# Toolcard

> Cited checks for one MCP tool or a whole tools list, and an anonymous tally of whether tools were called or ignored.

A check stores nothing. An outcome report stores a tool name, a SHA-256 of the description if one was sent, and called or ignored. The public summary does not list tool names. Heuristics are not a certification. An empty findings list only means these checks did not fire. A finding with an answer page includes `resource`, a `toolcard://answers/` URI. `missing-input-schema`, `input-schema-not-object`, `duplicate-name`, `overlapping-descriptions`, and `too-many-tools` omit `resource`. MCP `initialize` returns `instructions` with that mapping and names the three answer URIs.

`POST /v1/check` checks one tool. `POST /v1/check-server` checks a `tools/list` result (`{"tools":[...]}`), a JSON-RPC envelope with `result.tools`, or a server card with a `tools` array. One list counts as one check. The same call over MCP is `check_server`. Per-tool findings stay on each tool. Top-level findings are only `duplicate-name`, `overlapping-descriptions` (both descriptions need at least 4 content tokens and share at least 4/5 of the shorter set), and `too-many-tools` (more than 20 tools). Send at most 64 tools. The body limit is 128KB.

## Docs

- [Human page](https://agentghostedme.com/): what the checks are, a form that calls POST /v1/check, and the curl for POST /v1/check-server
- [Markdown twin](https://agentghostedme.com/index.md): the same page in markdown
- [One tool per REST endpoint](https://agentghostedme.com/mcp-tools-mapped-1-to-1-onto-a-rest-api.md): answer for MCP tools mapped 1:1 onto a REST API, with the check and the dated sources
- [Server loads, agent never calls](https://agentghostedme.com/mcp-server-loads-but-the-agent-never-calls-it.md): answer for an MCP server that loads while the agent never calls the tool, with the check and the dated source
- [Picking the right subset of parameters](https://agentghostedme.com/picking-the-right-subset-of-parameters.md): answer for an MCP tool with too many top-level input properties, with the check and the dated source
- [OpenAPI](https://agentghostedme.com/openapi.json): HTTP API
- [Rules](https://agentghostedme.com/v1/rules): rule ids, cutoffs, and sources
- [Examples](https://agentghostedme.com/v1/examples): two sample checks computed live
- [Outcome summary](https://agentghostedme.com/v1/outcomes/summary): aggregate counts only
- [MCP discovery card](https://agentghostedme.com/.well-known/mcp.json): name, description, version, and the streamable HTTP remote. Not a registry submission.
- [MCP server card](https://agentghostedme.com/.well-known/mcp/server-card.json): check_tool, check_server, report_outcome, outcome_summary, three read-only resources (toolcard://answers/mcp-tools-mapped-1-to-1-onto-a-rest-api, toolcard://answers/mcp-server-loads-but-the-agent-never-calls-it, and toolcard://answers/picking-the-right-subset-of-parameters), and a skills entry for https://agentghostedme.com/skills/SKILL.md. That URL is not an MCP resource.
- [Agent skill](https://agentghostedme.com/skills/SKILL.md): call check_tool or check_server, then read the three toolcard://answers resources. Served here. Not submitted anywhere.

## Optional

- [Privacy](https://agentghostedme.com/privacy.html): what is stored
- [Terms](https://agentghostedme.com/terms.html): no warranty, no payment yet