Praxa MCP tools let an MCP-compatible agent host discover governed
capabilities, create and inspect durable missions, query purpose-filtered
memory, and read evidence surfaces. The contracts add a standard tool boundary;
they do not grant provider authority or make model prose an execution receipt.
Choose a use case
Example: governed support escalation
- Search capabilities for the escalation action family.
- Query only the support compartment and incident-resolution purpose.
- Submit the user intent with one stable idempotency key.
- Create a bounded mission after the application validates the goal and budget.
- Require host approval before any mutation.
- Read the mission and trace until the required terminal evidence exists.
- Store only redacted identifiers and receipts in the support case.
Example: engineering incident assistant
Give the host read-only access to aura_get_mission, aura_get_trace,
aura_get_skill, and aura_get_coverage. Ask it to summarize an incident run,
cite the exact trace and skill version, and identify missing evidence. Do not
enable mission mutation tools until the read-only workflow passes isolation,
redaction, and prompt-injection tests.
Example: enterprise capability catalog
Use aura_search_capabilities to populate a reviewed catalog of actions that
are policy eligible for a purpose and target type. Cache only within the
deployment’s freshness rules. A search result is eligibility evidence, not
entitlement, provider availability, approval, or proof that an action ran.
When MCP is not the best interface
- Use
@praxa/sdk when your TypeScript service needs the complete mission client and event helpers.
- Use Execution Fabric
/v1 when a backend needs the minimal public durable-task contract.
- Use
@praxa/sdk/memory when you are federating existing provider memory read-only.
- Use direct API reference calls for deterministic service-to-service flows that do not need a model to choose tools.
Production acceptance
Test tool selection, correct and wrong scopes, revocation, tenant isolation,
prompt injection in returned content, schema rejection, approval visibility,
exact mutation replay, changed-body conflict, timeout reconciliation, output
bounds, audit correlation, and cleanup. See security and testing. Last modified on August 14, 2026
