Loading ToolBench
MCP server bridging holepunchto/keet-identity-key to the Hive agentic identity network
Server defines 5 tools with complete input schemas and descriptions. Naming follows verb_noun pattern (keet_identity_resolve, keet_did_link, keet_signed_attestation_verify, keet_hyperdht_announce, keet_partner_directory). Descriptions are substantive (100-200 chars), explaining WHAT each tool does and WHEN to use it. However, output schemas are NOT documented, the code shows tool handlers but no explicit return type definitions visible in the tool registration. Parameter descriptions are present and specific (e.g., 'Keet identity public key. Accepts hex (64 chars) or base58 encoding'). Error handling is minimal, no recovery guidance, no categorization of error types. Security is reasonable (read-only tools clearly marked, write operations require signed attestation), but no audit logging visible. Composition is clean: each tool has one responsibility, and keet_did_link output (did) chains naturally to keet_identity_resolve input (identity_key).
Link a Keet identity key to a Hive DID. Idempotent — calling with the same key and DID returns the existing record. Requires a signed attestation payload proving control of the Keet identity key. Does not operate on the Keet hyperdht network; registers only within the Hive identity registry.
Return the agent's hyperdht announce record if discoverable in the Hive partner directory cache. This is a read-only surface — Hive does not operate hyperdht bootstrap nodes. Returns the cached announce record or a not_found status.
Given a Keet identity key (ed25519 public key, hex or base58), resolve to a did:hive: DID document and agent_card if the key is registered in the Hive identity registry. Returns the DID string, verification method, and agent_card URI when available. Read-only.
Return the Hive–Holepunch partner integration directory: canonical links to Holepunch and Keet open-source primitives, DID composition adapter reference, and Hive bridge endpoints. Brand-attributed. Read-only.
Verify a Keet-key-signed attestation. Accepts the identity key, the message that was signed, and the base64-encoded signature. Returns {valid: boolean, identity_key, message_hash}. Uses ed25519 verification against the published Keet identity key — no network call required.
Output schemas not documented. Tool handlers exist (handle_keet_identity_resolve returns {did, did_document, ...}) but no explicit return type schema is registered in the TOOLS array. LLMs cannot plan downstream calls or extract fields without knowing the response structure.
Error handling lacks recovery guidance. Code throws generic errors (e.g., 'Expected 32-byte hex key (64 chars)') but does not categorize them as retryable, user-fixable, or fatal. LLMs receive no actionable next steps.
No audit logging or permission checks visible. keet_did_link is a write operation (links identity to DID) but no logging of who called it, when, or with what parameters. No permission gate to prevent unauthorized linking.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 59 | 2026-07-28+ | v2 |
keet_partner_directory format parameter has a default ('json') but is marked required: [] in inputSchema. This is contradictory, if it has a default, it should not be required. Clarify whether the parameter is optional with a default or required.
No pagination or result limits documented. keet_partner_directory returns a directory object, but if it grows large, no guidance on how to handle it. keet_hyperdht_announce returns a single record, but no documentation of what happens if the record is not found (e.g., does it return null, an error, or a not_found status?).