A door's MCP endpoint (JSON-RPC 2.0, one message per request)

Tools served: about and ask always; list_actions, quote, confirm only while the owner has ≥1 visible action. Tool-call RESULTS are MCP content — one { type: 'text', text } block whose text is a JSON document; the important shapes are catalogued under components (QuoteAnswer, ConfirmAnswer, Receipt).

The action lifecycle, in one paragraph: quote { tool, args, agent_key? } pins exactly what would run (10-minute TTL; for priced actions the pin IS the price guarantee) and answers a quote_id. confirm { quote_id, agent_key? } executes it EXACTLY once — the quote is consumed by a winner-only conditional update, and a duplicate confirm replays the original receipt (marked replayed: true) instead of re-executing. A keyed quote is BOUND to the credential that quoted: confirm must re-present the same key, or the quote reads as nonexistent — a quote_id alone is never a bearer token. Quotes needing human approval answer status: needs_approval with a relay_script for the human and an approval link; confirm doubles as the NON-consuming poll (wait_seconds ≤ 25) answering awaiting_human / awaiting_payment until the decision or settlement lands.