# H/M MCP Activation Lab

Find the first static friction between MCP discovery and a useful tool request.

- Web: `https://hogarmas.net/mcp-activation-lab/`
- Stateless API: `POST https://hogarmas.net/api/mcp-activation-lint`
- Report schema: `hm.mcp-activation-lint.v1`
- Receipt schema: `hm.mcp-activation-receipt.v1`
- Ruleset: `mcp-2025-11-25-static-activation-v1`

## Browser-local workflow

Paste an MCP `initialize` result and a `tools/list` result. The browser checks five static stages:

1. Orient: server identity, tools capability and initialize instructions.
2. Choose: catalog presence, valid unique names and outcome descriptions.
3. Authorize: tool annotations and any payment boundary.
4. Invoke: object-root input schemas and a low-friction first tool.
5. Verify: an explicit result contract for the first-value tool.

Source JSON remains in the browser. Only an aggregate `mcp-activation-lint-run` event is counted on the production website.

## Stateless API

```http
POST /api/mcp-activation-lint
Content-Type: application/json

{
  "initialize": {
    "serverInfo": { "name": "example", "version": "1.0.0" },
    "capabilities": { "tools": {} },
    "instructions": "Start with inspect_activation."
  },
  "tools": {
    "tools": []
  }
}
```

The body limit is 64 KB. The endpoint is stateless and does not persist request content.

## Evidence boundary

The result is deterministic static metadata analysis. It does not execute a tool, prove a successful outcome, verify identity, produce a security or compliance verdict, estimate conversion probability, or represent the global MCP ecosystem.

Tool annotations are treated as untrusted client hints, not authorization enforcement.