InterAI Risk Oracle

What InterAI Risk Oracle MCP server does

The InterAI Risk Oracle MCP server is intended for pre-execution decisions on actions that may create external, financial, operational, or irreversible consequences. An agent proposes an action and its context; the service evaluates that proposal against applicable policy and returns a machine-readable authority result.

The central result is one of three recommendations: allow, review_required, or block. Responses can also include policy findings, a durable trust_receipt_id, an execution_intent_digest, and policy provenance. The current hosted beta additionally exposes fields such as score, risk_level, and diagnostic signals, but those are compatibility fields rather than the primary authority contract.

The InterAI Risk Oracle MCP server does not perform the proposed action. A surrounding execution host must decide how to route the result, verify the receipt and exact intent, and either execute, escalate, or abort.

How it works

The host submits a proposed action together with execution context. For authenticated autonomous execution, policy is composed in this order: host, account, caller, then effective policy. Host requirements form an irreducible floor, account policy is attached after credential resolution, and caller constraints may restrict the request further but cannot weaken earlier requirements.

For executable pilot authorization, the host builds a canonical action envelope and an attested execution context. InterAI returns a canonical execution intent and digest; an authenticated allow may also receive a short-lived, single-use execution authorization. Before causing a side effect, the host must rebuild the final invocation, recompute the digest, validate the authorization, and fail closed if any relevant field differs.

A change to the tool, arguments, actor, run, workspace, environment, destination, or relevant policy requires a new decision. Review outcomes are not authorizations, and a reviewed or overridden action becomes a new proposed intent.

Setup and configuration

The provided material documents hosted endpoints for an Action Boundary Lab, a controlled safe demo, and an OpenAPI description. It does not provide MCP installation commands, transport details, package names, client configuration, or environment variables. Integrators therefore need to consult the repository and service documentation for deployment-specific setup.

The service can be used with account-associated policy or with accountless execution. Accountless requests do not resolve an account profile and use the host-to-caller policy path. Account policy administration is described as InterAI-administered rather than customer self-service.

Tools and capabilities

The documented capabilities include:

• Evaluating a proposed consequential action before execution.
• Returning allow, review_required, or block authority decisions.
• Producing trust receipts and deterministic execution-intent digests.
• Applying host, account, and caller policy constraints.
• Accepting signed external assertions as verified, bound, non-authoritative evidence.

External providers can contribute assertions, but their verdicts do not directly become InterAI authority decisions. InterAI verifies and records that evidence while retaining execution authority.

Limitations and notes

The InterAI Risk Oracle MCP server is a decision layer, not an executor, authentication system, permission manager, spend-limit engine, or universal workflow controller. It complements those controls rather than replacing them.

Execution authorizations are valid for 1–300 seconds, with 60 seconds as the default, and are single-use. InterAI does not provide universal distributed replay prevention across external runtimes; the host must durably consume authorizations atomically when that guarantee is needed.

The documented external-evidence mode is intentionally non-authoritative. Provider results such as PASS, CAUTION, or BLOCK remain assertions and do not directly determine InterAI's ALLOW, REVIEW_REQUIRED, or BLOCK output. The supplied material also does not identify supported MCP clients or provide a license declaration.