UCAN token operations for capability-based authorisation.
| Name: | ucan |
| Class: | covia.adapter.UCANAdapter |
This adapter provides 2 MCP tool(s) for AI agent integration:
| Tool Name | Description |
|---|---|
| ucan_issue | Creates a venue-signed UCAN capability token for resources controlled by this venue or one of its managed custodial users. The venue is the issuer. Self-sovereign DID owners must sign UCANs with their own key using a client SDK. The token grants the audience (aud) the specified capabilities (att). Set exp to a future Unix timestamp for a finite lifetime; omitted exp or explicit exp:null mints a genuinely non-expiring token with an explicit null claim. |
| ucan_verify | Verifies a UCAN capability token against this venue's trust policy and explains the verdict — the diagnostic counterpart to enforcement. Reports validity (signature at every chain hop, temporal bounds), the parsed claims, the delegation chain depth and root issuer, and a per-capability root-authority verdict: 'owner' (self-sovereign — the chain root is signed by the resource owner), 'venue' (rooted by this venue), or 'refused'. Optionally checks whether the token would authorise a specific request here; caveated paths report false because this diagnostic has no concrete invocation in which to run their policy gates. Read-only: no signing, no side effects. |