# The agent door — MCP tools, the machine face, the derivation contract

An agent gets the same door as a person — capture, query, get_event, translate, resolve, subscribe as typed MCP tools, JSON-RPC over POST /mcp, re-dispatched through the same worker fetch with the same key. A door, not a second path.


## The tools, and the two that refuse

| tool | what it does | readOnlyHint | state |
|---|---|---|---|
| capture | POST an EPCIS document through the gateway laws: strip → validate → project-check → stamp → append | false | shipped |
| query | SimpleEventQuery over whatever was captured | true | shipped |
| get_event | one event, by its CBV §8.9 hash identity | true | shipped |
| translate | EPCIS 1.1 / 1.2 / 2.0 XML → 2.0 JSON-LD, with a per-job fidelity report | true | shipped |
| resolve | identity resolution, via id.org.ai (Agent. Human. Thing.) | true | Coming soon |
| subscribe | push subscriptions | false | Coming soon |

## Paste-ready

```json
{ "mcpServers": { "epcis": { "command": "npx", "args": ["epcis.dev", "mcp"] } } }
```

Every tool call dispatches through the same capture pipeline as the REST interface, so validation, refusals and envelope stamping are byte-identical — strip, validate, stamp, append, on your own bench.

## The machine face

/llms.txt (the ledger and summarizer rules) · /agent-classes.json (the single enumeration of agent classes) · /icp.json (this property's derivation contract). Both JSON faces are built from one frozen enumeration — the same module a runtime selector must read. The free zone is compute — translate, validate, hash, capture at $0/event (intent, until published terms bind it). Absent a pre-registered notification channel, every human-gated scope fail-closes (never a silent grant). Who an observer is resolves via id.org.ai — Agent. Human. Thing. No surface here describes the mechanics.