{
 "id": "local-tool-call-proof",
 "name": "Per-Call Proof for Local Tool Invocation by AI Agents",
 "acronym": "",
 "aliases": [
  "Local Tool Call Proof",
  "draft-lee-wimse-local-tool-call-proof"
 ],
 "collisions": [],
 "step": "permit",
 "parties": [
  "agent-agent"
 ],
 "form": "endpoint",
 "track": "ietf",
 "scope": "general",
 "question": "How can a local tool server (for example an MCP stdio server) verify that each invocation from an AI agent passed a policy decision, without reusable credentials in the agent process?",
 "analog": "Per-request signed authorization token, applied to local inter-process tool calls instead of HTTP",
 "origin": {
  "org": "SSenStone Inc.",
  "date": "2026-10-12"
 },
 "governance": "IETF Internet-Draft, discussed on the WIMSE Working Group mailing list",
 "native_status": "Internet-Draft, Intended Status: Standards Track; expires 15 April 2027",
 "phase": "draft",
 "implementation": "unknown",
 "adoption": {
  "level": "unmeasured",
  "by": null,
  "probe_run": null
 },
 "version": {
  "label": "draft-lee-wimse-local-tool-call-proof-01",
  "date": "2026-10-12"
 },
 "spec_url": "https://datatracker.ietf.org/doc/html/draft-lee-wimse-local-tool-call-proof-01",
 "discovery": {
  "mechanism": "Local Call Authority exposes a JSON-RPC 2.0 interface over a Unix domain socket or named pipe on the host; no network discovery described in the available text",
  "path": null
 },
 "probe": {
  "method": "NONE",
  "path": "",
  "parse": "",
  "on_absent": "Support is a host-local deployment property and cannot be observed from outside the host"
 },
 "evidence": [
  {
   "claim": "The draft defines a per-call proof for local tool invocation: a Call Authority outside the agent process issues short-lived, single-use proofs bound to the tool name and arguments through a canonical action digest (JCS + SHA-256), and the tool server rejects invocations lacking a valid proof. It includes an MCP stdio binding.",
   "label": "REPORTED",
   "url": "https://datatracker.ietf.org/doc/html/draft-lee-wimse-local-tool-call-proof-01",
   "date": "2026-10-12"
  }
 ],
 "summary_md": "Defines a per-call proof for local tool invocations by AI agents, such as MCP servers over stdio. A Call Authority running outside the agent process evaluates policy, issues a short-lived single-use proof bound to a canonical action digest of the method, tool name and arguments, and verifies it for the tool server. Proof formats are opaque and defined by evidence type profiles. An MCP stdio binding is included. It does not prevent prompt injection, but confines the effects of a compromised agent to actions policy permits.",
 "part_of": null,
 "group": null,
 "candidate": true,
 "confidence": 0.8,
 "use_cases": [
  "delegate-user-authority",
  "audit-agent-actions",
  "expose-tools-to-agents"
 ],
 "audience": [
  "agent-builder",
  "platform",
  "standards-body"
 ],
 "pairs_with": [
  "mcp",
  "wimse-aims"
 ],
 "prerequisites": [
  "mcp"
 ],
 "dispute": null,
 "last_verified": "2026-10-19",
 "history": [
  {
   "date": "2026-10-19",
   "note": "auto-drafted candidate from exa (https://datatracker.ietf.org/doc/html/draft-lee-wimse-local-tool-call-proof-01)"
  }
 ],
 "watch": [
  {
   "type": "page",
   "url": "https://datatracker.ietf.org/doc/html/draft-lee-wimse-local-tool-call-proof-01"
  }
 ],
 "freshness": "current",
 "url": "https://agenticweb.wiki/protocols/local-tool-call-proof/",
 "category": "permit",
 "type": "protocol"
}