MCP Tools

ArmorClaude exposes 5 MCP tools through the armorclaude-policy MCP server. These are available to Claude during a session - Claude uses them to register plans, read policy, and perform trust operations.

policy_read

Read the current policy state.

Input:

Without id: Returns the full policy state (version, policy JSON, history).

With id: Returns a single policy statement by its ID.

Example output:

{
  "version": 3,
  "policy": {
    "schemaVersion": "armor.policy.v1",
    "kind": "PolicyProfile",
    "defaults": { "decision": "deny" },
    "statements": [
      { "id": "stmt_1", "effect": "permit", "action": { "type": "tool", "eq": "Read" } }
    ]
  }
}

register_intent_plan

Declare the tools Claude intends to use for the current task. ArmorClaude requires this before any other tool call - without a registered plan, all tool calls are blocked.

Input:

Each step in the steps array:

Example input:

{
  "goal": "Read and summarize README.md",
  "steps": [
    {
      "action": "Read",
      "description": "Read the README file",
      "metadata": { "inputs": { "file_path": "/project/README.md" } }
    }
  ]
}

What happens when called:

1. The plan is validated against the intent plan schema
2. If an API key is configured, the plan is sent to the ArmorIQ backend for a signed JWT intent token
3. The plan and token are stored locally as a pending plan file
4. The next PreToolUse hook consumes the pending plan and enforces it

Example output:

Intent registered: 2 steps. Token valid 3600s.

trust_revoke

Revoke the currently active intent token. Use when the plan has gone wrong or needs to be stopped immediately.

Input:

What happens when called:

1. The active session's intent token is located
2. A revocation delta is signed and broadcast to the ArmorIQ backend
3. Within ~55ms, every enforcement point (PEP) in the fleet refuses the token
4. The revocation is recorded in the runtime state's trust operation log

Example output:

Token revoked. trustId=tr_abc123 (2 descendants cascaded)

trust_reanchor

Re-anchor to an updated plan without revoking the current token. Use when the plan needs to change mid-session (e.g., additional tools needed).

Input:

What happens when called:

1. The updated plan is validated
2. A delta δ(h_P → h'_P) is signed, linking the old plan hash to the new one
3. The working token is re-minted so subsequent tool calls succeed against the new plan
4. The tamper-evident lineage is preserved in the IAP audit log

Example output:

ReAnchor recorded. trustId=tr_def456 delta(a1b2c3d4e5f6 → 7890abcd1234)

trust_delegate

Issue a subtree-bounded child token with a Merkle inclusion proof. Used for multi-agent scenarios where a sub-agent needs authority over part of the plan.

Input:

What happens when called:

1. A child token is minted, scoped to the specified subtree path
2. A Merkle inclusion proof is generated, proving the subtree is part of the parent plan
3. The sub-agent receives authority confined to the named subtree
4. The delegation is recorded in the trust operation log

Example output:

Delegation issued. trustId=tr_ghi789 subtreePath=/steps/[1] (delegationId=del_xyz)

Whitelisted Tools

These tools are never blocked by ArmorClaude's intent enforcement (they are needed for the system to function):

• register_intent_plan - Claude needs this to declare plans
• policy_read - Policy reading (read-only, no mutation)
• trust_revoke / trust_reanchor / trust_delegate - Trust operations
• ExitPlanMode - Plan mode approval
• ToolSearch / TodoWrite / ListMcpResourcesTool - Claude Code internals with no side effects

Verifying MCP Server Connection

Check that the ArmorClaude MCP server is connected:

claude mcp list | grep armorclaude

Expected output:

plugin:armorclaude:armorclaude-policy: ... ✓ Connected