If your system can call tools, it can use Keon.
Keon exposes a standard MCP tool surface. Your existing client connects directly. Keon handles policy evaluation, identity binding, and receipt issuance on every call.
{
"method": "tools/call",
"params": {
"name": "keon.governed.execute.v1",
"arguments": {
"purpose": "Summarize recent emails",
"mode": "decide_then_execute"
}
}
}From your agent's perspective, that's the entire integration surface.
Decide before execute. Receipt every outcome.
Any MCP-compatible client issues a standard tools/call request. No Keon-specific SDK, no custom protocol. If your system can call tools, it can call Keon.
The request enters the governance boundary. Keon binds tenant and actor, checks tool scope, and Runtime returns a policy decision — approved or denied — carrying the PolicyHash it was evaluated under. No effect occurs before this step completes.
Authorized actions execute within the governed boundary. The response carries a receipt envelope alongside the result — directive, intent, request, decision, execution, and outcome IDs — proof of what was decided, under which policy, by which authority. A denial is a governed outcome, not an error: the chain is still returned, with the execution receipt null.
The integration stays small because the boundary is doing the work.
Keon does not require you to abandon your orchestration layer. If it speaks MCP, it already speaks Keon.
You do not build policy evaluation, receipt issuance, or audit trails. Keon handles all of it behind the tool boundary. Your integration code stays small.
Keon exposes a standard MCP tool surface. No proprietary protocol, no special transport. Connect the way you connect to any MCP server.
Every governed execution produces a signed DecisionReceipt. Use them for agent memory, audit logs, compliance reporting, or downstream system coordination.
Tenant binding, actor identity, and policy enforcement are handled by Keon. If policy cannot be evaluated, execution does not proceed.
Keon speaks MCP. Your stack probably already fits.
Three tiers. Additive. Enforced on every call.
Every credential carries a package tier. The tier decides which tools appear in tools/list and which invocations are authorized. Authority does not change with tier — Runtime remains the only approval authority for effects at every level.
Route any resource action through Runtime policy evaluation and get the receipt chain back. Includes a decide-only preflight so you can rehearse a policy outcome without causing one.
- keon.governed.execute.v1
- keon.launch.hardening.v1
- keon.governance.noop.v1
- keon.browseahead.scan.v1
Memory writes are stored only after Runtime approves them, so every shard is bound to a decision receipt. Reads cover search, receipt and lineage retrieval, Ed25519-signed evidence packs, and deterministic replay verification over a shard sequence.
- keon.cortex.memory.write.v1
- keon.cortex.memory.search.v1
- keon.cortex.receipt.get.v1
- keon.cortex.lineage.get.v1
- keon.cortex.evidence.get.v1
- keon.cortex.replay.query.v1
Five non-effecting cognition tools produce candidates without touching the execution boundary. Only handoff.dispatch crosses it, and it calls Runtime directly — after resolving the supplied Cortex lineage reference against the calling tenant.
- keon.collective.deliberate.v1
- keon.collective.compare.v1
- keon.collective.adversarial_review.v1
- keon.collective.collapse.v1
- keon.collective.handoff.prepare.v1
- keon.collective.handoff.dispatch.v1
A Collective-tier credential can call every tool. A Cortex-tier credential can call Runtime and Cortex tools.
Out-of-tier tools are omitted from discovery entirely. Your client never sees a tool it cannot call.
Discovery filtering is not the control. Every invocation re-checks entitlement; an out-of-tier call returns DENIED_ENTITLEMENT.
Tier decides what exists. Scope decides what you may do with it — keon:cortex:read, keon:collective:dispatch, and so on.
Traditional systems execute first. Keon decides first.
Receipts are issued before execution, not reconstructed after the fact.
Every receipt carries the PolicyHash of the version active at evaluation time.
Authorization is not assumed. It is declared, evaluated, and proven at every execution boundary.
Cortex tier returns an evidence pack for a governed shard with an Ed25519 signature, key ID, and algorithm. Canonicalize the pack the way Cortex does before verifying — the payload is re-serialized in transit, so hashing the bytes as received will not match.
Replay recomputes value hashes over a caller-supplied shard sequence and reports per-shard match. A blank entry is rejected rather than skipped, so a partial replay cannot pass as a complete one.
Collective dispatch resolves the supplied Cortex lineage reference against the calling tenant before any Runtime call. If it does not resolve, or Cortex is unreachable, the call fails closed and no decision is made.
MCP is primary. The pre-MCP surface exists for compatibility.
POST /mcp Streamable HTTP. initialize → tools/list → tools/call. Protocol versions: 2025-11-25, 2025-06-18, 2025-03-26
POST /mcp/tools/list POST /mcp/tools/invoke Pre-MCP surface. Do not build new integrations on it.
Keon.McpGateway --stdio For MCP clients that launch a server process rather than attaching custom headers.