) — 16/17 checks · equipment simulator

Usage: not collected — by design

Eclipse Muster MCP

The Customer Graph core: provenance on every field, propose-only identity merges, and drafts that cite the record — or say what's missing.

record_ingest · record_read · record_search · merge_propose · merge_execute · merge_unmerge · reply_draft · policy_show · receipt_list

Test Bench: CERTIFIED(local) — 15/16 checks · local build

Usage: not collected — by design

Eclipse Haven MCP

The governed Zendesk server: OAuth-first (token auth refused by name — it sunsets 2027-04-30), replies only as approved drafts, a receipt for every touch.

auth_status · ticket_search · ticket_get · user_get · org_get · ticket_create · ticket_update · reply_draft · reply_send · receipt_list

Test Bench: CERTIFIED(simulator) — 13/14 checks · fixture build · run-2 FAILED card retained, run 3 standing

Usage: not collected — by design

Eclipse Orbit MCP

The HubSpot wrap: the vendor's own MCP server, under policy — classified tools only, approval gates on sends, and a halt the moment a tool's tier drifts up.

vendor_tools · vendor_refresh · vendor_call · halt_clear · receipt_list

Test Bench: CERTIFIED(simulator) — 16/17 checks · local stub vendor

Usage: not collected — by design

Eclipse Voice Core MCP

The Consent Registry and Number Registry every Eclipse telephony adapter obeys: no provenance, no consent; one revocation silences every adapter at the next check.

consent_check · consent_record_write · consent_revoke · consent_history · dnc_status · window_check · number_list · number_get · number_enroll · number_health_report · send_evaluate · activity_emit · kill_switch_set · receipt_list

Test Bench: CERTIFIED(local) — 19/20 checks · local build

Usage: not collected — by design

Eclipse Trunk MCP

The governed Twilio adapter: a classified subset of the carrier's pipes, every send gated by live consent + mandate first. V0 is fixtures — nothing sent, nothing provisioned.

logs_read · send_sms_sim · place_call_sim · number_search · registration_status · recording_policy_get · recording_policy_set · receipt_list

Test Bench: CERTIFIED(simulator) — 16/17 checks · fixture adapter

Usage: not collected — by design

Eclipse Connect MCP

The MCP face of the Eclipse Connect relay: upload, publish, status, revoke through a revocable agent key — never raw OAuth. A distinct surface from the relay, benched separately.

connect_account · grant_status · upload_video · publish_video · revoke_grant

Test Bench: CERTIFIED(dogfood-facade) — 14/15 checks · facade over the live relay

Usage: not collected — by design

Eclipse Envoy MCP

The signed front door for agent-to-agent business: counterparties vetted into risk tiers, told exactly what their tier allows, negotiated with in drafts. It binds nothing — only the owner binds Cyan Eclipse.

identity_get · inquiry_open · fact_request · scope_draft_open · proposal_submit · room_send · attestation_submit · receipt-grade audit

Test Bench: CERTIFIED(local) — 17/18 checks · local build · offline fixtures

Usage: not collected — by design

Eclipse Fathom MCP

DeFi, measured honestly: a signed protocol registry, dual-source risk reads that render DIVERGENT instead of averaging, and an allowance audit that flags the unlimited grants. Reads only — no execution surface exists.

registry_list · registry_verify · position_read · health_read · depeg_watch · allowance_audit · address_check · exposure_read

Test Bench: CERTIFIED(local) — 16/17 checks · reads only · fixture transport

Usage: not collected — by design

Eclipse Codex MCP

Banking regulation as data: a citation-exact versioned library, a deadline engine that knows rule clocks from guidance cadences, local sanctions screening with no auto-clear, and exam-evidence packs whose gap section cannot be suppressed.

library_search · obligation_map · deadline_compute · clock_status · screen_lookup · screen_disposition_record · evidence_pack_build · receipt_verify

Test Bench: CERTIFIED(local) — 18/19 checks · synthetic fixture institution

Usage: not collected — by design

Eclipse Till MCP

Bazaar checkout for agents — a separate server from the discovery MCP: hash-bound all-in quotes, Wallet-mandate verification against the all-in total, signed buyer-bound entitlements, and a non-delivery refund that fires itself. Sandbox test credits only. Ads Rail P1 extension: charge-time mandate enforcement for ad spend — Stripe test mode only, NOT PROVEN IN STRIPE.

catalog_price · quote_get · purchase_execute · buyer_approve · entitlement_verify · delivery_status · refund_request · receipt_get

Test Bench: CERTIFIED(local) — 23/24 checks · sandbox test credits only · Ads Rail P1: CERTIFIED(local/simulator) — 100/100, test mode only, NOT PROVEN IN STRIPE

Usage: not collected — by design

Eclipse Book MCP

The Markets core: one canonical book across exchanges and prediction markets, criteria verbatim + hash-pinned, fee truth or FEE_UNVERIFIED, resolutions verified only against their own named source — and no probability field, ever. Market data + venue access layer — not an exchange.

instrument_ingest · book_ingest · quote_get · fee_schedule_register · position_open · resolution_verify · order_draft · venue_status

Test Bench: CERTIFIED(local) — 16/17 checks · data only · not an exchange

Usage: not collected — by design

Eclipse Forecast MCP

The Polymarket adapter: the venue’s prices with their criteria, liquidity, and resolution state attached — token/outcome mapping pinned from the venue’s own arrays. Data only; the US trading surface is absent by design.

forecast_sync · market_list · market_get · book_get · quote_get · resolution_get · venue_status · receipt_list

Test Bench: CERTIFIED(local) — 13/14 checks · data only · no US trading surface

Usage: not collected — by design

Eclipse Strike MCP

The Coinbase public-data adapter: products and level-2 books normalized into the suite’s one book, unmapped statuses preserved verbatim, fee truth or FEE_UNVERIFIED. Coinbase’s account MCPs are re-implemented nowhere — no account tools exist.

product_list · product_get · book_get · quote_get · venue_status · receipt_list

Test Bench: CERTIFIED(local) — 13/14 checks · public data only · no account tools

Usage: not collected — by design

Eclipse Meter MCP

Cross-provider agent spend analytics — one ledger for tokens, tools, and payments. Every record is signed at ingest and hash-chained; the retry share of spend is computed from links, not estimated; attestation exports verify offline with the public key only. Meter reports and never blocks — enforcement is Tripwire. Local v0.1 — fixture transport only; live ingest is not built.

meter_ingest · cost_record_list · spend_rollup · budget_posture · cost_attest_get · adapter_list · receipt_list

Test Bench: CERTIFIED(local) — 19/20 checks · local build

Usage: not collected — by design

Eclipse Tripwire MCP

Runaway enforcement for agent spend: deterministic velocity, loop, spawn, and cap-trajectory detectors over recorded event streams — and a freeze that is verified against the Wallet before it is ever recorded confirmed. A backend that lies about freezing gets FREEZE_UNCONFIRMED and a critical owner page, never a success record. Sandbox only — fixture streams, the sandbox Wallet, test USDC.

tripwire_wallet_bind · tripwire_rule_set · tripwire_arm · tripwire_disarm · tripwire_ingest · freeze_now · unfreeze · tripwire_events · tripwire_status

Test Bench: CERTIFIED(local) — 18/19 checks · local build

Usage: not collected — by design

Eclipse Umbra MCP

Cross-registry lookalike, typosquat, and silent-endpoint-change watch for agent identities. Findings issue only in a closed state vocabulary, each backed by a reproducible evidence pack and signed under a dedicated findings key — a witness, never an accuser, with no enforcement verb at any tier. Local v0.1 — snapshot import only; live crawling is gated per registry and not built.

snapshot_import · watchlist_set · diff_run · similarity_scan · finding_issue · finding_get · finding_list · finding_verify · rebuttal_file · receipt_list · receipt_verify

Test Bench: CERTIFIED(local) — 18/19 checks · local build

Usage: not collected — by design

Eclipse Blackbox MCP

The tamper-evident flight recorder for agent actions: an append-only, hash-chained record signed at ingest by a recorder-held key the recorded agent never touches. The agent's credential can only append — no read, verify, or export path — and the recorder grades evidence from proof, receipting its own gaps as signed INGEST_GAP events. No update, delete, or redact verb exists. Local v0.1 — single-store; the hosted recorder is owner-gated and not built.

record_append · record_verify_chain · record_read · record_export_pack · record_status

Test Bench: CERTIFIED(local) — 22/22 checks · local build

Usage: not collected — by design

Eclipse Docket MCP

Agent-to-agent dispute process — structured claims, evidence packs, recorded determinations. Not a court, not a legal judgment. The pack assembles from the underlying product's receipts alone, byte-identical for both parties; narratives are data with zero state effect, and outcomes are process states the underlying machine executes or declines. Expiry records silence, never a default judgment. Local v0.1 — Till fixture receipts; arbitration-as-service is owner + counsel gated.

dispute_file · evidence_pack_get · submission_add · determination_record · dispute_withdraw · dispute_status

Test Bench: CERTIFIED(local) — 19/20 checks · local build

Usage: not collected — by design

Eclipse Countermark MCP

One verification call for third-party agent cards and payment mandates — a receipted verdict a merchant can rely on, across formats. Every verdict enumerates the checks actually performed and carries provenance; presented-only artifacts cap at UNRESOLVED, and there is no approve, release, or trust-score surface. Local v0.1 — fixture issuers + fixture revocation feed; live issuer discovery is not built.

verify_card · verify_mandate · verify_revocation_status · verification_receipt

Test Bench: CERTIFIED(local) — 23/24 checks · local build

Usage: not collected — by design

Eclipse Census MCP

Agent discovery & inventory of record — from authorized sources only. Every item traces to a receipted discovery event, and an item that cannot cite one cannot render; source claims stay attributed and are never promoted to Census verdicts, and every export carries its coverage gaps. Local v0.1 — fixture sources only; tenant connectors are gated and not built.

census_sources · census_discover · census_list · census_get · census_shadow · census_reconcile · census_export · census_diff · receipt_list · receipt_verify

Test Bench: CERTIFIED(local) — 23/24 checks · local build

Usage: not collected — by design

Eclipse Crosswalk MCP

Multi-regime AI-obligation mapping — which AI laws bind your systems, what evidence satisfies each. A versioned obligation library with as-of resolution and a role dimension; candidate classifications bind to the exact fact-set hash and the determination stays permanently empty and customer-owned. Evidence machinery, never verdicts. Local v0.1 — synthetic fixture deployer only; live customer data is counsel-gated.

library_search · library_provision · obligation_map · classification_candidates · obligation_coverage · clock_rules · clock_status · evidence_pack_build · evidence_pack_verify · receipt_verify

Test Bench: CERTIFIED(local) — 21/22 checks · local build

Usage: not collected — by design

Eclipse Redteam MCP

Adversarial simulation for AI agents — sandboxed twins only, never the production agent. No tool accepts a free-form target: probe construction sits downstream of a signed, in-date authorization record and a registration proof, so an unauthorized target refuses before any probe exists. Reports are signed and verify offline. Local v0.1 — fixture twins only; external runs are counsel-gated.

rt_register_target · rt_suites_list · rt_run_suite · rt_report

Test Bench: CERTIFIED(local) — 26/27 checks · local build

Usage: not collected — by design

Eclipse Span MCP

Delegation-chain governance: spawn limits, depth caps, mandate attenuation. Every proposed spawn is checked against a total componentwise attenuation order walked to an owner-signed root, with subtree budgets enforced at every ancestor — chain-laundering by splitting spawns across children is arithmetically impossible. Local v0.1 — check-and-record, not blocking enforcement in external frameworks.

root_register · root_revoke · budget_set · chain_view · node_effective_mandate · spawn_check · spawn_record · spawn_close · chain_verify · ancestry · subtree

Test Bench: CERTIFIED(local) — 23/24 checks · local build

Usage: not collected — by design

Eclipse Airtime MCP

Mandate-bound ad operations. Spend enforcement happens before the platform call — a refusal makes zero calls — ad copy may publish only as claims drawn from a signed claims record, and every mutation or refusal seals into an advertiser-held evidence ledger that survives the account. No override tool exists; more spend is a new signed mandate. Local/simulator P0 — simulator transport only; no live spend exists.

mandate_issue · mandate_check · copy_screen · campaign_create_draft · campaign_set_status · audience_attach · ledger_get · appeal_pack_export

Test Bench: CERTIFIED(local/simulator) — 23/23 checks · simulator only · no live spend

Usage: not collected — by design

Eclipse Friction MCP

A signed, agent-only friction board: agents file infrastructure friction as findings backed by hash-chained trace packs the board verifies before surfacing — in a closed 15-class vocabulary (Emic-12 + house classes), never as free-text posts. Vendors answer on the record, and a fix closes only after a clean replay verifies it. No scores, no rankings, no leaderboard. Local v0.1 — local stdio board only; the hosted/public board is P1 and not built.

friction_file · friction_import · friction_get · friction_list · friction_verify · friction_supersede · friction_subject_register · friction_feed_read · friction_acknowledge · friction_rebut · friction_fix_claim · friction_fix_submit · friction_gate_check · friction_radar_digest · friction_board_status · friction_receipt_verify

Test Bench: CERTIFIED(local) — 41/41 checks · local build

Usage: not collected — by design

Eclipse BidMatrix MCP

Drop in a solicitation, get back the compliance matrix — every requirement row is a verbatim quote with its section + line locator, and sections that yield nothing are flagged SILENT_EMPTY instead of silently dropped. Deadlines extract under strict formats only; vague or relative dates are flagged by name, never fabricated. Local v0.1 — caller-supplied text or local file; no SAM.gov fetch, no PDF parsing.

solicitation_shred · compliance_matrix · requirements_checklist · deadline_extract · set_aside_summary

Test Bench: CERTIFIED(local) — 25/26 checks · local build

Usage: not collected — by design

Section 508 Evidence MCP

WCAG 2.1 A/AA audits of supplied HTML that produce the deliverable federal buyers actually require: ACR/VPAT-ready evidence. Every finding is bound to its criterion, a verbatim snippet, and an element locator; the 15 criteria static markup cannot decide are reported NOT_STATICALLY_DECIDABLE with reasons — never silently passed, and a zero-failure audit still claims conformance NONE. Local v0.1 — static analysis of supplied HTML; no rendered DOM, no browser.

audit_html · acr_report · checks_list

Test Bench: CERTIFIED(local) — 19/20 checks · local build

Usage: not collected — by design

FedScope MCP

Federal + state opportunity search with deterministic fit and newcomer scoring and plain-language summaries — not a raw API wrapper. Every score decomposes into named factors with per-factor points; every summary names the record fields it traces to and flags absent facts instead of inventing them. Exactly 4 read-only tools; no fetch verb exists. Local v0.1 — caller-supplied / bundled local datasets; no live SAM.gov fetch.

opportunity_search · opportunity_score · opportunity_summarize · validate_dataset

Test Bench: CERTIFIED(local) — 21/22 checks · local build

Usage: not collected — by design

Eclipse Health Check MCP

Scan an MCP server or agent configuration for security posture — 23 checks in 7 categories, every finding cited to file + line with severity and fix bound to the check definition, and a score that never prints without its decomposition. The scanner reads targets only: it never executes, imports, or probes them, and credential values are masked in its evidence. Local v0.1 — static scanner; no live probing.

health_scan · health_scan_config · health_checks_list · health_explain_check

Test Bench: CERTIFIED(local) — 21/22 checks · local build

Usage: not collected — by design

Eclipse Legacy Recon MCP

Point an agent at a codebase: architecture map, dependency/EOL risk list with rule-cited claims, and modernization estimate inputs — never an estimate. Claims keep DECLARED / OBSERVED / INFERRED separate, and anything not statically determinable reports UNKNOWN with the reason instead of a guessed stack. Local v0.1 — read-only static recon at the NARROWED OBSERVED SCOPE (CLAIM-SCOPE.md), CERTIFIED(local) at that scope. The former universal claim FAILED at card -10 and stays on the record: this shelf does not hide its failures.

recon_scan · architecture_map · dependency_risk_list · modernization_inputs

Test Bench: CERTIFIED(local) — 30/30 checks · local build · at the NARROWED OBSERVED SCOPE (CLAIM-SCOPE.md): Positive DECLARED, OBSERVED, and INFERRED reports only within CLAIM-SCOPE.md, with evidence or basis carried in the output; OBSERVED is not exhaustive · withdrawn W1–W9 named in CLAIM-SCOPE.md and the catalog entry · scoped re-bench card -11 supersedes the card -10 FAILED standing at the former universal claim; all 11 scorecards retained append-only

Usage: not collected — by design

Eclipse Steward MCP

Team-chat agent governance — a signed, version-chained mandate is the whole authority: the agent surface holds no dispatch verb and no credential, the gate re-checks mandate, kill, disclosure, quiet windows, and caps at dispatch, and every read is receipted. Chat content never governs — an in-chat mandate amendment refuses even from the workspace owner. It governs the agent — it never monitors the people. Local/simulator v0.1 — fixture adapters for Slack, Teams, Discord; no live platform, no real messages. Name CONDITIONAL (trademark screen pending; fallback Eclipse Usher); the spec's 7 owner decisions ship at their spec defaults, carried in the catalog manifest.

workspace_bind · mandate_issue · mandate_amend · draft_approve · gate_dispatch · kill_issue · disclosure_check · receipt_verify · read · draft_propose

Test Bench: CERTIFIED(local) — 27/28 checks · local build

Usage: not collected — by design

Eclipse Mail MCP

A governed email identity for an agent: scoped grants (send/read/search only), review-first sending where the owner approves the exact draft — signature included — and a kill switch that fails closed on every surface. Inbound mail is evidence, never instructions: SPF/DKIM/DMARC verdicts set the trust tier, no valid signed envelope means never agent-tier, and the §5 fraud firewall is by construction — payment, credential, trust, and disclosure instructions from email are non-actionable because no tool can adopt them; detection opens an out-of-band verification workflow keyed to the registry number-of-record. Local / fixture-only v0.1 — synthetic fixture mailbox behind the live transport seam; NO live mailbox, NO live sending, no real credentials. One disclosed PARTIAL: the fraud detector's detection prong is pattern-bounded on extended evasions (7/12) — an evasion loses the flag only, never protected state; a semantic detector pass is required before any live claim. (Working name.)

grant_issue · fixture_load · list_inbox · read_message · search_messages · ingest_message · draft_create · draft_approve · send_message · reply_message · get_grant_status · revoke · audit_list · fraud_list · registry_list · signature_set · template_register · allowlist_add · freeze_correspondent · unfreeze_correspondent

Test Bench: CERTIFIED(local / fixture-only) — 48/49 checks · local / fixture-only build

Usage: not collected — by design

Eclipse Proof MCP

Governed video production for agents: timelines assemble freely, but export executes only against a Herald-signed approval pinning the exact edit-decision fingerprint — post-approval drift refuses, every adapter mutation is read-back-verified (the Resolve API fails silently), and Proof Print seals render evidence — captions verbatim — to the approval. No code-exec tool exists on any surface. Local v0.1 — benched against a declared simulated Resolve-shaped adapter; no live-Resolve claim (no Resolve Studio seat on the build VM).

project_open · project_attest · timeline_read · timeline_fingerprint · export_presets_list · template_list · media_import · clip_place · clip_trim · text_set · template_instantiate · marker_set · approval_request · export_execute · session_close · proof_print_verify · proof_trace_fingerprint · proof_trace_diff

Test Bench: CERTIFIED(local) — 35/37 checks · local build · simulated Resolve-shaped adapter — no live Resolve claim

Usage: not collected — by design

Eclipse Charter MCP

Personal-finance governance across all of the owner's accounts: policy-of-record drift named with both values, cross-account wash-sale watch including the IRA trap (Rev. Rul. 2008-5) caught pre-settlement, fee math against policy ceilings, and a permanent grant-keeper — Schwab grants AGING at day 5, EXPIRED_FAIL_CLOSED at day 7. Not a bank. Not an investment adviser. Charter checks your rules — it never writes them. Local v0.1 — Plaid-shaped fixture adapter and fixture-form dogfood; no live Plaid claim.

policy_upsert · policy_get · accounts_snapshot · positions_get · lots_get · activity_get · drift_check · wash_scan · fee_report · grant_status · document_ingest

Test Bench: CERTIFIED(local) — 24/24 checks · local build · Plaid-shaped fixture adapter — no live Plaid

Usage: not collected — by design

Eclipse Colophon MCP

The catalog of record for books: a signed TitleRecord per title — only signed versions enforce — with rights, prices and royalties recomputed line-by-line from record terms and checked everywhere the book sells, in a closed 8-class divergence vocabulary. Discovered editions are quarantined, the price-match trap fires CRITICAL at check time, and pirate sources refuse by name — there is no price-write verb. Local/simulator v0.1 — synthetic fixtures only; no live retailer or KDP data.

calibre_diff_record · calibre_ingest_library · divergence_get · divergence_list · divergence_resolve · drift_check_feed · drift_check_listing · drift_scan_catalog · edition_list · epub_check · onix_build · onix_diff · onix_validate · record_get · record_history_get · record_rights_cell · record_sign_version · record_upsert_edition · record_upsert_title · royalty_ingest_report · royalty_ledger_get · royalty_reconcile · royalty_run_get

Test Bench: CERTIFIED(local/simulator) — 19/19 checks · synthetic fixtures only

Usage: not collected — by design

Eclipse Tether MCP

The mandate layer between an agent and a moving machine: physical task authority exists only inside a Herald-signed mandate pinning agent × robot serials × human-authored task templates × workspace envelope × speed/force ceilings × occupancy × window, enforced at a site bridge that is the only routed path to the robot — and every session, refusals and human overrides included, seals into an offline-verifiable evidence pack. No direct-motion surface exists. Simulator v0.1 — ROS 2 + Gazebo + UR-class arm sim; no hardware claim.

fleet_discover · session_open · task_templates_list · task_dispatch · task_status · task_abort · telemetry_read · image_read · session_close · mandate_register · mandate_revoke · template_register · template_revoke · site_freeze_set · session_reattest · pack_verify · pack_render · pack_compare · gauge_check_mandate · gauge_check_template · gauge_check_pair · gauge_limits_list

Test Bench: CERTIFIED(simulator) — 31/31 checks · simulator only · no hardware

Usage: not collected — by design

Eclipse Proving MCP

Governed bench access for agents: physical bench authority exists only inside a Herald-signed mandate pinning agent × board × operation classes × exact artifact hashes, enforced at the bridge holding the target connections — an artifact one byte off its pin refuses, receipted, with no override anywhere on the surface — and every session, gaps and refusals included, seals into an offline-verifiable evidence pack. Fuse programming, PMIC/voltage configuration, and boot-strap changes are permanently refused: no tool exists. Simulator v0.1 — adapters are simulated-PS (evidence class: emulator); no live transport exercised and no hardware claim.

bench_discover · session_open · session_status · target_connect · target_attest · register_read · memory_read · console_read · artifact_load · memory_write · target_run · target_halt · power_set · target_reset · persistent_write · session_close · pin_verify · pin_show · pin_status · gate_run · pack_verify · gate_assertions_check

Test Bench: CERTIFIED(simulator) — 10/10 checks · simulator only · simulated-PS adapters (emulator class) · no live transport exercised

Usage: not collected — by design

Eclipse Wageward MCP

Governed HR + payroll operations for agents: agents prepare runs and filing packets, a human approves the exact run — fingerprint-bound and Herald-signed, with any post-approval drift refused by name — bank changes verify through the employee's own channel, SSNs/bank numbers exist only as keyed-HMAC tokens, and every packet carries the statement that approval does not transfer payroll-tax liability. Approval-and-evidence rail ONLY — submit-class tools (payroll_run_submit / filing_submit) are ABSENT by design; local v0.1 over a synthetic workforce, no live provider, money, or filing.

workforce_roster_read · compensation_read · pay_history_read · payroll_run_prepare · payroll_run_diff · run_fingerprint_get · filing_packet_prepare · anomaly_scan · change_request_open · change_request_status · access_ledger_read · synthetic_workforce_generate · pin_verify · run_reconcile · change_check · access_pack_verify

Test Bench: CERTIFIED(local) — 20/20 checks · approval-and-evidence rail only · submit-class tools absent by design · synthetic workforce only

Usage: not collected — by design

Eclipse Covenant MCP

Consent-enforcement + evidence for real-estate lead work: every lead carries a Herald-signed provenance record (classes never blended), and outreach executes only through a send-time Gate — mandate × per-channel consent scope × named-seller coverage × no open revocation × fresh DNC scrub × fair-housing guards — with every send and refusal sealed into an evidence pack for the broker of record. Consent rules are versioned data packs; missing or stale packs fail closed. P0 synthetic only — no live outreach; counsel HARD GATE stands before any P1 live use.

lead_intake · consent_attach_certificate · consent_record_read · consent_history · revocation_record · lead_context_read · outreach_text · outreach_call_place · outreach_email · followup_sequence_plan · showing_schedule · copy_screen · criteria_screen · consent_record_verify

Test Bench: CERTIFIED(local/simulator) — 40/40 checks · P0 synthetic only · counsel hard gate before any P1 live outreach

Usage: not collected — by design

Eclipse Meridian MCP

Governed telehealth operations: encounters execute only when licensure × consent × mandate verify at encounter time against the patient's attested location; AI-drafted notes live cryptographically outside the record until the treating clinician signs the exact fingerprint; minimum-necessary PHI reads are purpose-declared and every read — granted or refused — seals a hash-chained access record. Not a healthcare provider. Synthetic scope only — no live PHI, no real EHR connection; NO signing capability exists in this product (no note_finalize-class tool, in any phase) and no prescribing surface; P1 requires HIPAA counsel + executed BAA + a design partner.

mandate_upsert · mandate_get · license_verify_at_encounter · consent_set_required · encounter_gate_check · encounter_schedule · encounter_start_gate · encounter_pack_get · intake_template_get · intake_status_get · note_draft_create · note_fingerprint_get · note_sign_request · note_signed_status_get · note_addendum_create · patient_context_get · appointment_get · access_pack_get · access_pack_verify

Test Bench: CERTIFIED(local, synthetic scope) — 22/22 checks · synthetic only · no signing capability exists in the product

Usage: not collected — by design

Eclipse Consent MCP

Per-agent, per-purpose consent receipts for personal data — a grant an agent must present, and a revocation that propagates. Processors present a receipt id at action time and get ALLOW/DENY synchronously against current state, so a revocation binds at the very next check; a grant without full provenance is void, and a grantee can never write its own consent (CONSENT_SELF_ASSERTED). Local v0.1 — fixture subjects only, enforced by the product (SUBJECT_NOT_FIXTURE); real-subject processing and jurisdiction packs are held (G-COUNSEL), consumer grant UX held (G-OWNER).

consent_grant · consent_check · consent_revoke · consent_history · consent_dependents

Test Bench: CERTIFIED(local) — 23/24 checks · local build · fixture subjects only

Usage: not collected — by design

Eclipse Lineage MCP

Agent provenance — spawn trees, model/config lineage, and version ancestry: who spawned whom, running what, changed when. A behavior-relevant config change mints a new generation identity instead of editing the old one (GENERATION_IMMUTABLE); per-root signed hash chains verify offline and name the first broken link; prompts and configs are recorded as hashes only — there is no prompt_get. Local v0.1 — self/consented emission only; corroboration is labeled UNVERIFIED by construction (no per-agent key registry in v0); framework adapters (G-LIVE) and hosted lineage (G-OWNER) are held, not built.

lineage_spawn · lineage_config_change · lineage_retire · lineage_tree · lineage_verify

Test Bench: CERTIFIED(local) — 10/10 checks · local build · scoped re-bench run 3

Usage: not collected — by design

Eclipse Attest MCP

Signed performance attestations for agents, issued only against settled, receipt-backed work — reputation that travels because its evidence does. Wash and self-dealing are excluded by construction (WASH_EXCLUDED), outcomes are a closed vocabulary with banded value — no stars, no free-text reviews — and evidence diversity is computed from the registry's accountable identity, so a Sybil cluster cannot inflate it by assertion. Local v0.1 — Till settlement receipts are the only admitted evidence class; public feeds/leaderboards (G-COUNSEL) and new evidence classes (G-OWNER) are held gates, not built.

attest_issue · attest_verify · attest_list_subject · attest_revoke · attest_dispute

Test Bench: CERTIFIED(local) — 10/10 checks · local build · scoped re-bench (C12 diversity)

Usage: not collected — by design

Eclipse Revoke MCP

Signed revocation lists for agent cards, keys, and mandates — an issuer revokes once, and subscribers learn it from a signed, epoch-versioned feed they can check offline, with staleness announced, never silent. Only the original issuer (or its recorded successor) can originate a revocation; any other signer refuses REVOKE_NOT_ISSUER and is receipted as a violation attempt. Local v0.1 — own-issuer feed + offline check over fixture issuers; external distribution (G-REG/G-LIVE) and emergency classes (G-COUNSEL) are held gates, not built; no enforcement verb exists.

revoke_issue · revoke_counter_notice · list_publish · revocation_check · feed_status · feed_acknowledge

Test Bench: CERTIFIED(local) — 13/13 checks · local build

Usage: not collected — by design

Eclipse Keyhold MCP

Credential leases, never raw keys — scoped, expiring leases over NON-OAuth static credentials (raw API keys, PATs) under Wallet policy semantics: allowlist scope, expiry, use-count cap, audience binding, per-lease kill switch. The secret is sealed on the operator's own machine under the owner master key; the server holds ciphertext and contains no decrypt path; redemption injects the credential after the model's view ends. Local v0.1 — first-party scope, one redemption class (https_static_key), fixture transport; third-party custody is HELD (G-COUNSEL + G-OWNER + security review; may conclude never); name CONDITIONAL (trademark screen owed, G-TM).

secret_enroll · lease_issue · lease_status · lease_list · lease_revoke · redemption_audit

Test Bench: CERTIFIED(local) — 13/13 checks · local build · first-party scope (59/59 probes)

Usage: not collected — by design

Eclipse Loft MCP

Governed design-to-print authority for agents: fabrication runs only inside a signed mandate pinning agent × printer serial × design pin × slicer build × profile hash × material × envelope × site class × window, enforced at a bridge holding the only printer credentials. The bridge re-slices the pinned inputs at dispatch and hash-matches the toolpath before any printer contact — hand-edited toolpaths, poisoned profiles, slicer drift and material swaps refuse by name before heat — and every print and refusal seals into an evidence pack verified offline by Loft Proof. No raw G-code surface exists, and config writes are permanently refused. Simulator v0.1 — host-shaped sim printers only (OctoPrint virtual + virtual Klipper/Moonraker); no live printer exercised. Proof verifies only against a trusted signer anchor — unanchored packs report PRINT_UNVERIFIED by design. Geometry: declared geometry only.

design_register · design_inspect · design_pin_get · printers_discover · session_open · job_prepare · job_dispatch · job_status · job_abort · telemetry_read · session_close

Test Bench: CERTIFIED(simulator) — 12/12 checks · simulator only · host-shaped sim printers · no live printer exercised · Proof requires a trusted signer anchor

Usage: not collected — by design

Eclipse Corona MCP

Sealed render-proof for deployed websites: the verifier renders the served artifact across a pinned matrix (Chromium/Firefox/WebKit × three viewports), runs a closed vocabulary of mechanical probes at each cell, hashes every screenshot, and seals measurements + hashes into a signed pack bound to the deployed artifact's hashes — recomputed offline by anyone. The publish gate may say 'verified live' only while a PASS served pack's hashes equal the deployed manifest; any served-byte change invalidates the proof, and the gate blocks the word 'verified', never the publish. Local verifier only, at the P0 ceiling — no hosted/live scope. A pack proves identity and mechanical soundness of the pinned bytes only — never that an asset is semantically the right asset; semantic approval is the separate human act on the contact sheet. Name CONDITIONAL — trademark screen pending (fallbacks: Eclipse Transit, Eclipse Behold, Eclipse Lantern).

verify_deploy · verify_page · pack_inspect · pack_recompute · probe_registry

Test Bench: CERTIFIED(local) — 25/27 checks · local verifier only · P0 ceiling · render-proof packs bound to deployed artifact hashes · no semantic-correctness claim · name CONDITIONAL (TM screen pending)

Usage: not collected — by design

Eclipse Crosslist MCP

Publish once, tracked everywhere: selecting a registry (Eclipse Bazaar, Official MCP Registry, Glama, Smithery) materializes that registry's own verb set and native data model as MCP tools — with native|adapted|absent provenance and honest absences (Glama carries ZERO write verbs; claim execution refuses permanently) — while one Herald-signed mandate submits a single canonical manifest across registries and a hash-chained ledger tracks each registry's listing state with Herald-sealable receipts. No union index, no cross-facet search, no fused ranking. Certified at split per-facet scopes — root+ledger and the Bazaar facet CERTIFIED(local); Official CERTIFIED(live-read) with writes CERTIFIED(fixture) only, NOT live-write certified; Smithery CERTIFIED(live-read) for search/get with the rest CERTIFIED(fixture); Glama CERTIFIED(fixture-read) only; Herald dependency FIXTURE ONLY (ECDSA P-256 fixture verification; production RSA-JWS not exercised). Receipts are sealable / pending — never sealed. Known limitations: deeply nested error envelopes (depth 4+) can escape detection and error-shaped data keys can be refused by mistake; resubmission repair runs just before mandate verification (nothing is written or accepted first); a submitted track whose registry record is entirely absent has no automatic exit — it stays submitted rather than inventing a state; a Glama submit against its absent native verb consumes the mandate nonce, so a later legitimate use can read as a replay.

list_registries · select_registry · deselect_registry · invoke_facet_tool · ledger_create_track · ledger_submit · ledger_status · ledger_poll · ledger_list_tracks · ledger_receipts · + 33 facet verbs (Bazaar 8 · Official 8 · Glama 8 read-only · Smithery 9)

Test Bench: CERTIFIED(split per facet) — 39/40 checks · root+ledger CERTIFIED(local) · Bazaar CERTIFIED(local) · Official CERTIFIED(live-read), writes fixture only · Smithery CERTIFIED(live-read) search/get, rest fixture · Glama CERTIFIED(fixture-read) only · Herald FIXTURE ONLY · receipts sealable/pending, never sealed · no live-write claim · dogfood: full real catalog tracked + served through the Bazaar facet

Usage: not collected — by design

Eclipse Verbatim MCP

Title 26 as a sealed object: the OLRC-published text (release point Public Law 119-124) is sealed at ingest under the published canonicalization verbatim-canon/1.1 — per-section hashes for all 2,277 sections, dual Merkle roots, a signed manifest — and its headline verb is cite-check: a quoted passage gets a byte-for-byte verdict (MATCH / DIVERGES with the first divergence localized / NOT_IN_CORPUS) against the sealed text. OLRC editorial notes are sealed in a separate EDITORIAL layer and never served as statute. An independent implementation written from the spec alone reproduces the seal exactly — 2,277/2,277 in both layers. CERTIFIED(local) — local stdio only, no hosted scope. No advice surface: no tool interprets, explains, applies, or calculates anything; Title 26 statute only — no CFR; the corpus is a dated snapshot at the named release point, never described as current law. Known limitations: a MATCH for a repealed section carries no status field (D-5); 115 identifier-absent sections are reachable only via manifest paging, search, or unclaimed cite-check (D-6); the cite-check candidate pre-filter can only produce non-MATCH outcomes, never a false MATCH (D-7); two spec-clarification errata candidates are on record (prose-form title citations, D-8; nested-note text rule, D-9). Signing uses labelled Herald FIXTURE keys only — never production custody. Name CONDITIONAL — trademark screen (spec D1) is owner-side and still open (fallbacks: Eclipse Quire, Eclipse Schedule).

get_section · search · notes_get · cite_check · section_verify · manifest_get · manifest_verify · corpus_status · snapshot_list · lineage

Test Bench: CERTIFIED(local) — 5/5 checks · scoped re-bench scopes all PASS · full-spec-literal recompute 2277/2277 both layers · canon verbatim-canon/1.1 · snapshot usc26-119-124-de68dcc8b3db · cite-check hostile battery: 0 false MATCH · Herald FIXTURE keys only · name CONDITIONAL (TM screen pending)

Usage: not collected — by design

Eclipse Roll MCP

Filing prep + proof for business & government filings: a filing is prepared, approved, and evidenced as a Herald-signed DELTA between the registry-of-record's own current state — read back through its sanctioned public surface at prep time — and the exact artifact to be submitted; after the human submits via the registry's own channel, Proof re-reads the registry and seals proof-of-filing only if the public record changed exactly as approved (a mismatch seals FILED_UNVERIFIED + a Radar discrepancy — never a partial seal). Renewal Radar tracks deadlines against registry state; the built dogfood subjects are CETech's own Florida annual report, SAM.gov renewal watch, and VetCert radar entry — all labelled fixtures. CERTIFIED(local) at FIXTURE scope: every Gauge adapter is a labelled fixture and NO live registry read has been exercised yet. NO submission verb exists on any surface, in any name — prep-and-seal only; the human always submits. UPL fence at the tool layer: advice / selection / interpretation / clearance refuse by name (ADVICE_CLASS_REFUSED). The bench arc is on the record: first bench FAILED (23/34 — revocation not propagating into live sessions; Proof certifying a filing the read-back had refuted), the fix round closed D1–D10, and the scoped re-bench passed 17/17 attacking the fix code with fresh shapes. Name CONDITIONAL — trademark screen pending (fallbacks: Eclipse Seal, Eclipse Record).

session_open · registry_record_get · filing_prepare · filing_diff · pack_get · pack_seal · pack_verify · pack_render · pack_compare · radar_entries_list · radar_entry_get · radar_refresh · + mandate + gauge surfaces (18 tools, 5 disjoint surfaces)

Test Bench: CERTIFIED(local) — 17/17 checks · scoped re-bench (first bench FAILED — baseline card retained) · FIXTURE scope · Gauge adapters labelled fixtures · no live registry read exercised · no submission verb exists · UPL fence ADVICE_CLASS_REFUSED · counsel gate stands pre-P1 · name CONDITIONAL (TM screen pending)

Usage: not collected — by design

Eclipse Verbatim — Executive Orders

Executive Orders as sealed objects: Federal Register full-text XML sealed per section under canon-eo/1.0 into snapshot eo-20261022-26818c895dee — 1,315 orders, per-section hashes, a signed manifest — with a disposition graph extracted from the orders' own sealed sections: 10,667 edges, each pinned to the hash of the asserting section and typed by provenance (TEXT / FR_NOTE / NARA_TABLE). Where the consulted sources disagree, the disagreement itself is sealed as a DIVERGENCE record — 823, status OPEN, never resolved by the product. CERTIFIED(local) — local stdio only, no hosted scope. Coverage is measured, not assumed: sealed text runs from 2000 (the Federal Register full-text XML floor, measured — the 1994 assumption was falsified); 258 orders are EXCLUDED_NAMED (NO_FR_FULL_TEXT_XML), never silently absent, and pre-2000 orders ride in a labelled unsealed metadata+edges layer reaching back to 1931. No tool characterizes legal effect — no status field exists anywhere in the product; a disposition answer is an edge set + as_of + a coverage window + the standing completeness sentence. Bench arc on the record: PARTIAL on cards -1/-2 (certification withheld on EO-D1-2 alone — whole-cue scope emission trusted the savings idiom), the fix round closed it: the FULL census went 9 → 5 with every survivor re-derived by the bench from the sealed asserting text, 186/186 stated ranges re-derived verbatim, extraction precision/recall 1.000 on a fresh labelled sample. Two LOW findings (EO-D1-4, EO-D1-5) stand synthetic-only, corpus-swept, with a pre-reseal sweep condition. The snapshot seal is a labelled FIXTURE seal — never production Herald custody. Name CONDITIONAL — inherits the pending Eclipse Verbatim trademark screen (family fallbacks: Eclipse Quire, Eclipse Schedule).

search_orders · get_order · get_section · cite_check · verify_manifest · disposition · revocation_chain · resolve_authority · graph_divergences · corpus_status

Test Bench: CERTIFIED(local) — scoped re-bench #3 · 7/7 checks · FULL census 5 genuine · 186/186 ranges · precision/recall 1.000 · suite 76/76 · snapshot eo-20261022-26818c895dee · FIXTURE seal · name CONDITIONAL

Usage: not collected — by design

Eclipse Flood Witness

Flood evidence over sealed snapshots of FEMA's public National Flood Hazard Layer: an offline evidence engine that seals NFHL county extracts per partition under flood-canon/1.0 and mints geometry determinations as signed, independently recomputable receipts — the standalone verifier ships in the tree, and anyone can re-derive a receipt from its sealed snapshot. Two Florida partitions are sealed: Leon (snapshot nfhl-fl-leon-20260611-bec93b592c31 — 12,099 features) and Monroe (nfhl-fl-monroe-20261022-4776f79b6d7c — 9,664 features); the operative index fw-index-202610-abd4c392bd16 enumerates all 67 Florida counties and names the other 65 NOT_SEALED — Miami-Dade is NOT_SEALED (pending), never silently absent. Subjects are geometry (FOOTPRINT / STRUCTURE_POINT / PARCEL); an address is refused as a subject. BFE has exactly three outcomes and no datum-conversion code path exists; drift between vintages is classified by causal source record across a closed 12-class grammar. CERTIFIED(local) — local stdio only; the runtime has no live-query path. This is an evidence-grade receipt witness only: never a determination of record, never an SFHDF, never lender-compliant, never an insurance-required/not-required answer, and never a statement that a property is "safe" — determination-shaped, insurance-shaped, risk-score, and live-query tool names are refused by name. Bench arc on the record: card -1 PARTIAL(local); the fix round closed FW-D1..D7 and the scoped re-bench verified all seven FIXED against fresh shapes, not the builder's regressions. Flag-1 qualifier: the LOMC override branch (LOMC_OVERRIDE_APPLIES) is FIXTURE-PROVEN ONLY — the LOMA layer is absent from FEMA's county shapefile distribution, the sealed corpus holds zero LOMA/LOMR-F records, and the branch has never fired on real sealed data. One LOW (FW-D8) stands as a printed condition: a LOMR case wholly removed in a later vintage did not raise drift — fixed in code after the bench; it must hold before any second-vintage drift output is published. All seals are FIXTURE_SIGNED (Herald fixture key) and labelled as such. Nothing here states or implies endorsement by, affiliation with, or certification from FEMA or any government agency — FEMA/NFHL/FIRM name the public data source only. Name CONDITIONAL — working name, trademark screen owed.

determine · verify_receipt · receipt_get · drift_report · watch_set · watch_list · coverage_status · manifest_get · manifest_verify · geocode_explore

Test Bench: CERTIFIED(local) — scoped re-bench · 7/7 checks · 2 sealed partitions (Leon 12,099 · Monroe 9,664 features) · Miami-Dade NOT_SEALED · Flag-1: LOMC override FIXTURE-PROVEN ONLY · FW-D8 printed condition · FIXTURE_SIGNED seals · name CONDITIONAL

Usage: not collected — by design

Eclipse Recall Witness

Recall campaigns, witnessed: NHTSA serves what a campaign says now and overwrites what it said — this product seals the saying. The recalls flat file seals nightly into a hash-chained anchor (recall-anchor/1.0) and every campaign's full payload seals as an immutable vintage under recall-canon/1.0; a campaign that disappears seals as a tombstone vintage, never a silent drop. Drift between consecutive vintages seals as events across the closed recall-events/1.1 grammar — POPULATION_EXPANSION · REMEDY_CHANGE · ESCALATION_DO_NOT_DRIVE · ESCALATION_PARK_OUTSIDE · CORRECTION · CLOSURE, each with closed subtypes — an escalation is never absorbed into an expansion. Advisory detection is normalized token-pattern matching harvested from the live escalation stock (BMW/Mazda/Ford/Ferrari “advised not to drive”, Porsche 24V809 “should not drive”, GM/Kia park-outside) and cross-checked against the API's own parkIt/parkOutSide flags: 15/15 live campaigns agree. Posture-at-date derives exclusively from sealed vintages — before the first vintage the answer is NOT_SEALED, printed with its reason and the campaign's own first-vintage date. Mandate-bound check receipts run one live CAMPAIGN-LEVEL check and seal what it returned. CERTIFIED(local, FIXTURE scope) — local stdio only. Every receipt prints scope_class: CAMPAIGN-LEVEL and the three standing sentences byte-exact: “This record states what NHTSA served at the stated time. It is not a safety determination about any vehicle.” · “This receipt proves a check was made and what it returned. It is not a legal determination of compliance with any law.” · “Per-VIN unrepaired status is NOT determined by this check.” A specific VIN is never called “open” — per-VIN unrepaired status is never determined here (the consumer VIN lookup is never automated; no such code path exists in the tree). Bench arc on the record: card -1 PARTIAL(local, FIXTURE scope); the fix round closed RW-D1..RW-D6 and the scoped re-bench verified all six FIXED against fresh shapes, not the builder's regressions (136 checks, 127 pass). LIVE-PROVEN at cross-check + check-issuance scope against api.nhtsa.gov: the live cross-check seals 24V809 with cross_check OK, its DO_NOT_DRIVE tag agreeing with parkIt: true; an altered-summary hold-out sealed nothing (FAILED + named); one live check receipt (rcpt-00001, Porsche 911 MY2024) carries exactly the 4 campaigns the live API returns and recomputes MATCH. NOT live: the nightly flat-file spine — www-odi.nhtsa.dot.gov remains unreachable from the build egress (re-probed 2026-10-26, empty reply) and was NOT re-routed to the API, because the flat file is the canon source; LIVE scope waits on the first real nightly ingest and live-key cutover (owner). Churn is MEASURING: counters seal inside every anchor from night one and no rates exist before a day-90 segment seals. Three LOW conditions stand printed on card -2, all riding the recall-events/1.2 / next-seal touch: RW-D7 — the park-outside matcher can tag narrative “parked outside” rollaway text as a false PARK_OUTSIDE (no live-stock instance); RW-D8 — the chain walk does not yet assert the genesis links (first-vintage/first-anchor prev-hash tampers verify MATCH; content integrity unaffected); RW-D9 — operate/use paraphrase families tag nothing, so no escalation-completeness claim is made beyond the live-stock-proven phrase families. All seals are under FIXTURE ECDSA keys, labelled seal_key_class: FIXTURE on every artifact. Pricing is NOT YET SET — no price points exist in the approved price book for this product; nothing is priced or activated. Name CONDITIONAL — working name, trademark screen owed.

get_campaign · get_campaign_vintage · list_campaign_vintages · get_drift_events · list_campaigns_for_vehicle · get_posture_at_date · get_anchor · get_churn_series · verify_receipt · issue_check_receipt · ingest_run · archive_seal · churn_publish

Test Bench: CERTIFIED(local) — FIXTURE scope · scoped re-bench · 127/136 checks · RW-D1..D6 FIXED verified · live cross-check + 1 live check issuance PROVEN (api.nhtsa.gov) · nightly spine FIXTURE-proven — first live ingest pending · churn MEASURING · RW-D7/RW-D8/RW-D9 LOW conditions printed · FIXTURE keys · name CONDITIONAL

Usage: not collected — by design

Eclipse Test Bench

The certification harness behind every verdict on this shelf: adversarial suites run over the wire against bench-owned fixtures — homoglyph typosquats, lying backends, duplicate-event batches, schema fuzzing — with FAILED cards retained append-only, never overwritten. It runs in-house against the whole fleet today and is productizing as a CLI + hosted run service (slate T1). The paid tier — a Verity-run certification carrying the seal — is an owner decision, not yet offered.

In-house artifact — productization in progress; no public Test Bench card yet, and none claimed.

Usage: not collected — by design

Eclipse Stocktake

Catalog / manifest / storefront consistency auditor: one scorecard ledger checked against every surface that repeats a verdict, with machine-safe fields synced and prose verified, never rewritten. It is the drift checker that has closed every Eclipse publish pass at drift=0 — running in-house today as sync_verdicts.py, productizing as a CLI + CI action (slate T4).

In-house artifact — productization in progress; no public Test Bench card yet, and none claimed.

Usage: not collected — by design

Eclipse Press

Agent-native static-site publish pipeline: deploy zips with normalized permissions and real file mtimes — the GoDaddy 403 and PHP-opcache lessons, encoded — published to a verified shelf manifest. It publishes thewhitereport.com and this Bazaar in production today (deploy-pipeline/publish.py) and is productizing as a standalone pipeline (slate T3).

In-house artifact — productization in progress; no public Test Bench card yet, and none claimed.

Usage: not collected — by design

Herald Card Kit

Agent Card issue/verify toolkit for A2A builders: the Herald JWS card tooling (cards.py, jwscore.py) that already runs inside the Eclipse Herald MCP, productizing as a CLI + library (slate T7). Issue signed Agent Cards and verify a counterparty's card offline, with receipts — no call home.

In-house artifact — productization in progress; no public Test Bench card yet, and none claimed.

Usage: not collected — by design

Eclipse Ledger MCP

Betting records and responsible-gambling controls: limits that can fall instantly but never rise without a wait and a fresh confirmation, absolute self-exclusion, honest cash P&L that never counts a bonus bet as money. Not a sportsbook. No bets are placed here.

limit_set · limit_confirm · exclusion_start · jurisdiction_check · bet_record_add · pnl_summary · reality_snapshot · odds_compare · slip_prepare · resources_get

Test Bench: CERTIFIED(local) — 21/22 checks · fixtures only · not a sportsbook

Usage: not collected — by design