Access & Testing
Capability Token Studio
Issue backend-signed HMAC-SHA256 capability tokens, inspect decoded authorization claims, and review zero-trust tool policies.
Issue Signed Capability Token
Generate real HMAC-SHA256 capability tokens via POST /api/tokens/issue for authorized test requests
Cryptographic HMAC-SHA256 Token Issuer
Capability Token Claims Inspector
Paste any issued token above to decode its Base64URL claims, UUIDv4 nonce, action binding, and TTL status
Gateway Tool Capability Enforcement Matrix
Actual verification rules enforced by PolicyEnforcer and CapabilityTokenManager
| MCP Tool | Capability Token | Amount Ceiling | Guardrail Fields | Saga Compensation |
|---|---|---|---|---|
| execute_transfer | REQUIRED | $10,000.00 ceiling + token maxAmount | None (numeric/account schema) | Reverses debit/credit on mock_accounts |
| delete_record | REQUIRED | N/A | None | Restores deleted record content to SQLite |
| create_user_record | OPEN / GUARDRAILED | N/A | content | Deletes created record from SQLite |
| send_email | OPEN / GUARDRAILED | N/A | subject, body | Marks outbox draft as cancelled |
| read_invoice | OPEN / GUARDRAILED | N/A | None | Read-only (no-op compensation) |
| check_balance | OPEN / GUARDRAILED | N/A | None | Read-only (no-op compensation) |