agent access · MCP-native
Fluency is not evidence. This is the record that goes underneath it.
Software split by domain: one tool for HR, one for marketing, one for finance. AI is splitting the same way. Anywhere a wrong answer costs money, the model will need a record it can cite. Regulation is where that bites hardest, because there a confident wrong answer costs a licence.
why a general model must fail here
A language model fails on a regulatory question not because it reasons badly but because it has nothing to reason over. The text it is paraphrasing may have moved since it was trained, and it has no way to know.
This is not a problem a larger model fixes, because what is missing is not capability but ground truth: a record that is dated, sourced, and able to say when it expires. CBSR is that record, published in the shape an agent reads rather than in the shape a person reads and an agent guesses at.
The fields a grounded answer has to carry
Below is what compose() returns for one corridor. The thing to read is not the verdict but the ring around it: every field beside the verdict exists so that the verdict can be shown to have been wrong later.
// compose(origin="EU", destination="US", as_of="2026-08-20") { "corridor": "EU>US", "class": "T", // regime in transition "mechanism": "commencement_pending", "binding_at": "destination_inbound_gate", "provision": "GENIUS Act §18", "status": "enacted_not_commenced", // NOT citable as current law "resolves_on": "2027-01-18", "resolves_to": "II", "claim_class": "tier1_legal", "evidence_tier": "resolution_text", "as_of": "2026-08-20", "register": "v0.11.0", "doi": "10.5281/zenodo.20730358" }
Field names follow the register schema; the shape above is illustrative. status is a separate field rather than a caveat in prose — which is exactly why a statute that is enacted and not commenced cannot be served as current law.
Without as_of, nothing expires
An answer with no date never goes stale and so never turns out to have been wrong. That is not caution. It is unfalsifiability.
Without a provision, nothing is arguable
“Under MiCA” is not a citation. The article is. A pinpoint is what lets someone go back to the text and tell you that you read it wrong.
Without status, pending reads as in force
This is the single most common failure of an unaided model, and it makes it confidently. Here it is a named state, not a hedge.
Without a version, nothing can be audited
The register is dated by construction, so a citation that omits the version cites nothing in particular. Every release is archived to Zenodo and can be fetched back.
Roughly thirty typed tools over one record
The register ships as a single dataset.json and an MCP server that exposes it to agents. The tools are typed: arguments are constrained by the schema and so are returns, so what reaches the model is structure rather than prose it has to parse a second time.
| Tool family | What an agent does with it | Key fields returned |
|---|---|---|
| compose() | Resolve one directed edge: origin → destination, read at a given date. This is the one that gets called most. | class · mechanism · provision · as_of |
| compose(as_of=…) | The same edge at another date. Scheduled commencements are applied, so “not today, but then” is a computed verdict rather than a forecast. | resolves_on · resolves_to · trigger |
| citable_law() | Take only the subset that may be cited as current binding law. Called when the answer is going into a memorandum, an opinion, or a filing. | 46 records · claim_class · evidence_tier |
| jurisdiction | Pull one jurisdiction across every dimension: issuance, redemption, reserves, investor gating, AML, cross-border, and the rest. | 15 dimensions · per-record sourcing |
| dimension | Cut one dimension across every jurisdiction. This is the shape of “who prohibits yield and who does not”. | 12 jurisdictions · comparability notes |
| backlog | Fetch the cells that have not yet cleared the full citable bar. The gap is queryable data, not a disclaimer. | per-cell worklist · what is missing |
the tool list lives in the repository
The table groups by function; it is not a signature list. The authoritative names, arguments, and return shapes are in MCP_SERVER.md in the register repository, and they move with the version. Take that as canonical, not this page.
Four failures an ungrounded model cannot avoid on its own
These are not four names for hallucination. They are four distinct mechanisms, each stopped by a different device on the data side, and each of which reads as perfectly normal output when ungrounded.
Citing law that has not commenced
The model reads an enacted statute and describes an application route that does not exist today. The device: status is a separate field, and the build refuses to admit an enacted_not_commenced record into the citable subset.
Answering a directed question as if it were symmetric
The model gives a verdict “between the EU and the US” when the binding rule sits on the destination side. The device: the dataset's unit is the directed edge, and 56 of the 66 pairs here read differently by direction.
Serving a market fact as a proposition of law
“Major issuers generally do this” comes back as “the rules require this”. The device: claim_class separates the two, and a market fact cannot enter the instrument a lawyer is shown.
Producing an answer that cannot expire
The answer is not wrong, but it does not say which day's law it read, so six months later nobody can tell whether it still holds. The device: every verdict carries an as_of and a register version, both in the return value.
None of the four is fixed by prompting. Each requires the model to hold something it does not have: a record that is dated, that can point at where it came from, and that admits which of its cells are not yet verified.
how to wire it up
No account, no key, no rate card. Code under Apache-2.0, data under CC-BY-4.0, run your own copy.
Pin a version
Take a DOI'd release from Zenodo rather than following main. You will want to reproduce today's answer in six months, and a moving branch cannot do that.
Mount the MCP server in your agent
Follow the configuration in MCP_SERVER.md. The tools are typed, so the model receives structure and does not have to scrape fields back out of prose.
Require the envelope in the answer
State it in the system prompt: any regulatory verdict must carry provision, status, as_of, and the version. If one is missing, go back to the tool rather than reaching for “as far as I know”.
Degrade against the backlog
When asked about a cell that has not cleared the full citable bar, the right behaviour is to say it is on the worklist, not to promote a regime-level confirmation into a provision-level one.