# otlp_span_receipt

OTLP span/trace to receipt bundle; does NOT build a ChainGraph (use build_chaingraph for that). Three modes, chosen by which input is supplied. (1) Pass trace alone to GENERATE a receipt bundle: a per-span receipt (span digest, parent-span receipt digest, semconv_snapshot, eddsa-jcs-2022 signature over an ephemeral did:key) for every span, plus a Merkle-rooted (RFC 6962) trace receipt. (2) Pass bundle ({trace, span_receipts, trace_receipt, issuer_did}) to VERIFY it: recomputes every digest, walks the parent-receipt chain, rebuilds the Merkle root, and reports which spans are attested, unattested, or tampered. (3) Pass run_chain_result (the structuredContent from run_chain) instead of trace to bridge a ChainGraph chain run into an OTLP trace first -- one execute_tool span per successfully-executed step, each carrying its own execution_hash as a span attribute (ocg.execution_hash) -- then generates the same receipt bundle over it. Byte-identical receipt engine to tools/566-otel-span-receipt-verifier.html -- a human's browser-generated bundle and this tool's output interoperate on the exact same wire shape.

Agent View of the PolicyLayer registry record for `otlp_span_receipt`. HTML page: https://policylayer.com/tools/postoaklabs-ainumbers-mcp-apps/otlp-span-receipt

## Facts

- Tool: `otlp_span_receipt`
- Server: Ainumbers Mcp Apps (`postoaklabs/ainumbers-mcp-apps`) — https://policylayer.com/tools/postoaklabs-ainumbers-mcp-apps.md
- Homepage: https://github.com/PostOakLabs/ainumbers-mcp-apps
- Risk category: Execute (High risk)
- Registry record: grade F, identity unverified
- Server auth posture: open
- Server CORS policy: https://ainumbers.co
- Server rate-limited: no
- Parameters: 4
- Recommended policy verdict: Rate-limited

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `trace` | object | no | An OTLP/JSON trace document to generate a receipt bundle over. Omit if passing bundle or run_chain_result. |
| `bundle` | object | no | {trace, span_receipts[], trace_receipt, issuer_did} to VERIFY instead of generate. |
| `service` | string | no | resource service.name to stamp when bridging run_chain_result into a trace. Defaults to "ainumbers-chaingraph-worker". |
| `run_chain_result` | object | no | The structuredContent object returned by run_chain (must include chain and steps[]) -- bridges the chain run into an OTLP trace, then generates a receipt bundle |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "otlp_span_receipt",
    "arguments": {}
  }
}
```

## Why otlp_span_receipt is rated High

Tool executes cryptographic operations and builds signed receipt bundles from trace data.

From the tool's own definition: "generates receipt bundle, computes digests, eddsa signatures, Merkle root"

Risk signals: Bulk/mass operation — affects multiple targets · Admin/system-level operation

## Use case

AI agents invoke otlp_span_receipt to trigger actions in Ainumbers Mcp Apps. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

## Recommended policy (PolicyLayer)

Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Ainumbers Mcp Apps:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "otlp_span_receipt": {
      "limits": [
        {
          "counter": "otlp_span_receipt_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}
```

## Other tools on Ainumbers Mcp Apps (687)

- `agentic_mandate_sandbox` — Execute — https://policylayer.com/tools/postoaklabs-ainumbers-mcp-apps/agentic-mandate-sandbox.md
- `allocate_ihb_interest` — Execute — https://policylayer.com/tools/postoaklabs-ainumbers-mcp-apps/allocate-ihb-interest.md
- `amortize_asc606_commissions` — Execute — https://policylayer.com/tools/postoaklabs-ainumbers-mcp-apps/amortize-asc606-commissions.md
- `anchor_document_integrity` — Execute — https://policylayer.com/tools/postoaklabs-ainumbers-mcp-apps/anchor-document-integrity.md
- `apply_climate_scenario` — Execute — https://policylayer.com/tools/postoaklabs-ainumbers-mcp-apps/apply-climate-scenario.md
- `assemble_aiuc1_evidence_pack` — Execute — https://policylayer.com/tools/postoaklabs-ainumbers-mcp-apps/assemble-aiuc1-evidence-pack.md
- `assemble_ocg_evidence_bundle` — Execute — https://policylayer.com/tools/postoaklabs-ainumbers-mcp-apps/assemble-ocg-evidence-bundle.md
- `attest_bulk_disbursement_integrity` — Execute — https://policylayer.com/tools/postoaklabs-ainumbers-mcp-apps/attest-bulk-disbursement-integrity.md
- `attest_calc_agent_independence` — Execute — https://policylayer.com/tools/postoaklabs-ainumbers-mcp-apps/attest-calc-agent-independence.md
- `attest_daily_reconciliation` — Execute — https://policylayer.com/tools/postoaklabs-ainumbers-mcp-apps/attest-daily-reconciliation.md
- `attest_margin_call_lifecycle` — Execute — https://policylayer.com/tools/postoaklabs-ainumbers-mcp-apps/attest-margin-call-lifecycle.md
- `bind_attested_subject` — Execute — https://policylayer.com/tools/postoaklabs-ainumbers-mcp-apps/bind-attested-subject.md
- `build_226j_response_evidence_pack` — Execute — https://policylayer.com/tools/postoaklabs-ainumbers-mcp-apps/build-226j-response-evidence-pack.md
- `build_agent_test_evidence` — Execute — https://policylayer.com/tools/postoaklabs-ainumbers-mcp-apps/build-agent-test-evidence.md
- `build_agent_traffic_policy` — Execute — https://policylayer.com/tools/postoaklabs-ainumbers-mcp-apps/build-agent-traffic-policy.md
- `build_ai_conformity_pack` — Execute — https://policylayer.com/tools/postoaklabs-ainumbers-mcp-apps/build-ai-conformity-pack.md
- `build_ai_workpaper_record` — Execute — https://policylayer.com/tools/postoaklabs-ainumbers-mcp-apps/build-ai-workpaper-record.md
- `build_allocation_decision_receipt` — Execute — https://policylayer.com/tools/postoaklabs-ainumbers-mcp-apps/build-allocation-decision-receipt.md
- `build_amortization_schedule` — Execute — https://policylayer.com/tools/postoaklabs-ainumbers-mcp-apps/build-amortization-schedule.md
- `build_ap2_cartmandate_hashchain` — Execute — https://policylayer.com/tools/postoaklabs-ainumbers-mcp-apps/build-ap2-cartmandate-hashchain.md
- `build_cbcr_report` — Execute — https://policylayer.com/tools/postoaklabs-ainumbers-mcp-apps/build-cbcr-report.md
- `build_chaingraph` — Execute — https://policylayer.com/tools/postoaklabs-ainumbers-mcp-apps/build-chaingraph.md
- `build_claim_dispute_bundle` — Execute — https://policylayer.com/tools/postoaklabs-ainumbers-mcp-apps/build-claim-dispute-bundle.md
- `build_conditional_relief_collateral_receipt` — Execute — https://policylayer.com/tools/postoaklabs-ainumbers-mcp-apps/build-conditional-relief-collateral-receipt.md
- `build_conversion_receipt` — Execute — https://policylayer.com/tools/postoaklabs-ainumbers-mcp-apps/build-conversion-receipt.md
- `build_digest_manifest` — Execute — https://policylayer.com/tools/postoaklabs-ainumbers-mcp-apps/build-digest-manifest.md
- `build_disclosure_manifest` — Execute — https://policylayer.com/tools/postoaklabs-ainumbers-mcp-apps/build-disclosure-manifest.md
- `build_dora_roi_register` — Execute — https://policylayer.com/tools/postoaklabs-ainumbers-mcp-apps/build-dora-roi-register.md
- `build_dual_control_certification` — Execute — https://policylayer.com/tools/postoaklabs-ainumbers-mcp-apps/build-dual-control-certification.md
- `build_etr_possession_chain` — Execute — https://policylayer.com/tools/postoaklabs-ainumbers-mcp-apps/build-etr-possession-chain.md
- …and 657 more: https://policylayer.com/tools/postoaklabs-ainumbers-mcp-apps.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=postoaklabs-ainumbers-mcp-apps · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/postoaklabs-ainumbers-mcp-apps