Skip to main content
Praxa MCP tools let an MCP-compatible agent host discover governed capabilities, create and inspect durable missions, query purpose-filtered memory, and read evidence surfaces. The contracts add a standard tool boundary; they do not grant provider authority or make model prose an execution receipt.

​
Choose a use case

​
Example: governed support escalation

  1. Search capabilities for the escalation action family.
  2. Query only the support compartment and incident-resolution purpose.
  3. Submit the user intent with one stable idempotency key.
  4. Create a bounded mission after the application validates the goal and budget.
  5. Require host approval before any mutation.
  6. Read the mission and trace until the required terminal evidence exists.
  7. Store only redacted identifiers and receipts in the support case.

​
Example: engineering incident assistant

Give the host read-only access to aura_get_mission, aura_get_trace, aura_get_skill, and aura_get_coverage. Ask it to summarize an incident run, cite the exact trace and skill version, and identify missing evidence. Do not enable mission mutation tools until the read-only workflow passes isolation, redaction, and prompt-injection tests.

​
Example: enterprise capability catalog

Use aura_search_capabilities to populate a reviewed catalog of actions that are policy eligible for a purpose and target type. Cache only within the deployment’s freshness rules. A search result is eligibility evidence, not entitlement, provider availability, approval, or proof that an action ran.

​
When MCP is not the best interface

  • Use @praxa/sdk when your TypeScript service needs the complete mission client and event helpers.
  • Use Execution Fabric /v1 when a backend needs the minimal public durable-task contract.
  • Use @praxa/sdk/memory when you are federating existing provider memory read-only.
  • Use direct API reference calls for deterministic service-to-service flows that do not need a model to choose tools.

​
Production acceptance

Test tool selection, correct and wrong scopes, revocation, tenant isolation, prompt injection in returned content, schema rejection, approval visibility, exact mutation replay, changed-body conflict, timeout reconciliation, output bounds, audit correlation, and cleanup. See security and testing.
Last modified on August 14, 2026