# complete_sprint_item Mark a sprint item done. Pass task_id to link the task that shipped it. Pass session_id to get a board_change field (items injected mid-run) and an active-worktree merge reminder in the response. If the item is flagged required_notes, you MUST pass notes= (evidence: what shipped / how verified) or a task_id, or completion is refused (EVIDENCE_REQUIRED). If the item is flagged require_verification (e2e1b682), completion is refused (VERIFICATION_REQUIRED) unless an independent PASS is on file: pass verifier_session_id (a DIFFERENT session id from actor — a fresh, no-memory subsession that inspected the change with read-only tools) and verification_verdict='pass' to file and check the verdict in this same call. fdaa5b55 — if the item has a linked GitHub issue, the response carries a github_issue_action field: issues Meridian itself created (github_issue_source='meridian_auto') are commented on and auto-closed; any other issue (manual/legacy) only gets a proposed-closure comment plus a non-blocking HITL for human review — never auto-closed. 8693b6a8 — claim-ownership gate: if the item is claimed by a DIFFERENT actor than the one completing it, completion is refused (CLAIM_MISMATCH) UNLESS that claim is stale (claimed 2h+ ago, or the claiming session is dead/closed) — the exact stale-cleanup pattern of closing items left behind by a dead session keeps working automatically. For a live, non-stale foreign claim, pass force_foreign_claim=true to explicitly acknowledge and complete anyway. 5fe3502e — pass strict_evidence=true (or flag the item require_strict_evidence=true via update_sprint_item) for STRICT, fail-closed evidence verification: completion is refused (STRICT_EVIDENCE_BLOCKED, with typed evidence_errors codes — EVIDENCE_ABSENT/EVIDENCE_INVALID/EVIDENCE_STALE/WRONG_WORKTREE/UNCLAIMED_EDIT) unless evidence is present, verifiable, fresh, from the right worktree, and every modified file was claimed. Default (no strict_evidence, no require_strict_evidence) behavior is exactly the pre-existing advisory-only evidence checks — nothing changes unless you opt in. a8c0f3b7 — CODE-INTEL PROSPECTING RECEIPT gate: opt in at the PROJECT level via set_capability_manifest(capabilities=[{id:'code_intel_prospecting', ...}]) — no per-call flag needed, and a no-op for projects that never declared it. When declared, completion of an item that has touches_resources and no prospect_bypass is refused (CODE_INTEL_RECEIPT_MISSING) unless a durable receipt shows a real search_graph/find_symbol/prospect_symbol call happened since the item was claimed (see meridian.code_intel_receipt) — or refused (CODE_INTEL_UNAVAILABLE) when the capability is availability_policy='required' and code-intel itself is unavailable. Pass override_code_intel_receipt=true with a non-empty override_reason to acknowledge and complete anyway (audited). 'optional'/'degraded_ok' policies never block — they degrade with a code_intel_receipt_warning on the returned item instead. Persistent-state disclosure: on hosted Meridian, supplied text and project/session metadata are sent to and stored in Meridian's service; self-hosted deployments keep them in the configured local SQLite/Postgres database. This data is visible in the dashboard/API and later project context or handoffs. Delete individual tasks, notes, or decisions where supported, or delete the project/account using the documented controls. Do not include secrets. Agent View of the PolicyLayer registry record for `complete_sprint_item`. HTML page: https://policylayer.com/tools/io-github-ajc3xc-meridian/complete-sprint-item ## Facts - Tool: `complete_sprint_item` - Server: Meridian (`@meridianmcp/mcp`) — https://policylayer.com/tools/io-github-ajc3xc-meridian.md - Install: `npx -y @meridianmcp/mcp` - Homepage: https://github.com/meridianmcp/Meridian - Risk category: Write (Medium risk) - Registry record: grade F, identity unverified - Server auth posture: open - Server CORS policy: * - Server rate-limited: no - Parameters: 12 (1 required) - Recommended policy verdict: Rate-limited ## Parameters | Parameter | Type | Required | Description | | --- | --- | --- | --- | | `actor` | string | no | Executor id/name recorded as having completed the item (defaults to session_id). Checked against the item's claim owner (8693b6a8) — a mismatch on a live, non-s | | `notes` | string | no | Evidence for the completion (what shipped / how it was verified). Persisted on the item; satisfies the required_notes gate. | | `item_id` | string | yes | | | `task_id` | string | no | | | `project_id` | string | no | | | `session_id` | string | no | Optional: include board_change + worktree merge reminder. | | `project_name` | string | no | Project name — an alternative to project_id; resolved to the id internally. project_id wins if both are given. | | `override_reason` | string | no | 5fe3502e — REQUIRED alongside override_strict_evidence=true (or a8c0f3b7's override_code_intel_receipt=true): why the rejection is being overridden. Recorded to | | `strict_evidence` | boolean | no | 5fe3502e — opt in to the STRICT, fail-closed evidence gate for THIS call only (see meridian.sprint_evidence_guard). Omit/false preserves the exact pre-existing | | `verification_notes` | string | no | e2e1b682 — optional free-text explanation from the verifier (especially useful on a fail verdict). | | `force_foreign_claim` | boolean | no | 8693b6a8 — set true to complete an item claimed by a DIFFERENT, still-live (non-stale) actor. An explicit override, never inferred; omit/false for normal comple | | `verifier_session_id` | string | no | e2e1b682 — session id of the fresh, independent, read-only-tools verifier subsession that PASSED/FAILED this item. Must differ from actor/session_id or the requ | Parameters from the server's own tool schema. ## Example call (MCP tools/call, JSON-RPC 2.0) ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "complete_sprint_item", "arguments": { "item_id": "" } } } ``` ## Why complete_sprint_item is rated Medium This tool creates or modifies data reversibly within a task/sprint tracking system. It marks items as complete, which changes their status in the persistent memory store but does not delete or irreversibly destroy data. The conditional logic around notes and verification acts as safeguards for state modification, not irreversible operations. From the tool's own definition: "Tool description states 'Mark a sprint item done' and 'completion is refused' based on conditions, indicating the tool modifies state of sprint items by changing their completion status." Risk signals: High parameter count (15 properties) · Bulk/mass operation — affects multiple targets ## Use case AI agents use complete_sprint_item to create or update resources in Meridian, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Meridian environment. ## Recommended policy (PolicyLayer) Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Meridian: ```json { "version": "1", "default": "deny", "tools": { "complete_sprint_item": { "limits": [ { "counter": "complete_sprint_item_rate", "window": "minute", "max": 30, "scope": "grant" } ] } } } ``` ## Other tools on Meridian (174) - `archive_decision` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/archive-decision.md - `batch_mutate` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/batch-mutate.md - `claim_sprint_item` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/claim-sprint-item.md - `clear_capability_profile` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/clear-capability-profile.md - `clone_profile_layer` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/clone-profile-layer.md - `delete_custom_hook` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/delete-custom-hook.md - `delete_note` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/delete-note.md - `delete_sprint_item_pointer` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/delete-sprint-item-pointer.md - `fan_out_sprint_items` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/fan-out-sprint-items.md - `purge_ai_log` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/purge-ai-log.md - `record_handoff_correction` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/record-handoff-correction.md - `release_docx_region_claims` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/release-docx-region-claims.md - `request_hitl` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/request-hitl.md - `reset_plugin_override` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/reset-plugin-override.md - `reset_profile_layer` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/reset-profile-layer.md - `complete_wave_gate` — Execute — https://policylayer.com/tools/io-github-ajc3xc-meridian/complete-wave-gate.md - `execute_batch` — Execute — https://policylayer.com/tools/io-github-ajc3xc-meridian/execute-batch.md - `prospect_symbol` — Execute — https://policylayer.com/tools/io-github-ajc3xc-meridian/prospect-symbol.md - `run_verification` — Execute — https://policylayer.com/tools/io-github-ajc3xc-meridian/run-verification.md - `start_session` — Execute — https://policylayer.com/tools/io-github-ajc3xc-meridian/start-session.md - `analyze_model_efficiency` — Read — https://policylayer.com/tools/io-github-ajc3xc-meridian/analyze-model-efficiency.md - `analyze_sprint` — Read — https://policylayer.com/tools/io-github-ajc3xc-meridian/analyze-sprint.md - `batch_read` — Read — https://policylayer.com/tools/io-github-ajc3xc-meridian/batch-read.md - `find_outputs_by_source` — Read — https://policylayer.com/tools/io-github-ajc3xc-meridian/find-outputs-by-source.md - `find_similar_equation` — Read — https://policylayer.com/tools/io-github-ajc3xc-meridian/find-similar-equation.md - `find_similar_figure` — Read — https://policylayer.com/tools/io-github-ajc3xc-meridian/find-similar-figure.md - `find_similar_table` — Read — https://policylayer.com/tools/io-github-ajc3xc-meridian/find-similar-table.md - `find_symbol_usages` — Read — https://policylayer.com/tools/io-github-ajc3xc-meridian/find-symbol-usages.md - `get_agent_instructions` — Read — https://policylayer.com/tools/io-github-ajc3xc-meridian/get-agent-instructions.md - `get_blog_posts` — Read — https://policylayer.com/tools/io-github-ajc3xc-meridian/get-blog-posts.md - …and 144 more: https://policylayer.com/tools/io-github-ajc3xc-meridian.md ## For agents This record is a snapshot. Live verdicts and the full registry: - Check every server in your MCP config at once: `npx -y policylayer stack` - Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md) - Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events` --- Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=io-github-ajc3xc-meridian · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/io-github-ajc3xc-meridian