End-to-end example

This flow initializes the MCP session, discovers capability-dependent tools, obtains an access token, starts a Task Guard task, checks a material action, runs Secure and Govern, records the result, and completes the task.

Replace https://mcp.maetra.io with your deployed MCP host.

1. Initialize#

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "initialize",
  "params": {
    "protocolVersion": "2024-11-05",
    "capabilities": {},
    "clientInfo": { "name": "billing-bot", "version": "0.1.0" }
  }
}

The response includes server instructions for the capabilities enabled in the workspace.

2. Discover tools#

{ "jsonrpc": "2.0", "id": 2, "method": "tools/list" }

The result always includes get_mcp_access, then includes only the Task Guard, Secure, and Govern tools allowed for the current workspace and key.

3. Get capability access#

{
  "jsonrpc": "2.0",
  "id": 3,
  "method": "tools/call",
  "params": {
    "name": "get_mcp_access",
    "arguments": {}
  }
}

Read structuredContent.mcp_access_token, expires_at, and the enabled capabilities. The examples below use <ACCESS_TOKEN> for that short-lived value.

Call get_mcp_access again at the beginning of every new user turn or work cycle.

4. Start the Task Guard task#

If Task Guard is enabled:

{
  "jsonrpc": "2.0",
  "id": 4,
  "method": "tools/call",
  "params": {
    "name": "start_task",
    "arguments": {
      "mcp_access_token": "<ACCESS_TOKEN>",
      "session_ref": "conversation_01JY8Q",
      "objective": "Process the approved customer refund.",
      "constraints": ["Do not modify unrelated customer records."],
      "success_criteria": ["Refund is processed and recorded."],
      "in_scope": ["Validate refund", "Request approval", "Execute refund"],
      "out_of_scope": ["Change billing provider configuration"],
      "agent_name": "billing-bot",
      "host_type": "CUSTOM_MCP",
      "confirmation_capable": true,
      "effect_reporting_capable": true,
      "idempotency_key": "task-start-01JY8Q"
    }
  }
}

Retain the returned task anchor and contract_version.

5. Check task alignment#

Before the material action:

{
  "jsonrpc": "2.0",
  "id": 5,
  "method": "tools/call",
  "params": {
    "name": "check_task_alignment",
    "arguments": {
      "mcp_access_token": "<ACCESS_TOKEN>",
      "session_ref": "conversation_01JY8Q",
      "action": "Submit a $5,000 refund to the billing provider",
      "action_type": "execute",
      "effect": "TRANSFER",
      "effects": ["Transfer $5,000 to the customer"],
      "tool_name": "billing_api",
      "operation": "create_refund",
      "contract_version": 1,
      "external_action_id": "refund-action-01JY8V",
      "idempotency_key": "alignment-01JY8V",
      "provenance": "HOST_VERIFIED"
    }
  }
}

Proceed only for ALIGNED or SUPPORTING. Explain NEEDS_EXPLANATION, ask the user inline for USER_CONFIRMATION_REQUIRED, refresh context for CONTEXT_REFRESH_REQUIRED, and replan or stop for REFOCUS or STOPPED.

6. Run Secure#

If Secure is enabled, scan the tool call before execution:

{
  "jsonrpc": "2.0",
  "id": 6,
  "method": "tools/call",
  "params": {
    "name": "check_action",
    "arguments": {
      "mcp_access_token": "<ACCESS_TOKEN>",
      "scan_type": "tool_call",
      "tool_name": "billing_api",
      "agent_name": "billing-bot",
      "content": "{\"operation\":\"create_refund\",\"amount\":5000,\"currency\":\"USD\"}"
    }
  }
}

Do not proceed when Secure returns blocked. Review flagged according to your workflow.

7. Request Govern approval#

If Govern is enabled:

{
  "jsonrpc": "2.0",
  "id": 7,
  "method": "tools/call",
  "params": {
    "name": "request_approval",
    "arguments": {
      "mcp_access_token": "<ACCESS_TOKEN>",
      "action": "transfer_funds",
      "agent_name": "billing-bot",
      "autonomy_level": "L3",
      "payload": { "amount": 5000, "currency": "USD", "to": "acct_9931" },
      "reasoning": "Customer refund exceeds the auto-approve limit."
    }
  }
}

If the result is pending, poll:

{
  "jsonrpc": "2.0",
  "id": 8,
  "method": "tools/call",
  "params": {
    "name": "get_approval_status",
    "arguments": {
      "mcp_access_token": "<ACCESS_TOKEN>",
      "checkpoint_id": "cp_7Yh2Qa",
      "wait_seconds": 30
    }
  }
}

Keep polling until terminal. Execute only after approved.

8. Execute and report the effect#

After every enabled control permits the action and the refund runs:

{
  "jsonrpc": "2.0",
  "id": 9,
  "method": "tools/call",
  "params": {
    "name": "record_action_effect",
    "arguments": {
      "mcp_access_token": "<ACCESS_TOKEN>",
      "check_id": "tgc_01JY8W",
      "actual_effect": "TRANSFER",
      "actual_effects": ["Transferred $5,000 to customer account acct_9931"],
      "summary": "The approved refund completed successfully.",
      "validation_outcome": "Billing provider returned succeeded."
    }
  }
}

If effect_aligned is false, ask the session user inline before expanding further.

9. Complete the task#

{
  "jsonrpc": "2.0",
  "id": 10,
  "method": "tools/call",
  "params": {
    "name": "complete_task",
    "arguments": {
      "mcp_access_token": "<ACCESS_TOKEN>",
      "session_ref": "conversation_01JY8Q",
      "summary": "The approved refund was processed and recorded.",
      "completion_event_id": "complete-01JY9Z"
    }
  }
}

Batching#

You can batch independent JSON-RPC requests such as initialize and tools/list. Do not batch get_mcp_access with capability calls that need its returned token. Do not batch sequential Task Guard, Secure, Govern, execution, and effect-reporting steps whose inputs or permission depend on the prior result.