{"name":"xyz.pflow.sim/whatif","slug":"sim-whatif","title":null,"description":"Conversational what-if simulation: build, diagnose and compare Petri-net models; CC0 catalog.","url":"https://mcp.market/server/sim-whatif","rating":null,"grade":"C","score":60,"certified":false,"status":"active","category":"other","tags":[],"presence":{"score":8,"stars":null,"forks":null,"downloads_week":null,"last_push_at":null,"license":null},"uptime":{"percent":100,"checks":19,"ok":19,"last_checked_at":"2026-09-24T05:01:17.003Z","last_ok_at":"2026-09-24T05:01:17.003Z","latency_ms":265},"claimed":false,"transport":"remote","callable_via_gateway":true,"default_price_micros":0,"repository":null,"website":"https://sim.pflow.xyz","version":"1.0.0","remotes":[{"type":"streamable-http","url":"https://sim.pflow.xyz/mcp"}],"packages":[],"tools":[{"name":"sim_bind","description":"Record an intended connection between two stored models' declared ports — fromModel's fromPort feeding toModel's toPort — as a new content-addressed Binding, alongside sim_link's Relation graph rather than inside either model (ROADMAP.md Phase 9). This does not run anything, does not validate that either port exists or has the right direction, and does not touch either model: it is a proposal to connect, discoverable afterward via sim_edges on either model id (a from/to Relation is recorded automatically) or sim_get_binding on the id this returns. Storing the same from/to/transform twice returns the same id rather than a duplicate.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"fromModel":{"description":"id of the model supplying the connection's output","type":"string"},"fromPort":{"description":"element id of the declared output port on fromModel (see GET /api/models/{id}/ports)","type":"string"},"toModel":{"description":"id of the model receiving the connection","type":"string"},"toPort":{"description":"element id of the declared input port on toModel","type":"string"},"transform":{"description":"free-text account of how fromPort's value becomes toPort's — a unit scale, a resample window, an aggregation. Not yet interpreted by anything; recorded for whoever builds the pipeline runner","type":"string"}},"required":["fromModel","fromPort","toModel","toPort"]}},{"name":"sim_calibrate","description":"Calibrate a model against YOUR event log — the reading that meets reality. Upload CSV (case_id, activity, timestamp; the shape sim_dataset emits, activities = transition ids), and rates are learned from the observed timings: sources from inter-arrival times, services from the gap before their completions, all per hour. Instant-pickup transitions (declared rate >= 100) keep their declared rate — their observed gap is the queue wait, and learning it would destroy the calibration discipline. A transition declaring a delay (a fixed-duration timer, not a rate) is fit differently and returned in learnedDelays instead of learnedRates: the MEDIAN observed gap, in hours, written onto the transition itself since a delay has no solver-map slot — a gapCV in rateEvidence far from 0 means the log looks exponential, not fixed, and the calibration says so in a caveat rather than trusting the median anyway. Returns a NEW content-addressed model (learned rates in the solver map, learned delays on the transitions, declared values otherwise untouched, lineage recorded) plus a conformance report: fittingPercent (full replays) is the headline, worst traces named with the activities that could not fire. tokenFitness is a second, harsher reading of the same replay (raw tokens present vs. required at every step, not full-trace success) that under-reads any net with a resource pool — read fittingPercent, not tokenFitness, unless you specifically want the raw-token number. Every learned rate or delay has an entry in rateEvidence: n (gaps it rests on), gapCV (sample std dev over mean of those gaps; ~1 for exponential timings, near 0 for a true timer) and insufficient when n < 2 — n=0 yields nothing, n=1 a value with no spread. Learned values on a structure that cannot replay the traces would be numerology — read fittingPercent before trusting them.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"id":{"description":"model id to calibrate","type":"string"},"log":{"description":"the event log, as CSV text","type":"string"}},"required":["id","log"]}},{"name":"sim_canonical","description":"Tell whether two differently-labelled models are actually the same net: an isomorphism-invariant id computed from the model's EXACT automorphism orbits (orbits.go), not the colour-refinement (WL) kind sim_classify falls back to when the exact search can't decide. Two models differing only by renaming places or transitions share the same canonicalId even though their content-addressed ids (from sim_get_model) differ — this is the id to compare, not the model id, when checking whether a catalog already holds this net. Also returns the non-trivial automorphism orbits and generator count the id was computed from: zero generators means the net is rigid (no symmetry at all), which is itself a fact about the net's structure. Refuses (as a tool error) when the exact search exceeds its 200,000-leaf budget — too large or too symmetric for this implementation, per orbits.go — rather than silently falling back to a weaker answer; sim_classify's own fallback covers that case for classification specifically.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"id":{"description":"model id","type":"string"}},"required":["id"]}},{"name":"sim_classify","description":"Discover the parameter classes of a stored model and return them as JSON-LD with empty annotation slots for you to fill in (label, comment, unit, domain, substitutes — nothing else; membership/kind/evidence are derived and settled by measurement, not yours to edit). With verify=true a shared colour is checked by exact automorphism proof where the search can decide it (settling interchangeability outright, the stronger claim), falling back to the sampled permutation experiment only where it can't — the exact search refuses past a 200,000-leaf budget on nets too large or too symmetric for it. Read the sim://docs/classification resource once for the colour-refinement caveat and the annotation contract in full.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"id":{"description":"model id","type":"string"},"inline_context":{"description":"embed the full JSON-LD @context map in the result instead of the URL it is served from (https://sim.pflow.xyz/ns/v1/context). Default false: the URL resolves to the identical map, so only set this for an offline consumer that cannot fetch it.","type":"boolean"},"verify":{"description":"run the permutation experiment (costs simulation; default false, and classes then say they are candidates)","type":"boolean"}},"required":["id"]}},{"name":"sim_code_to_flow","description":"Derive a Petri-net model from source code with the configured LLM (control flow, state machine, resources or concurrency focus), validate it, and store it as a NEW model you own. The same generator the /api/code-to-flow endpoint uses; refused when this deployment has no LLM provider configured. Returns the new id when the answer validates, otherwise the raw model JSON and the validation errors so you can fix and sim_create_model it by hand.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"code":{"description":"source code to analyse","type":"string"},"focus":{"description":"control-flow (default), state-machine, resources or concurrency","type":"string"},"language":{"description":"source language hint, e.g. go, python, javascript","type":"string"},"name":{"description":"name for the derived model","type":"string"}},"required":["code"]}},{"name":"sim_compare","description":"Run several scenarios against one model on one shared seed and return them side by side — the seed sharing is server-enforced, so differences are the scenarios, not the dice. Returns a summary by default (finals, throughput/mean/P95 metrics, contention, depletion — no time series); pass full=true for the complete trajectories, which run to hundreds of KB. A scenario carrying \"summary\": true stays summarized even under full=true, so one comparison can chart some scenarios and only read the rest. Unset hours default to 8, samples to 60 (the trajectory grid, which only matters under full=true — metrics are time-weighted and do not depend on it) and realizations to 16 per scenario. Each scenario can set its own \"engine\" (see sim_scenario / docs/engine-selection.md); comparing an \"ode\" run against an \"ssa\" one is legitimate but the shared seed only removes dice from scenarios using the same engine.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"full":{"description":"include the sample-grid time series in every result (large; default false); a scenario with its own \"summary\": true is left summarized regardless","type":"boolean"},"id":{"description":"model id","type":"string"},"scenarios":{"description":"JSON array of scenarios, each with a name, e.g. [{\"name\":\"today\",\"hours\":8},{\"name\":\"one more\",\"hours\":8,\"marking\":{\"staff\":3}},{\"name\":\"bigger batches\",\"hours\":8,\"params\":{\"batch_size\":6}}]","type":"string"}},"required":["id","scenarios"]}},{"name":"sim_components","description":"List the component registry: pre-baked subnet templates (arrivals, service, hazard, inventory, decision, mailbox, datastore) with the calibration discipline baked into the arcs and rates. Each entry names its ports (places you can attach onto existing places), its params with recommended defaults, and the discipline notes explaining WHY the template is shaped the way it is. Compose them with sim_compose.","write_action":false,"price_micros":0,"input_schema":{"type":"object"}},{"name":"sim_compose","description":"Instantiate a registry component into a model and store the result as a NEW content-addressed model you own (lineage recorded when composing onto an existing id). Omit id to start a model from the component alone; pass attach to fuse a component port onto one of the model's existing places (e.g. attach {\"queue\": \"tickets_queue\"} wires a hazard onto the service's queue). Prefix namespaces the created elements (defaults to the component name). Three calls build a working helpdesk: arrivals, then service attached to its queue, then hazard attached to the same queue — the result passes diagnose because the discipline is in the template.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"attach":{"description":"JSON object mapping port name -> existing place id","type":"string"},"component":{"description":"registry component name (see sim_components)","type":"string"},"id":{"description":"model to compose onto; omit to start fresh","type":"string"},"name":{"description":"model name for the stored result (kept from the base when composing onto an id)","type":"string"},"params":{"description":"JSON object overriding param defaults, e.g. {\"staff\": 3}","type":"string"},"prefix":{"description":"instance prefix for created elements (default: component name)","type":"string"}},"required":["component"]}},{"name":"sim_conformance","description":"Check how well a stored model matches an observed event log WITHOUT rewriting its rates — the read sim_calibrate bundles into calibration, offered on its own and in full: fitness (can the model replay each case?), precision (does it allow behaviour never observed?), generalization and simplicity, with per-trace diagnostics naming the activities that could not fire. Log is CSV (case_id, activity, timestamp; the shape sim_dataset emits, activities = transition ids). The log is replayed one case at a time from the model's initial marking, so the model should be the per-case workflow; a resource net whose places are shared across cases will not fit. Caveats name what the analysable net encoded lossily.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"id":{"description":"model id","type":"string"},"log":{"description":"the event log, as CSV text","type":"string"}},"required":["id","log"]}},{"name":"sim_create_collection","description":"Mint a named Collection and return its content id. A collection carries no member list of its own — a mutable list would change the collection's own id every time something joined it, the same reason Lineage lives beside a model rather than inside it. Add members with sim_link(collectionID, \"hasMember\", memberID) and read them back with sim_neighbors(collectionID, \"hasMember\") or sim_edges(collectionID). Content-addressed: creating a collection with a name already used returns the existing id, not a new sibling.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"name":{"description":"collection name","type":"string"}},"required":["name"]}},{"name":"sim_create_model","description":"Store a Petri-net model (JSON with name/places/transitions/arcs) and return its content id. Models are immutable; a changed model is a new id. Structural validation rejects malformed nets with every reason at once.\n\nThe model is yours: it appears only in your own listing until you dedicate it to the commons with sim_license_model, and you can remove it with sim_delete_model. Anyone you give the id to can use it either way.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"model":{"description":"the model JSON","type":"string"}},"required":["model"]}},{"name":"sim_crosscheck","description":"Run every applicable READING of a model against the others and report agreement or divergence with the reason: discrete SSA means vs the continuous mean-field solve, algebraically derived conservation laws vs simulated means, and (for game-schema models) the closed-form incidence ranking vs rollouts vs exact search. Divergence is a finding, not an error — small-count mean-field gaps and the prior's threat-blindness are named as such. Trust is agreement between independent readings of one structure. Gated nets (read arc, inhibitor, reached capacity, guard) have no ODE reading to compare against at all — see docs/engine-selection.md for the four-rule decision behind which readings even apply.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"hours":{"description":"horizon (default 8)","type":"number"},"id":{"description":"model id","type":"string"},"realizations":{"description":"SSA runs averaged, max 200 (default 24)","type":"number"}},"required":["id"]}},{"name":"sim_dataset","description":"Generate a synthetic event log from a stored model (seeded SSA playout; case-per-arrival). Returns CSV. Deterministic: same id, same seed, same bytes.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"cases":{"description":"cases to generate (default 200, max 2000 over MCP)","type":"number"},"id":{"description":"model id","type":"string"},"seed":{"description":"PRNG seed (default 1)","type":"number"}},"required":["id"]}},{"name":"sim_delete_model","description":"Delete a model you created. Refused for the curated catalog, for models you do not own, and for models already dedicated to the commons (a dedication is irrevocable).","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"id":{"description":"model id to delete","type":"string"}},"required":["id"]}},{"name":"sim_diagnose","description":"Test a stored model without writing a fitness test for it. Reports generic gates (mass balance, dormant sources, whether staffing has a knee, whether any knob binds), every derived control ranked by MEASURED influence on the outcome (pool/source/patience/parameter knobs, rate-knob influence is signed), the parameter classes discovered among them, and four structural readings needing no run behind them (T-invariants, siphons/traps with deadlock witnesses, CTMC lumpability, constrained lumping). Pure read. Loss/success inference and objective framing can be corrected by tagging places or declaring simulation.objective — read the sim://docs/classification resource once for how to read influence and noise, the four structural readings, and the two corrections.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"hours":{"description":"horizon per run (default 8)","type":"number"},"id":{"description":"model id","type":"string"},"inline_context":{"description":"embed the full JSON-LD @context map in the result instead of the URL it is served from (https://sim.pflow.xyz/ns/v1/context). Default false: the URL resolves to the identical map, so only set this for an offline consumer that cannot fetch it.","type":"boolean"},"maxRealizations":{"description":"bounds how far the adaptive default may escalate (default 200, the same ceiling an explicit realizations refuses above). Ignored once realizations is set. For a caller with its own latency budget, not for narrowing a report.","type":"number"},"realizations":{"description":"runs averaged per measurement, max 200. Leave unset and the default ADAPTS: a 24-realization pilot that doubles while the baseline outcome sits inside its own noise floor, up to 200 (or maxRealizations, if set); the report's realizations field and sample-size finding record where it settled and why. Set it and that exact count is used, never more. If the report still says underpowered after adapting, raise hours or set a count explicitly.","type":"number"},"seed":{"description":"seed shared by every run, so differences measure the knob and not the dice (default 7)","type":"number"}},"required":["id"]}},{"name":"sim_diff","description":"Structural difference between two stored models: places, transitions and arcs added or removed, and surviving elements whose numbers changed (initial, capacity, rate, stages, arc weight or kind). The readout for what a builder turn, a sim_extend or a sim_refine actually changed between two ids in a lineage.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"a":{"description":"model id (before)","type":"string"},"b":{"description":"model id (after)","type":"string"}},"required":["a","b"]}},{"name":"sim_distill","description":"Distill exact search into the play scorer: fit rate multipliers for named transition groups so play's rankings agree with exact minimax, on positions sampled by random self-play and labeled by search. This is TACTICAL calibration — the counterpart of sim_calibrate, which learns rates from an event log. The division of labor is deliberate (petri-pilot experiments/ode-minimax): structure carries the tactic, and no fitting of an unmodified net's rates can express what its final state cannot separate — declare the structural prior as transitions in the model (e.g. forced-reply copies of the plays, catalyzed by the opponent's pattern) and distill the magnitudes it introduced. Zero agreement improvement is a finding about the structure, not a failed fit. Read agreementBefore/agreementAfter, not the loss: the hinge loss can overstate failure while every argmax is right.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"groups":{"description":"JSON object: group name -> transition ids sharing one fitted multiplier, e.g. {\"detectors\":[\"x_win_0\",\"o_win_0\"],\"draw\":[\"call_draw\"]}","type":"string"},"id":{"description":"model id (needs simulation.objective, players with turnPlace)","type":"string"},"options":{"description":"JSON: {\"games\":20,\"positions\":40,\"iters\":40,\"horizon\":3,\"realizations\":40,\"seed\":11,\"engine\":\"\"}","type":"string"}},"required":["id","groups"]}},{"name":"sim_edges","description":"List every relation touching an entity, as either subject or object — the two-directional view datum_edges gives. A filtered scan over every stored relation rather than a maintained index: this is a simulation sandbox's model graph, not a large corpus, so scanning on each call is the honest tradeoff over a second data structure that could drift from the source of truth.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"id":{"description":"entity id to look up","type":"string"}},"required":["id"]}},{"name":"sim_evaluate","description":"Score a player's legal next moves by NEXT-MOVE ELIMINATION (the tic-tac-toe blog technique): compute the expected objective from the given marking with all moves available, then once per candidate with that move's rate zeroed — the move whose elimination loses the most is the best move. Needs the game schema (simulation.objective + simulation.players). Ungated nets use the continuous ODE relaxation; gated nets use exact seeded SSA rollouts, and the response says which — the same rule sim_scenario's \"engine\" choice follows (docs/engine-selection.md).","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"horizon":{"description":"model time to explore ahead (default 3)","type":"number"},"id":{"description":"model id","type":"string"},"marking":{"description":"JSON object, sparse marking override (the position to evaluate from); default = the initial marking","type":"string"},"player":{"description":"player name from simulation.players","type":"string"},"realizations":{"description":"SSA rollouts per elimination (default 40)","type":"number"}},"required":["id","player"]}},{"name":"sim_extend","description":"Apply structural edits to a stored model and store the result as a NEW model you own, with lineage back to the original — the same vocabulary the guided builder uses behind its interview, now callable directly. Operations (JSON array, each with \"op\"): add_place {id, initial}, add_transition {id, guard, event}, add_arc {from, to, weight, kinetic, type}, remove_place, remove_transition, remove_arc {from, to}, set_rate {id, rate}, set_initial {id, initial}, set_capacity {id, capacity}. The edited model is validated before it is stored; a set of operations that leaves the net malformed is refused with every reason, and nothing is written. Returns the new id, the operations applied, and the structural diff.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"id":{"description":"model id to edit","type":"string"},"name":{"description":"optional name for the edited model","type":"string"},"operations":{"description":"JSON array of operations","type":"string"}},"required":["id","operations"]}},{"name":"sim_get_binding","description":"Fetch a stored Binding (see sim_bind) by id: which model/port feeds which, and any recorded transform.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"id":{"description":"binding id","type":"string"}},"required":["id"]}},{"name":"sim_get_model","description":"Fetch a stored model's full Petri-net JSON by id.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"id":{"description":"model id (content hash)","type":"string"}},"required":["id"]}},{"name":"sim_invariants","description":"Derive a model's full algebraic invariant structure: conservation laws (Farkas P-invariants — weighted place sums every run preserves, the arithmetic a trust panel should show), firing cycles (T-invariants, named per-cycle with a readable detail sentence, each tagged StructuralProof), and the siphon/trap report (every minimal siphon and trap found from the arc structure, plus deadlock witnesses — minimal siphons holding no tokens at this model's own initial marking, which proves every transition needing one permanently disabled). This is the same computation sim_diagnose's structural fields read from, not a lesser copy of it. Pure structure, no simulation; every claim holds for every trajectory from this initial marking.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"id":{"description":"model id","type":"string"}},"required":["id"]}},{"name":"sim_license_model","description":"Dedicate a model you created to the commons under CC0-1.0, CC-BY-4.0, CC-BY-SA-4.0. It then appears in every user's listing with the license shown, and the dedication is IRREVOCABLE — it cannot be changed or deleted afterwards, which is what makes it safe for others to build on. CC0-1.0 is the cleanest choice for a model: attribution terms are hard to honor for a net someone folds into a larger one.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"id":{"description":"model id to dedicate","type":"string"},"license":{"description":"one of CC0-1.0, CC-BY-4.0, CC-BY-SA-4.0","type":"string"}},"required":["id","license"]}},{"name":"sim_link","description":"Record a typed edge between any two stored entities — models, prompts, artifacts, maps, collections, or anything else addressed by a content id — with no fixed predicate vocabulary: the caller's choice, the same as datum_link (\"hasMember\", \"cites\", \"supersedes\", whatever the relationship actually is). Distinct from the Lineage a model/prompt/artifact already carries, which is specifically derivation (parent -> prompt -> child); a Relation is any OTHER assertion about how two entities relate, including sim_create_collection's own membership edges. Storing the same subject/predicate/object/timestamp/attribution twice returns the same id rather than a duplicate.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"object":{"description":"id of the entity the relation points to","type":"string"},"predicate":{"description":"the relationship, e.g. hasMember, cites, supersedes — no fixed vocabulary","type":"string"},"subject":{"description":"id of the entity the relation starts from","type":"string"}},"required":["subject","predicate","object"]}},{"name":"sim_list_bindings","description":"List the content id of every stored Binding.","write_action":false,"price_micros":0,"input_schema":{"type":"object"}},{"name":"sim_list_models","description":"List the models visible to you: the curated catalog, models dedicated to the commons (their entry carries the license), and your own (marked mine). Other users' undedicated models are not listed, but any model id works with every sim_* tool — an id someone shares with you is the model.","write_action":false,"price_micros":0,"input_schema":{"type":"object"}},{"name":"sim_map_get","description":"Fetch a stored Map's key->value data by id.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"id":{"description":"map id","type":"string"}},"required":["id"]}},{"name":"sim_map_list","description":"List the content id of every stored Map.","write_action":false,"price_micros":0,"input_schema":{"type":"object"}},{"name":"sim_map_put","description":"Store a key->value lookup table as its own content-addressed entity — a generated parameter sweep, a rate table, a component registry, anything shaped as key->value rather than free text (an artifact) or a Petri net (a model). Returns its content id; the same data, even with keys inserted in a different order, returns the same id.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"data":{"description":"the table as a JSON object","type":"string"}},"required":["data"]}},{"name":"sim_my_sheets","description":"List the sheets this user has published, with their URLs.","write_action":false,"price_micros":0,"input_schema":{"type":"object"}},{"name":"sim_neighbors","description":"One-hop traversal from an entity: every object reachable via a relation where it is the subject, optionally filtered to a single predicate (omit for all of them). Pass a collection's id with predicate hasMember to list its members.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"id":{"description":"subject id to traverse from","type":"string"},"predicate":{"description":"restrict to this predicate; omit for every outgoing relation","type":"string"}},"required":["id"]}},{"name":"sim_optimize","description":"Multi-objective optimisation over transition rates for a stored model: Monte Carlo samples the rate ranges, runs each combination to the horizon with the continuous engine, and returns every sample with a Pareto flag — the non-dominated set is the trade-off frontier ('which staffing is non-dominated on served vs walked out'). Continuous reading: a model with a schedule or a gate is refused with the reason (use sim_compare with explicit scenarios for those).","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"hours":{"description":"horizon per run (default 8)","type":"number"},"id":{"description":"model id","type":"string"},"objectives":{"description":"JSON array of {\"place\": id, \"direction\": \"max\"|\"min\"}","type":"string"},"parameters":{"description":"JSON object transition_id → [min, max] rate range, e.g. {\"finish_brew\": [10, 40]}","type":"string"},"samples":{"description":"Monte Carlo samples (default 100, max 1000)","type":"number"},"seed":{"description":"sampling seed (default 42)","type":"number"}},"required":["id","parameters","objectives"]}},{"name":"sim_param_heatmap","description":"Two-rate grid for a stored model: vary two transition rates over ranges, run each combination to the horizon with the continuous engine, and return the observable's final value as a grid — 'which regime of arrivals × restock keeps the queue empty'. Continuous reading: a model with a schedule or a gate is refused with the reason.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"hours":{"description":"horizon per run (default 8)","type":"number"},"id":{"description":"model id","type":"string"},"log_scale":{"description":"space the grid in log10 (default false)","type":"boolean"},"observable":{"description":"place id whose final value fills the grid","type":"string"},"param_x":{"description":"first transition id","type":"string"},"param_y":{"description":"second transition id","type":"string"},"range_x":{"description":"JSON [start, stop, n] for param_x","type":"string"},"range_y":{"description":"JSON [start, stop, n] for param_y","type":"string"}},"required":["id","param_x","param_y","observable","range_x","range_y"]}},{"name":"sim_prompt","description":"Ask an LLM to derive something from a stored entity: a variant model, a report, a piece of generated code — whatever the prompt asks for. The parent's JSON rides along as context, the same way the guided builder gives its interviewer the draft. The parent is looked up as a model first, then a prompt, then an artifact, then a map — whichever resolves — and the context block is labelled by what kind it found (\"## Parent model\", \"## Parent prompt\", ...), so the LLM is never told a report is a Petri net. The prompt is stored first and content-addressed like a model, so it has an id of its own before the LLM ever answers; both the prompt and whatever came back are placed in lineage under the parent (sim_prompt as the activity), so Ancestry walks parent -> prompt -> result. A Relation{prompt, \"produced\", result} is recorded alongside — sim_reroll's forward index, and queryable directly via sim_edges/sim_neighbors. If the response parses and validates as a Petri-net model it is stored as a NEW model you own; otherwise the raw text is stored as an artifact. Refused if this deployment has no LLM provider configured.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"parent":{"description":"id to run the prompt against — a model, prompt, artifact, or map","type":"string"},"system":{"description":"optional system-level instructions, in addition to the parent context this tool always supplies","type":"string"},"text":{"description":"the natural-language instruction","type":"string"}},"required":["parent","text"]}},{"name":"sim_propose_types","description":"Propose candidate @type values for one or more stored models, e.g. \"QueueingSystem\" or \"ResourcePool\", from each model's own Diagnosis — never from a fresh simulation this tool runs itself for the sole purpose of classifying, only from an existing measurement it reuses. Every rule is a hand-written assumption about what a shape of knobs/loss/siphons/classes tends to mean, not a structural proof or a measurement, so results are ASSUMPTION-grade until a human reviews one and applies it — apply with sim_link(id, \"@type\", \"<Type>\"), there is no separate apply tool. Pure read; nothing here is written to any model. Defaults to scanning the visible catalog (up to limit) when ids is omitted. Costs one Diagnose run per model, so limit and realizations are both capped.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"ids":{"description":"JSON array of model ids to consider, e.g. [\"id1\",\"id2\"]. Omit to scan every model ListFor(\"\") would list (the public catalog), truncated to limit.","type":"string"},"limit":{"description":"maximum number of models to diagnose (default 10, max 25) — a cost control, since this runs a simulation per model","type":"number"},"realizations":{"description":"realizations per model's Diagnose run (default 8, max 16) — deliberately small, this only needs to name a shape, not measure precise influence","type":"number"}}}},{"name":"sim_publish","description":"Publish a stored model into the signed-in user's Google Sheets: the model workbook (live formulas when honest, a refusal tab when not), a server-run scenario as data tabs, and trajectory + contention charts. Returns the sheet URL. Counts against the daily quota.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"id":{"description":"model id","type":"string"},"scenario":{"description":"optional scenario JSON to run for the data tabs","type":"string"}},"required":["id"]}},{"name":"sim_publish_app","description":"Publish the generated application for a model you own — the single-file HTML a generator produced from the model's `view` prompt. Served at /app/<id> in a sandboxed opaque origin (no cookies, no session; only the CORS-open public API is reachable). START FROM THE RUNTIME, not from scratch: /lib/app-template.html is a working console that imports /lib/sim-console.js and composes <sim-controls>, <sim-disruptions>, <sim-net>, <sim-timeline>, <sim-trajectory> and <sim-results> — the same components the generic console at /whatif/ runs. Composing them is how an app inherits role derivation, the fungible-set collapse, the influence ranking that never filters, the contention ledger and the verbatim caveats, none of which the checks below can verify you reimplemented correctly. Root-relative /lib/ imports are allowed; off-origin ones are refused. Checks refuse an app that is empty, oversized, never references its model id, or loads external scripts/styles; behavioral correctness (does the app actually do what the view says) is on the generator and any browser gate you run.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"html":{"description":"the complete self-contained HTML document","type":"string"},"id":{"description":"model id the app presents","type":"string"}},"required":["id","html"]}},{"name":"sim_publish_compare","description":"Publish a multi-scenario comparison into the signed-in user's Google Sheets — sim_compare's export, the counterpart of sim_publish for a single scenario. Runs every scenario on one shared seed (the same server-enforced sharing sim_compare uses, so differences are the scenarios and not the dice) and writes a comparison table plus a trajectory chart, rather than one scenario's own data tabs. Returns the sheet URL. Counts against the same daily publish quota as sim_publish.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"id":{"description":"model id","type":"string"},"scenarios":{"description":"JSON array of scenarios, each with a name, e.g. [{\"name\":\"today\",\"hours\":8},{\"name\":\"one more\",\"hours\":8,\"marking\":{\"staff\":3}}]","type":"string"}},"required":["id","scenarios"]}},{"name":"sim_receipt","description":"Run a seeded scenario and get back the result PLUS a signed run receipt: an Ed25519 certificate over (model id, scenario, result hash, service revision). Anyone can check it two ways — verify the signature offline against the embedded public key (proves this service reported this result), and POST it to /api/receipts/verify (no auth) to replay the run and confirm the result hash reproduces (proves the run is reproducible, not invented). The current signing key is at GET /api/receipts/key. Reproducibility is the bottom rung of the trust ladder receipts build: play the model, check the anchors, re-run the seed, verify the certificate.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"id":{"description":"model id to run","type":"string"},"scenario":{"description":"scenario JSON (hours, samples, seed, marking, rates, schedule, summary — the same shape sim_scenario takes); defaults apply when omitted. The result hash covers the result as returned, so a summary: true scenario certifies the summarized form and replays to it","type":"string"}},"required":["id"]}},{"name":"sim_refine","description":"Refine a model's parameter classes by editing what the model SAYS (tags on a place or transition, or assertedClasses), then re-derive. Returns a NEW model id (ids are content addresses, so the original stays reachable) plus a before/after class diff. tags can only split classes; assertedClasses declares a merge and gets re-verified and costed, never trusted blind. Read the sim://docs/classification resource once for why the two levers are not symmetric.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"assertedClasses":{"description":"JSON array, e.g. [{\"id\":\"items\",\"members\":[\"item0\",\"item1\"],\"note\":\"one stocking decision\"}]","type":"string"},"id":{"description":"model id to refine","type":"string"},"signature":{"description":"optional hex signature over the CID of the signed claim; see modelstore.SignedClaim for the exact bytes. An unverifiable signature is refused, not stored with a flag.","type":"string"},"signer":{"description":"optional {\"type\":\"eth\"|\"ed25519\",\"address\":\"...\"} — signs the lineage claim so it is the refiner's word rather than the server's account of a session","type":"string"},"tags":{"description":"JSON object of place OR transition id -> {key: value}, e.g. {\"nurse_avail\":{\"refine.shift\":\"night\"}}. Keys not prefixed refine. are stored as metadata and refine nothing. classify.go's colour refinement seeds from both places' and transitions' tags, so either kind of id works here.","type":"string"}},"required":["id"]}},{"name":"sim_reroll","description":"Re-run a stored sim_prompt against the SAME parent it originally ran against — a sibling attempt, never a chain: it never derives from the previous attempt's output, only from the original parent, so rerolling ten times leaves ten independent siblings in lineage rather than a chain of ten. Reuses the original prompt's text and system unless you override them here. The original prompt and its result are left untouched; this stores a new prompt and a new result (model or artifact, same rule as sim_prompt) under Activity sim_reroll. When called with neither override and the deployment's LLM provider and model are unchanged since the original ran, the response carries a reproducibility field checked against every prior result this exact prompt has ever produced (via the same forward \"produced\" relation sim_edges/sim_neighbors can query directly): \"verified\" if this result content-matches one of them, \"diverged\" if it doesn't, \"not verified\" if there's no prior result on record yet.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"prompt":{"description":"id of the sim_prompt (or earlier sim_reroll) to re-run","type":"string"},"system":{"description":"override the original prompt's system text; default reuses it verbatim","type":"string"},"text":{"description":"override the original prompt's text; default reuses it verbatim","type":"string"}},"required":["prompt"]}},{"name":"sim_run_pipeline","description":"Run a set of stored Bindings (see sim_bind) as a composed pipeline: each bound model runs through its own ordinary scenario, in topological order, with an output port's own trajectory resampled into the target's input-transition schedule. One seed and horizon shared across every model in the pipeline, same discipline sim_compare enforces within one model. Refuses a cyclic binding set, and refuses any binding whose named port does not exist with the right direction (output must be a place, input must be a transition) — this is where that check finally happens, not at sim_bind time. The result carries an explicit assumption for the seam itself: no model's own fitness gates cover whether the JOIN between them is sound. Costs one Diagnose-shaped run per model in the pipeline.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"bindingIds":{"description":"JSON array of binding ids to run together, e.g. [\"id1\",\"id2\"] — every model these bindings touch is included automatically.","type":"string"},"hours":{"description":"horizon in hours, shared across every model in the pipeline (default 8)","type":"number"},"realizations":{"description":"realizations per model (0 leaves each model's own Run to its adaptive default)","type":"number"},"seed":{"description":"shared seed across every model's run (default 1)","type":"number"}},"required":["bindingIds"]}},{"name":"sim_scenario","description":"Run a seeded what-if scenario against a stored model: marking overrides, rate overrides, piecewise rate schedules, and params assignments to the model's declared structural parameters (arc weights, capacities — batch sizes and shelf sizes). Pure read — asking cannot change the model. Returns trajectory, final marking, metrics, contention, caveats and assumptions. \"samples\" (default 60) is the trajectory's resolution: the number of evenly spaced points from 0 to hours inclusive at which times and every place's series (mean and std_dev per point) are reported — it sizes the answer, not the run, since metrics (throughput, mean, p95, utilization, inFlight) are time-weighted over every firing and do not change with the grid. \"summary\": true omits the times and series arrays entirely (the keys are absent, not null) and returns just final, metrics, depleted, contended, caveats and assumptions — the verdict without the chart data, and the right form when nothing will be plotted. Transitions declaring stages (phase-type durations) run with the declared lower spread — the engine expands them structurally and reports in the model's own vocabulary. A model-declared schedule (the day shape on a transition) is honored by every run; the scenario's own schedule or rate override still wins for that transition. \"engine\" picks the reading: \"ssa\" (default, discrete Gillespie — the right choice whenever counts are small enough that variance is the answer, or a schedule is in play) or \"ode\" (continuous mass-action; refuses a schedule, and refuses outright rather than silently misread a model carrying a read arc, inhibitor, reached capacity, guard or non-kinetic arc — Forecast's caveats name which). See docs/engine-selection.md for the full decision rule, including why an arc weight above 1 gets a genuinely different rate law from each engine, and sim_crosscheck to run both readings side by side.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"id":{"description":"model id","type":"string"},"scenario":{"description":"scenario JSON, e.g. {\"hours\":8,\"samples\":60,\"realizations\":16,\"seed\":7,\"marking\":{\"staff\":3},\"params\":{\"batch_size\":6},\"schedule\":{\"arrive\":[{\"until\":2,\"value\":12},{\"until\":8,\"value\":4}]},\"engine\":\"ssa\",\"summary\":false}; hours defaults to 8, samples to 60, realizations to 16, summary to false (full trajectory)","type":"string"}},"required":["id"]}},{"name":"sim_supersede_model","description":"Mark an old version of your model as replaced by a newer one. The old id keeps working and its commons dedication (if any) stands — only the listing moves on to the successor. Both models must be yours.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"new":{"description":"model id of the successor","type":"string"},"old":{"description":"model id being replaced","type":"string"}},"required":["old","new"]}},{"name":"sim_verify","description":"Verify declared properties of a stored model: deadlock-free, bounded, mutual-exclusion, invariant expressions, reachable/unreachable targets. Verdicts are proved/refuted/unknown — unknown is never a pass — and each carries a method: structural means it holds for ANY initial marking (linear algebra on the incidence matrix, the strongest claim available), exhaustive means this marking's full state space, partial means truncated (only refutations sound). Caveats name anything the analysis net could not express.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"id":{"description":"model id","type":"string"},"properties":{"description":"JSON array of properties, e.g. [{\"kind\":\"deadlock-free\"},{\"kind\":\"mutual-exclusion\",\"places\":[\"win_x\",\"win_o\"]},{\"kind\":\"invariant\",\"expr\":\"a + 2*b == 10\"}]. Default: bounded + deadlock-free.","type":"string"}},"required":["id"]}}],"scan":{"score":60,"grade":"C","scanned_at":"2026-09-23T11:55:27.908Z","report":{"scannerVersion":"0.1.9","scannedAt":"2026-09-23T11:55:27.908Z","components":{"code":{"score":-1,"max":25,"notes":["remote-only server, no package to scan"]},"reliability":{"score":20,"max":20,"notes":["remote reachable in 501ms"]},"poisoning":{"score":15,"max":15,"notes":["46 tool descriptions checked"]},"auth":{"score":3,"max":15,"notes":["open endpoint exposes 12 write-action tools with no auth"]},"maintenance":{"score":3,"max":15,"notes":["no repository listed"]},"identity":{"score":4,"max":10,"notes":["verified namespace with website, no repo"]}},"findings":[{"id":"auth.open-write","severity":"high","component":"auth","title":"Write-action tools reachable without authentication"},{"id":"maint.no-repo","severity":"low","component":"maintenance","title":"No source repository listed"}],"inputs":{"probes":[{"url":"https://sim.pflow.xyz/mcp","reachable":true,"authRequired":false,"latencyMs":501,"serverInfo":{"name":"sim.pflow.xyz","version":"1.0.0"}}],"packages":[],"repo":{"found":false},"icon":{"url":null,"source":"none"},"presence":{"stars":null,"forks":null,"downloadsWeek":null,"license":null,"lastPushAt":null,"score":8}}}},"grade_history":[],"reviews":[]}