# Per-Call Proof for Local Tool Invocation by AI Agents

[3 · Permit](/category/permit/)
Candidate · auto-drafted, unreviewed · confidence 80%

| Per-Call Proof for Local Tool Invocation by AI Agents |
| --- |
| Category | [Permit](/category/permit/) |
| Governed by | IETF Internet-Draft, discussed on the WIMSE Working Group mailing list |
| Status | Internet-Draft, Intended Status: Standards Track; expires 15 April 2027 |
| Phase | draft |
| Implementation | unknown |
| Adoption | unmeasured |
| Version | draft-lee-wimse-local-tool-call-proof-01 (2026-10-12) |
| Specification | [https://datatracker.ietf.org/doc/html/draft-lee-wimse-local-tool-call-proof-01](https://datatracker.ietf.org/doc/html/draft-lee-wimse-local-tool-call-proof-01) |
| Found at | Local Call Authority exposes a JSON-RPC 2.0 interface over a Unix domain socket or named pipe on the host; no network discovery described in the available text |
| Last checked | 2026-10-19 |
| Freshness | current · checked 2026-10-19 |
| Solves | Delegate a user's authority to an agent, Audit what an agent did, Expose tools to agents |

Per-Call Proof for Local Tool Invocation by AI Agents is an agentic-web standard (endpoint) at step 3, Permit, governed by IETF Internet-Draft, discussed on the WIMSE Working Group mailing list; its own status is "Internet-Draft, Intended Status: Standards Track; expires 15 April 2027" (draft). It answers: How can a local tool server (for example an MCP stdio server) verify that each invocation from an AI agent passed a policy decision, without reusable credentials in the agent process? Adoption is unmeasured, last verified 2026-10-19.

[Permit](/category/permit/) Defines a per-call proof for local tool invocations by AI agents, such as MCP servers over stdio. A Call Authority running outside the agent process evaluates policy, issues a short-lived single-use proof bound to a canonical action digest of the method, tool name and arguments, and verifies it for the tool server. Proof formats are opaque and defined by evidence type profiles. An MCP stdio binding is included. It does not prevent prompt injection, but confines the effects of a compromised agent to actions policy permits.

## Discovery and probe

Local Call Authority exposes a JSON-RPC 2.0 interface over a Unix domain socket or named pipe on the host; no network discovery described in the available text

```
NONE
parse:
on absent: Support is a host-local deployment property and cannot be observed from outside the host
```

Not probed live: no-fixed-path. candidate record; probe rule pending

## History
- 2026-10-19 — auto-drafted candidate from exa (https://datatracker.ietf.org/doc/html/draft-lee-wimse-local-tool-call-proof-01)

## Instances

No instances recorded yet.

## See also

## References

- The draft defines a per-call proof for local tool invocation: a Call Authority outside the agent process issues short-lived, single-use proofs bound to the tool name and arguments through a canonical action digest (JCS + SHA-256), and the tool server rejects invocations lacking a valid proof. It includes an MCP stdio binding. — [https://datatracker.ietf.org/doc/html/draft-lee-wimse-local-tool-call-proof-01](https://datatracker.ietf.org/doc/html/draft-lee-wimse-local-tool-call-proof-01) (2026-10-12) REPORTED

[JSON](/data/protocols/local-tool-call-proof.json) · [Markdown](/protocols/local-tool-call-proof/index.md)