AgentTrust
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@AgentTrustcheck trust of agent abc123"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
AgentTrust
Reputation and trust scoring service for AI agents, exposed entirely as an MCP server. Evaluate counterparties before transacting, report interaction outcomes, issue portable trust certificates, and detect Sybil attacks.
Table of Contents
Related MCP server: TrustMesh MCP Server
Quickstart
1. Connect to the MCP server
Add AgentTrust to your MCP client configuration:
{
"mcpServers": {
"agent-trust": {
"url": "https://agent-trust.radi.pro/mcp"
}
}
}Or for local development via stdio:
{
"mcpServers": {
"agent-trust": {
"command": "uv",
"args": ["run", "python", "-m", "agent_trust.server"]
}
}
}2. Register your agent
register_agent(display_name="my-agent", capabilities=["search", "summarize"])Response:
{
"agent_id": "550e8400-e29b-41d4-a716-446655440000",
"source": "standalone",
"scopes": ["trust.read", "trust.report"],
"created": true,
"public_key_hex": "a1b2c3...",
"private_key_hex": "d4e5f6...",
"warning": "Key pair auto-generated. Store private_key_hex securely."
}Store the private_key_hex immediately -- it is shown only once.
3. Generate an access token
generate_agent_token(
agent_id="550e8400-...",
private_key_hex="d4e5f6..."
)Response:
{
"access_token": "eyJ...",
"expires_at": "2026-03-20T13:00:00+00:00",
"ttl_minutes": 60,
"agent_id": "550e8400-..."
}4. Check trust before transacting
check_trust(agent_id="counterparty-uuid")5. Report interaction outcomes
report_interaction(
counterparty_id="counterparty-uuid",
interaction_type="transaction",
outcome="success",
access_token="eyJ..."
)Both parties should report for mutual confirmation (higher credibility).
Connecting to the MCP Server
AgentTrust supports two MCP transports:
Transport | Use case | Endpoint |
Streamable HTTP | Remote agents, production |
|
stdio | Local development, MCP Inspector |
|
Authentication
AgentTrust supports two authentication methods. Many tools work without authentication, but reporting interactions, filing disputes, and issuing attestations require it.
AgentAuth (preferred)
Obtain a bearer token from AgentAuth and pass it as access_token. This provides the full set of scopes:
Scope | Grants |
| Score breakdowns, pending confirmations |
| Report and confirm interactions |
| File disputes |
| Resolve disputes (arbitrators) |
| Issue signed attestations |
| Alert subscriptions |
Standalone (Ed25519)
Register with register_agent and generate tokens with generate_agent_token. Provides trust.read and trust.report scopes. You can upgrade to AgentAuth later via link_agentauth.
No authentication
Tools marked as "Auth: none" work without any token. Useful for checking trust scores and verifying attestations.
Tools Reference
Discovery
discover
Auth: none
Returns the complete service catalog: available tools, auth methods, score types, interaction types, rate limits, and a quickstart guide. Call this first when connecting.
discover()Agent Management
register_agent
Auth: none
Register a new agent in the trust network. Three paths:
AgentAuth -- pass
access_tokenfrom AgentAuthStandalone -- pass your own
public_key_hex(hex-encoded Ed25519 public key)Auto-generate -- omit both to get a keypair generated for you
Parameter | Type | Required | Description |
| string | no | Human-readable name (max 200 chars) |
| list[string] | no | Tags like |
| dict | no | Arbitrary key-value data (max 10KB) |
| string | no | AgentAuth bearer token |
| string | no | Hex-encoded Ed25519 public key |
register_agent(
display_name="my-search-agent",
capabilities=["search", "summarize"]
)generate_agent_token
Auth: none (uses private key directly)
Generate a signed JWT access token for standalone agents.
Parameter | Type | Required | Description |
| string | yes | UUID from |
| string | yes | 64 hex chars, Ed25519 private key |
| int | no | Token lifetime, default 60, max 1440 |
generate_agent_token(
agent_id="550e8400-...",
private_key_hex="d4e5f6...",
ttl_minutes=120
)whoami
Auth: required
Check your identity, current trust scores, and scopes.
Parameter | Type | Required | Description |
| string | no | AgentAuth bearer token |
| string | no | Hex-encoded public key |
whoami(access_token="eyJ...")get_agent_profile
Auth: none (authenticated calls get extra detail)
Retrieve the public profile for any agent.
Parameter | Type | Required | Description |
| string | yes | UUID to look up |
| string | no | For additional details |
get_agent_profile(agent_id="550e8400-...")search_agents
Auth: none
Search agents by trust score, capabilities, and interaction count.
Parameter | Type | Required | Description |
| float | no | Minimum score 0.0-1.0 (default 0.0) |
| string | no |
|
| list[string] | no | Required capabilities (must have ALL) |
| int | no | Minimum interaction count |
| int | no | Max results, default 20, max 100 |
search_agents(min_score=0.7, capabilities=["code-review"], limit=10)link_agentauth
Auth: required (AgentAuth token)
Link an existing standalone profile to an AgentAuth identity, merging interaction history. The canonical agent_id after linking is always the original standalone UUID — the AgentAuth UUID is stored as agentauth_id in metadata.
Parameter | Type | Required | Description |
| string | yes | AgentAuth bearer token |
| string | yes | Public key from standalone registration |
| string | yes | JWT signed with private key (claims: |
| bool | no | Validate everything without committing changes (default |
Response:
{
"agent_id": "550e8400-...",
"canonical_agent_id": "550e8400-...",
"agentauth_id": "aa-uuid-...",
"merged": true,
"message": "Standalone profile successfully linked to AgentAuth identity. ..."
}On dry_run=true: returns would_link_agent_id, agentauth_id, current_scores, interaction_count, capabilities, and message — no changes are persisted.
Error codes: invalid_input, proof_sig_invalid, proof_expired, key_not_found, already_linked, authentication_failed.
verify_link_proof
Auth: required (AgentAuth token)
Preflight check: validate a link_agentauth proof without writing to the database. Runs the same validation steps (token authenticity, key lookup, proof signature, expiry, already-linked check) but never persists any changes. Use this before calling link_agentauth to confirm everything is in order.
Parameter | Type | Required | Description |
| string | yes | AgentAuth bearer token |
| string | yes | Hex-encoded Ed25519 public key of the standalone agent |
| string | yes | JWT signed with the standalone private key |
verify_link_proof(
access_token="eyJ...",
public_key_hex="a1b2c3...",
signed_proof="eyJ..."
)Response:
{
"valid": true,
"checks": {
"token_valid": true,
"key_found": true,
"proof_sig_valid": true,
"proof_not_expired": true,
"already_linked": false
},
"agent_id": "550e8400-..."
}agent_status
Auth: required
One-call status snapshot combining identity, trust scores, pending confirmation count, and active attestations. Useful as a dashboard or health check.
Parameter | Type | Required | Description |
| string | no | AgentAuth bearer token |
| string | no | Hex-encoded Ed25519 public key (standalone agents) |
agent_status(access_token="eyJ...")Response:
{
"agent_id": "550e8400-...",
"agentauth_linked": true,
"scores": {"overall": 0.73, "reliability": 0.81},
"scopes": ["trust.read", "trust.report"],
"pending_confirmations": 2,
"active_attestations": [
{
"attestation_id": "b1c2d3e4-...",
"valid_until": "2026-03-21T12:00:00+00:00",
"seconds_remaining": 86400
}
]
}Trust Scoring
check_trust
Auth: none (authenticated calls with trust.read scope get factor_breakdown)
Primary tool for evaluating an agent before a transaction. Returns a score (0.0-1.0), confidence (0.0-1.0), interaction count, and a plain-language explanation.
Parameter | Type | Required | Description |
| string | yes | UUID to evaluate |
| string | no | Default |
| string | no | For factor breakdown |
check_trust(agent_id="550e8400-...", score_type="reliability")Response:
{
"agent_id": "550e8400-...",
"score_type": "reliability",
"score": 0.82,
"confidence": 0.71,
"interaction_count": 15,
"explanation": "High trust score with 15 interactions. Mostly positive.",
"computed_at": "2026-03-20T12:00:00+00:00"
}A score of 0.5 with confidence 0.05 means "unknown", not "average". Low confidence means few interactions -- treat with caution.
check_trust_batch
Auth: none
Check trust scores for up to 20 agents in a single call.
Parameter | Type | Required | Description |
| list[string] | yes | Up to 20 UUIDs |
| string | no | Default |
check_trust_batch(agent_ids=["uuid-1", "uuid-2", "uuid-3"])compare_agents
Auth: none
Rank up to 10 agents side-by-side by score.
Parameter | Type | Required | Description |
| list[string] | yes | Up to 10 UUIDs |
| string | no | Default |
compare_agents(agent_ids=["uuid-1", "uuid-2"], score_type="honesty")get_score_breakdown
Auth: required (trust.read scope)
Detailed Bayesian factors behind a score: raw score, dispute penalty, alpha/beta parameters, interaction weights.
Parameter | Type | Required | Description |
| string | yes | UUID |
| string | yes | Token with |
get_score_breakdown(agent_id="550e8400-...", access_token="eyJ...")Interaction Reporting
report_interaction
Auth: required (trust.report scope)
Report the outcome of an interaction with another agent. Both parties should report for mutual confirmation -- one-sided reports carry less weight.
Parameter | Type | Required | Description |
| string | yes | UUID of the other agent |
| string | yes |
|
| string | yes |
|
| string | yes | Token with |
| dict | no | Metadata like |
| string | no | SHA-256 hex hash of supporting evidence (64 chars) |
report_interaction(
counterparty_id="550e8400-...",
interaction_type="transaction",
outcome="success",
access_token="eyJ...",
context={"amount": 100, "task_type": "code-review"}
)Response:
{
"interaction_id": "a1b2c3d4-...",
"reporter_id": "my-agent-uuid",
"counterparty_id": "550e8400-...",
"outcome": "success",
"mutually_confirmed": false,
"reported_at": "2026-03-20T12:00:00+00:00"
}confirm_interaction
Auth: required (trust.report scope)
Confirm a counterparty's interaction report. Creates mutual confirmation, which increases the report's weight in score computation.
Parameter | Type | Required | Description |
| string | yes | UUID from the other agent's |
| string | yes | Your view: |
| string | yes | Token with |
| dict | no | Additional context from your perspective |
confirm_interaction(
interaction_id="a1b2c3d4-...",
outcome="success",
access_token="eyJ..."
)list_pending_confirmations
Auth: required
List interactions reported by other agents that await your confirmation.
Parameter | Type | Required | Description |
| string | yes | Your access token |
| int | no | Lookback window, default 30, max 365 |
| int | no | Max results, default 50, max 200 |
list_pending_confirmations(access_token="eyJ...")get_interaction_history
Auth: required
Retrieve interaction history for an agent.
Parameter | Type | Required | Description |
| string | yes | UUID |
| string | no | Filter by type |
| string | no | Filter by outcome |
| int | no | Lookback window, default 90, max 365 |
| int | no | Max results, default 50, max 200 |
| string | yes | Your access token |
get_interaction_history(
agent_id="550e8400-...",
interaction_type="transaction",
since_days=30,
access_token="eyJ..."
)Disputes
file_dispute
Auth: required (trust.dispute.file scope)
Challenge an interaction outcome you believe was reported incorrectly.
Parameter | Type | Required | Description |
| string | yes | UUID of the disputed interaction |
| string | yes | Explanation (max 5000 chars) |
| string | yes | Token with |
| dict | no | Supporting evidence (max 10KB) |
file_dispute(
interaction_id="a1b2c3d4-...",
reason="The task was completed successfully but reported as failure",
access_token="eyJ..."
)Limits: max 10 disputes per day, max 30 open disputes at once. Agents with 5+ dismissed disputes are blocked from filing new ones (24h cooldown after each dismissal).
resolve_dispute
Auth: required (trust.dispute.resolve scope, arbitrators only)
Resolve an open dispute. Requires AgentAuth permission check.
Parameter | Type | Required | Description |
| string | yes | UUID of the dispute |
| string | yes |
|
| string | yes | Arbitrator's token |
| string | no | Explanation (max 2000 chars) |
resolve_dispute(
dispute_id="d1e2f3...",
resolution="upheld",
access_token="eyJ...",
resolution_note="Evidence confirms task was completed"
)Attestations
issue_attestation
Auth: required (trust.attest.issue scope)
Issue a portable, Ed25519-signed JWT capturing an agent's current trust scores. The agent can present this to third parties who verify the signature without querying AgentTrust.
Parameter | Type | Required | Description |
| string | yes | UUID of the agent to attest |
| string | yes | Token with |
| int | no | Validity period, default 12, range 1-72 |
issue_attestation(
agent_id="550e8400-...",
access_token="eyJ...",
ttl_hours=24
)Response:
{
"attestation_id": "b1c2d3e4-...",
"subject_agent_id": "550e8400-...",
"jwt_token": "eyJ...",
"score_snapshot": {
"overall": {"score": 0.82, "confidence": 0.71},
"reliability": {"score": 0.85, "confidence": 0.65}
},
"valid_from": "2026-03-20T12:00:00+00:00",
"valid_until": "2026-03-21T12:00:00+00:00"
}list_my_attestations
Auth: required
List your active (non-expired, non-revoked) attestations. Each entry includes the attestation ID, validity window, seconds remaining, and the score snapshot captured at issuance.
Parameter | Type | Required | Description |
| string | no | AgentAuth bearer token |
| string | no | Hex-encoded Ed25519 public key (standalone agents) |
list_my_attestations(access_token="eyJ...")Response:
{
"agent_id": "550e8400-...",
"attestations": [
{
"attestation_id": "b1c2d3e4-...",
"issued_at": "2026-03-20T12:00:00+00:00",
"valid_until": "2026-03-21T12:00:00+00:00",
"seconds_remaining": 86400,
"score_snapshot": {"overall": {"score": 0.82, "confidence": 0.71}}
}
],
"count": 1
}verify_attestation
Auth: none
Verify an attestation JWT's signature, expiry, and revocation status. No authentication needed -- this is designed for third-party verification.
Parameter | Type | Required | Description |
| string | yes | JWT from |
verify_attestation(jwt_token="eyJ...")Response:
{
"valid": true,
"attestation_id": "b1c2d3e4-...",
"subject_agent_id": "550e8400-...",
"score_snapshot": {"overall": {"score": 0.82, "confidence": 0.71}},
"issued_at": "2026-03-20T12:00:00+00:00",
"valid_until": "2026-03-21T12:00:00+00:00",
"seconds_remaining": 43200
}Sybil Detection
sybil_check
Auth: none
Detect potential Sybil behavior: ring reporting (mutual positive feedback loops), burst registration (many agents in a short window), and suspicious delegation chains.
Parameter | Type | Required | Description |
| string | yes | UUID to check |
sybil_check(agent_id="550e8400-...")Response:
{
"agent_id": "550e8400-...",
"risk_score": 0.15,
"is_suspicious": false,
"is_high_risk": false,
"signals": [],
"checked_at": "2026-03-20T12:00:00+00:00"
}When signals are detected:
{
"signals": [
{
"signal_type": "ring_reporting",
"severity": "high",
"description": "Mutual positive feedback loop detected",
"evidence": {"ring_size": 3, "agents": ["uuid-1", "uuid-2", "uuid-3"]}
}
]
}Resources
MCP resources provide read-only access to trust data via URI templates:
URI | Description |
| Current trust scores in all categories |
| Interaction history summary (last 90 days) |
| Active (non-expired, non-revoked) attestations |
| Top 50 agents ranked by score type |
| Full details of a specific dispute |
| Service health: DB, Redis, AgentAuth, worker queue |
Prompts
Pre-built prompt templates for common evaluation workflows:
Prompt | Parameters | Description |
|
| Structured evaluation before a transaction |
|
| Investigate why a trust score changed |
|
| Structured assessment for dispute arbitration |
Score Types
Type | Based on | Description |
| All interaction types | Composite score |
| Transaction, delegation, collaboration | Does the agent deliver? |
| Query, delegation | Does the agent respond timely? |
| Collaboration | Is the agent truthful? |
| Custom | Domain-specific scores (e.g., |
Scores use a Bayesian Beta distribution with exponential time decay (90-day half-life) and dispute penalties. Scores range from 0.0 to 1.0, paired with a confidence value:
High score + high confidence = trustworthy, well-established agent
High score + low confidence = looks good but too few interactions to be sure
0.5 score + near-zero confidence = unknown agent (prior), not "average"
Rate Limits
Requests are rate-limited per agent per minute, with higher limits for more trusted agents:
Trust Level | Requests/min |
Root (AgentAuth) | 120 |
Delegated | 90 |
Standalone | 60 |
Ephemeral | 30 |
Unauthenticated | 10 |
Additional limits on specific operations:
Interaction reports: max 10 per pair per day, 1 per type per pair per hour
Disputes filed: max 10 per day, max 30 open at once
Dispute targets: max 10 open disputes per target
Self-Hosting
Prerequisites
Python 3.13+
PostgreSQL 16
Redis 7
uv package manager
Setup
# Clone and install
git clone <repo-url>
cd agent-trust
uv sync
# Start infrastructure
docker compose up -d postgres redis
# Generate server signing key (first time only)
uv run python scripts/generate_keypair.py
# Run database migrations
uv run alembic upgrade head
# (Optional) Register scopes with AgentAuth
AGENTAUTH_ACCESS_TOKEN=<token> uv run python scripts/register_scopes.pyEnvironment Variables
Create a .env file:
DATABASE_URL=postgresql+asyncpg://agent_trust:agent_trust@localhost:5432/agent_trust
REDIS_URL=redis://localhost:6379/0
SIGNING_KEY_PATH=keys/service.key
# Auth: "agentauth", "standalone", or "both" (default: both)
AUTH_PROVIDER=both
AGENTAUTH_MCP_URL=https://agentauth.radi.pro/mcp
AGENTAUTH_ACCESS_TOKEN=<your-token>
# Scoring
SCORE_HALF_LIFE_DAYS=90
DISPUTE_PENALTY=0.03
ATTESTATION_TTL_HOURS=24
# Transport: "stdio" or "streamable-http"
MCP_TRANSPORT=stdio
MCP_PORT=8000
# Production
ENVIRONMENT=development # set to "production" to bind 0.0.0.0
LOG_LEVEL=INFO
JSON_LOGS=falseRunning
# Local development (stdio)
uv run python -m agent_trust.server
# Production (HTTP)
uv run python -m agent_trust.server --transport streamable-http --port 8000
# Background worker (score recomputation, attestation expiry)
uv run python scripts/run_worker.py
# Test with MCP Inspector
uv run mcp dev src/agent_trust/server.pyDocker
Run the full stack with Docker Compose:
docker compose up -dThis starts PostgreSQL, Redis, the MCP server (port 8140), the background worker, Prometheus (port 9090), and Grafana (port 3001).
Tests
uv run pytest # all tests
uv run pytest tests/test_tools/ -v # MCP tools
uv run pytest tests/test_engine/ -v # score algorithm
uv run pytest tests/test_auth/ -v # authentication
uv run pytest tests/test_integration/ # end-to-endAvailable Tools
23 toolsagent_statusA
Return a comprehensive status snapshot for your agent.
Combines identity, trust scores, pending confirmation count, and active attestations in a single call — useful as a dashboard or health check.
REQUIRES authentication (access_token or public_key_hex).
Example call: agent_status(access_token="eyJ...")
Example response: { "agent_id": "550e8400-...", "agentauth_linked": true, "scores": {"overall": 0.73, "reliability": 0.81}, "scopes": ["trust.read", "trust.write"], "pending_confirmations": 2, "active_attestations": [ { "attestation_id": "b1c2d3e4-...", "valid_until": "2026-03-21T12:00:00+00:00", "seconds_remaining": 86400 } ] }
| Name | Required | Description | Default |
|---|---|---|---|
| access_token | No | ||
| public_key_hex | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description must carry the burden. It mentions authentication requirement (access_token or public_key_hex) and provides an example response, but does not disclose other behavioral traits like side effects (none expected), rate limits, or error behavior for failed auth.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with a clear summary, authentication note, and example. However, the example response block is large and could be trimmed or referenced externally.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the example response covers key fields (agent_id, scores, scopes, pending_confirmations, active_attestations). Missing details on error responses or pagination, but these are not critical for a status snapshot.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so parameters are only named. The description partially compensates by showing an example call with access_token and mentioning both auth methods, but does not explain when to use each or their format beyond the example.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool returns a comprehensive status snapshot combining identity, trust scores, pending confirmations, and active attestations. This differentiates it from sibling tools like list_pending_confirmations or list_my_attestations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description indicates it's useful as a dashboard or health check but does not explicitly state when to use it versus more specific sibling tools like check_trust or get_score_breakdown. No when-not or alternative recommendations are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
check_trustA
Check an agent's trust score before entering a transaction.
Returns score (0.0-1.0), confidence (0.0-1.0), interaction_count, and a plain-language explanation of the score.
score_type options:
overall: composite score across all interaction types
reliability: based on transaction and delegation outcomes
responsiveness: based on query and delegation timeliness
honesty: based on collaboration outcomes
Low confidence means the agent has few interactions — treat with caution regardless of score value. A score of 0.5 with confidence 0.05 means 'unknown', not 'average'.
Authentication is optional:
Unauthenticated: score, confidence, interaction_count, explanation
Authenticated (trust.read scope): adds factor_breakdown summary
Example call: check_trust(agent_id="550e8400-e29b-41d4-a716-446655440000", score_type="overall")
Example response: { "agent_id": "550e8400-e29b-41d4-a716-446655440000", "score_type": "overall", "score": 0.82, "confidence": 0.71, "interaction_count": 15, "explanation": "High trust score with " "15 interactions. Mostly positive.", "computed_at": "2026-03-20T12:00:00+00:00" }
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | Yes | ||
| score_type | No | overall | |
| access_token | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, description fully discloses behavioral traits: optional authentication changes output, low confidence interpretation, meaning of score 0.5 with low confidence, and score_type options. Example response clarifies return fields and computed_at timestamp.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured: starts with purpose, lists return fields, details score_type options, explains authentication levels, provides example call and response. No redundant sentences; every part adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and 3 parameters, description is fully complete. It explains all return fields, authentication differences, score_type semantics, and even provides a full example response. Covers all necessary information for an agent to invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Despite 0% schema description coverage, the description explains all three parameters thoroughly: agent_id (required), score_type with options and defaults, and access_token with authentication behavior. Example call demonstrates parameter usage clearly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool checks an agent's trust score before a transaction, with specific verb and resource. It distinguishes from siblings like check_trust_batch (batch) and get_score_breakdown (detailed breakdown) by focusing on single-agent score retrieval with plain-language explanation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says when to use ('before entering a transaction') and describes authentication impact on returned data. Does not explicitly say when not to use (e.g., for batch operations), but the sibling list implies this. Overall, provides clear usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
check_trust_batchA
Check trust scores for multiple agents in a single call.
Evaluates up to 20 agents at once, reducing round-trips when you need to assess several potential counterparties before choosing one.
Each agent in the result includes score, confidence, and interaction_count. Agents that don't exist or can't be scored get an inline error.
score_type options: overall, reliability, responsiveness, honesty
Example call: check_trust_batch( agent_ids=["uuid-1", "uuid-2", "uuid-3"], score_type="reliability" )
Example response: { "score_type": "reliability", "results": [ {"agent_id": "uuid-1", "score": 0.82, "confidence": 0.71, "interaction_count": 15}, {"agent_id": "uuid-2", "score": 0.65, "confidence": 0.45, "interaction_count": 7}, {"agent_id": "uuid-3", "error_code": "not_found", "error": "Agent not found"} ], "count": 3, "succeeded": 2, "failed": 1 }
| Name | Required | Description | Default |
|---|---|---|---|
| agent_ids | Yes | ||
| score_type | No | overall | |
| access_token | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses key behaviors: batch limit, result structure (score, confidence, interaction_count), inline errors for missing agents, score_type options, and shows example input/output. However, it omits the role of the access_token parameter, which could affect authorization behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured: purpose first, then constraints, result format, options, and examples. Every sentence adds value without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the tool's purpose, batch limit, error handling, and provides illustrative examples. The missing explanation for access_token is a minor gap, and there is no output schema, but the example response compensates well.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description explains agent_ids (list of UUIDs) and score_type (with enumerated options), but does not explain the access_token parameter at all. Since the schema has 0% description coverage, the description partially compensates but misses one parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool checks trust scores for multiple agents in a single call, with explicit mention of batch size (up to 20) and use case (reducing round-trips). This distinguishes it from single-agent alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains when to use the tool (assessing several potential counterparties before choosing one) and implies a batch use case. However, it doesn't explicitly compare with sibling tools like check_trust or state when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
compare_agentsA
Compare trust scores of multiple agents side by side.
Returns a ranked list with scores, confidence levels, and interaction counts. Useful when choosing between multiple agents for a task.
Maximum 10 agents per comparison. score_type: overall, reliability, responsiveness, or honesty
| Name | Required | Description | Default |
|---|---|---|---|
| agent_ids | Yes | ||
| score_type | No | overall | |
| access_token | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description responsibly mentions return structure (scores, confidence, interaction counts) and limitation (max 10), but does not disclose authorization needs (access_token optional but unexplained) or error handling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Five concise sentences, front-loaded with purpose, no redundancy, each sentence adds information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite no output schema, description covers return values and constraints. Could mention error handling for invalid IDs, but overall sufficient for agent decision-making.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so description compensates by explaining score_type options and implying agent_ids purpose. It adds value over the schema, though access_token remains undocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (compare) and resource (trust scores of multiple agents), and specifically mentions returning a ranked list, distinguishing it from siblings like check_trust which is for single agent checks.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit context (useful when choosing between agents), a limit (max 10), and defines score_type options. However, it does not explicitly state when not to use or suggest alternatives like check_trust_batch for non-comparison queries.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
confirm_interactionA
Confirm a counterparty's interaction report by filing your side.
When another agent reports an interaction involving you, call this to confirm it. This creates your matching report and sets both reports' mutually_confirmed flags to true, increasing credibility weighting.
You can agree with the counterparty's outcome or report a different one. If you report a different outcome, the interaction is still marked as mutually confirmed (both parties reported), but the outcomes are recorded independently.
REQUIRES authentication (access_token with trust.report scope).
Example call: confirm_interaction( interaction_id="a1b2c3d4-...", outcome="success", access_token="eyJ..." )
Example response: { "confirmed": true, "interaction_id": "a1b2c3d4-...", "your_report_id": "e5f6a7b8-...", "mutually_confirmed": true, "outcome_match": true }
| Name | Required | Description | Default |
|---|---|---|---|
| interaction_id | Yes | ||
| outcome | Yes | ||
| access_token | Yes | ||
| context | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, but description fully discloses behavior: creates matching report, sets mutually_confirmed flags, handles different outcomes, requires access_token with trust.report scope, and includes example response.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with clear sections: purpose, usage, behavior, auth, example call, example response. Not overly verbose, but could be slightly more concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, example response helps. Covers auth, behavior, and outcome. However, missing explanation of context parameter and error scenarios. Still quite complete for a 4-param tool with no annotations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so description must compensate. Example shows interaction_id, outcome, access_token, but does not explain context parameter or possible outcome values. Adequate but missing details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the tool confirms a counterparty's interaction report by filing your side. Distinguishes from siblings like report_interaction and list_pending_confirmations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says when to use: when another agent reports an interaction involving you. Also explains you can agree or report a different outcome, but does not explicitly state when not to use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
discoverA
Discover AgentTrust capabilities, tools, auth methods, and rate limits.
Call this first when connecting to AgentTrust to understand what's available and how to authenticate. No authentication required.
Returns a complete catalog of:
Available tools with descriptions and required scopes
Supported authentication methods
Rate limit tiers by trust level
Score types and their meanings
Interaction types and outcome options
Example response (abbreviated): { "service": "AgentTrust", "version": "1.0.0", "auth_methods": [...], "tools": [...], "score_types": {...}, "rate_limits": {...} }
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
While no annotations are provided, the description thoroughly explains what the tool returns, including an example response. It implicitly indicates a read-only operation, though it could be more explicit about having no side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with bullet points and an example, front-loading the purpose. It is slightly lengthy but each sentence adds value, making it appropriate for the complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no parameters and no output schema, the description provides a complete overview of the return structure, covering tools, auth methods, rate limits, etc. No gaps remain.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0 parameters and 100% schema coverage, there is no need for parameter explanations. The baseline for 0 parameters is 4, and the description adds no misleading information.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool discovers AgentTrust capabilities, tools, auth methods, and rate limits. It uses a specific verb-resource pair and distinguishes itself from sibling tools by being the initial discovery endpoint.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says 'Call this first when connecting to AgentTrust' and notes 'No authentication required.' This provides clear when-to-use guidance and prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
file_disputeA
File a dispute against an interaction outcome.
Provide the interaction_id from a previously reported interaction and a clear reason explaining why you believe the outcome was incorrectly reported.
REQUIRES authentication (access_token) and trust.dispute.file scope.
Filing frivolous disputes damages your own trust score — dismissed disputes apply a small penalty to the filer.
Returns dispute_id and status ('open').
Example call: file_dispute( interaction_id="a1b2c3d4-...", reason="Counterparty did not deliver the agreed code review within SLA", access_token="eyJ..." )
Example response: { "dispute_id": "d5e6f7a8-...", "interaction_id": "a1b2c3d4-...", "filed_against": "550e8400-...", "status": "open", "created_at": "2026-03-20T12:00:00+00:00" }
| Name | Required | Description | Default |
|---|---|---|---|
| interaction_id | Yes | ||
| reason | Yes | ||
| access_token | Yes | ||
| evidence | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Discloses authentication requirements, scope, and consequences of frivolous disputes (trust score penalty). With no annotations, this carries full burden and handles it well.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Concise yet comprehensive: purpose, instructions, warnings, return info, and example call. Every sentence adds value; no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 4 parameters, 3 required, no output schema, the description covers all necessary aspects: inputs, side effects, return structure, and example response. Missing nothing critical.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so description must add meaning. It explains interaction_id comes from a previous report, reason must justify the dispute. The optional 'evidence' parameter is mentioned but not detailed, slightly reducing score.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states 'File a dispute against an interaction outcome', identifying verb and resource. Distinguishes from sibling tools like report_interaction and resolve_dispute.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explains when to use (after a reported interaction) and provides required parameters (interaction_id, reason, access_token). Does not explicitly exclude alternatives, but context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
generate_agent_tokenA
Generate a signed access token for a standalone agent.
Standalone agents authenticate by signing short-lived JWTs with their Ed25519 private key. Call this tool to obtain an access_token that can be passed directly to report_interaction, file_dispute, issue_attestation, get_score_breakdown, and any other tool requiring authentication.
The token is signed using your private key — no key material is stored server-side. When your token expires, call this tool again.
Typical agent flow:
Call register_agent() once → receive agent_id + private_key_hex
Call generate_agent_token(agent_id, private_key_hex) → receive access_token
Pass access_token to authenticated tools
Repeat step 2 when the token expires (check expires_at)
Args: agent_id: Your agent UUID (from register_agent). private_key_hex: Your 32-byte Ed25519 private key as 64 hex chars (private_key_hex from your register_agent response). ttl_minutes: Token lifetime in minutes. Default 60, max 1440 (24 h).
Returns: access_token: Signed JWT — pass this as access_token to other tools. expires_at: ISO 8601 UTC timestamp when the token expires. ttl_minutes: Actual TTL applied after clamping.
Example call: generate_agent_token( agent_id="550e8400-...", private_key_hex="d4e5f6...", ttl_minutes=60 )
Example response: { "access_token": "eyJ...", "expires_at": "2026-03-20T13:00:00+00:00", "ttl_minutes": 60, "agent_id": "550e8400-..." }
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | Yes | ||
| private_key_hex | Yes | ||
| ttl_minutes | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full transparency burden. It discloses that the token is signed client-side, no server-side key storage, token expiration, and the TTL clamping behavior. It does not mention rate limits or error conditions, but the provided information is sufficient for a straightforward token generation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with sections, bullet points, and examples. While slightly verbose, every sentence contributes meaning. The clear formatting aids readability and usability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (3 parameters, no output schema), the description is remarkably complete. It covers the typical workflow, parameter details, expected response structure (including an example), and the authentication flow. No gaps are apparent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate fully. It does so by explaining each parameter's purpose, source (e.g., from register_agent response), format (64 hex chars for private_key_hex), and constraints (default/max for ttl_minutes). This adds substantial value beyond the bare JSON schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool generates a signed access token for standalone agents. It differentiates by explaining the use case (authentication) and listing which sibling tools require the token, making it distinct from similar tools like register_agent.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit usage context: after register_agent and before calling authenticated tools. It includes a typical agent flow and advises to repeat when token expires. However, it does not explicitly state when not to use this tool or compare with alternatives, though the specific authentication role is implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_agent_profileA
Retrieve an agent's public profile.
Returns registration date, capabilities, trust summary, and interaction count. Authentication is optional — unauthenticated calls get a summary view, authenticated calls get full detail including AgentAuth metadata and the complete score breakdown.
Use this to evaluate a potential counterparty before transacting.
Args: agent_id: UUID string of the agent to look up. access_token: Optional AgentAuth bearer token for full detail view.
Returns:
agent_id, display_name, registered_at, capabilities,
trust_level, scores (summary or full), interaction_count,
agentauth_linked, and status.
Returns {"error": "not_found", ...} if the agent does not exist.
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | Yes | ||
| access_token | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the disclosure of optional authentication yielding summary vs. full detail is valuable. It covers return fields and error case, though does not mention read-only nature or rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with purpose, then details authentication, return fields, and error response in a well-organized, efficient block with no superfluous words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description lists all return fields and a plausible error case, fully covering what an agent needs for a data retrieval tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema coverage, the description adds meaning: agent_id is a UUID, access_token is optional and changes the response detail. This compensates well, though no format constraints are given.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Retrieve an agent's public profile' with a specific verb and resource, and distinguishes from sibling tools by noting the use case for evaluating a counterparty before transacting.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides a clear use case ('evaluate a potential counterparty before transacting'), but does not explicitly state when not to use or name alternative tools for other needs like trust breakdown.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_interaction_historyA
Retrieve interaction history for an agent.
Filter by interaction type and outcome. Returns chronological list with timestamps, counterparty IDs, and outcomes. Useful for due diligence before high-value transactions.
REQUIRES authentication — provide access_token to view interaction history.
since_days: how far back to look (default 90, max 365) limit: max results to return (default 50, max 200)
SECURITY NOTE: The context field in each interaction is stored as provided by the reporter and is not sanitized. Items with detected prompt injection patterns will include a 'context_warnings' field. Always sanitize context fields before passing them to LLM prompts.
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | Yes | ||
| interaction_type | No | ||
| outcome | No | ||
| since_days | No | ||
| limit | No | ||
| access_token | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description fully discloses authentication requirements, the unsanitized nature of the context field, and the presence of context_warnings for prompt injection. These are critical behavioral traits that go beyond the basic retrieval function and help the agent handle results safely.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is organized into logical paragraphs: purpose, filtering, use case, authentication, parameter details, and security note. Each section adds value. While it's longer than ideal, it avoids redundancy and front-loads the core functionality. Minor room for tightening, but overall well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the tool's purpose, filtering options, return format, authentication, and a critical security behavior. However, it lacks explicit pagination behavior beyond the limit parameter, and does not specify possible values for interaction_type or outcome. Given no output schema, it provides enough for basic usage but not exhaustive.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It provides defaults and limits for 'since_days' and 'limit', which is helpful. However, it omits details for 'agent_id', 'interaction_type', 'outcome', and 'access_token' (beyond stating the need for authentication). The added information is good but incomplete, leaving agents to infer or guess for several parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves interaction history for an agent, explicitly noting filtering by type and outcome, and the return format (chronological list with timestamps, counterparty IDs, outcomes). This distinguishes it from sibling tools like agent_status or check_trust, which serve different purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear usage context ('useful for due diligence before high-value transactions') and explicitly requires authentication via access_token. While it doesn't list alternative tools or when not to use, the given context and prerequisites are sufficient for an agent to decide. No misleading guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_score_breakdownA
Get a detailed breakdown of how an agent's trust score was computed.
Returns factor attribution showing:
bayesian_raw: score before dispute penalty
dispute_penalty: multiplier from lost disputes (1.0 = no penalty)
interactions_weighted: number of interactions used in computation
lost_disputes: count of upheld disputes against this agent
alpha/beta: Beta distribution parameters
REQUIRES authentication with trust.read scope. Use this to understand WHY an agent has a particular score.
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | Yes | ||
| access_token | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description fully discloses that this is a read operation, requires trust.read scope, and lists all returned fields with explanations. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, uses bullet points for return fields, and front-loads the purpose. Every sentence adds value without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description thoroughly covers return values. For a tool with two simple parameters and clear authentication requirement, it is sufficiently complete for an agent to use correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, meaning parameters have no descriptions in the schema. The description does not add any information about 'agent_id' or 'access_token' beyond their names. Given the lack of schema details, the description should compensate but fails to do so.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it returns a detailed breakdown of trust score computation, listing specific fields like bayesian_raw, dispute_penalty, etc. This distinguishes it from siblings like 'check_trust' which likely only return the overall score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly mentions required authentication scope and tells when to use ('understand WHY an agent has a particular score'). However, it does not explicitly state when not to use or mention alternatives among sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
issue_attestationA
Issue a signed attestation (JWT) capturing an agent's current trust scores.
The attestation is portable — the agent can present it to third parties who verify the signature without querying this service.
The JWT includes:
sub: agent_id
scores: snapshot of all trust scores at issuance time
agentauth_linked: whether the agent has an AgentAuth identity
iss: 'agent-trust'
exp/nbf/iat: validity window
Attestations are signed with the service's Ed25519 key. Verifiers can check the signature using verify_attestation without authentication.
ttl_hours: validity period in hours (default: ATTESTATION_TTL_HOURS config) Requires authentication with trust.attest.issue scope.
Example call: issue_attestation(agent_id="550e8400-...", access_token="eyJ...", ttl_hours=24)
Example response: { "attestation_id": "b1c2d3e4-...", "subject_agent_id": "550e8400-...", "jwt_token": "eyJ...", "score_snapshot": {"overall": {"score": 0.82, "confidence": 0.71}}, "valid_from": "2026-03-20T12:00:00+00:00", "valid_until": "2026-03-21T12:00:00+00:00" }
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | Yes | ||
| access_token | Yes | ||
| ttl_hours | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description fully compensates by disclosing JWT contents, signing key (Ed25519), authentication scope requirement, example response, and the default for ttl_hours. No contradiction exists.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a summary, bullet points of JWT contents, parameter details, example, and response format. It is informative but could be slightly more concise by removing some redundancy (e.g., portability statement repeated).
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 3 parameters and no output schema, the description covers purpose, authentication, parameter defaults, and example output. Missing error handling or rate limit info, but overall sufficient for selection and invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, but the description adds meaning: agent_id is implied by context, access_token requires specific scope, ttl_hours is validity period with a config-based default. An example call further clarifies usage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool issues a signed attestation (JWT) capturing trust scores, specifying verb (issue), resource (signed attestation/JWT), and content. It distinguishes from sibling tools like verify_attestation (which verifies) and list_my_attestations (which lists).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains the attestation is portable for third-party verification without querying the service, and that verifiers can use verify_attestation without authentication. It provides usage context but does not explicitly state when not to use or compare with alternatives like get_agent_profile.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
link_agentauthA
Link a standalone trust profile to an AgentAuth identity.
Provide your AgentAuth access_token, the public_key_hex you
originally registered with, and a signed_proof JWT proving you own
the standalone agent's private key. Your interaction history and scores
transfer to the AgentAuth identity. The standalone profile is updated to
reflect the AgentAuth source. This is a one-time, irreversible operation.
After linking, authenticate exclusively with your AgentAuth token — the public key will no longer be usable for authentication.
Canonical agent ID contract: after a successful link the canonical
agent_id is always the original standalone UUID. The AgentAuth UUID
is stored as agentauth_id in the profile's metadata and is also
returned in the response as agentauth_id. All historical scores and
interactions remain attached to the canonical standalone UUID.
The signed_proof JWT must be signed with the standalone agent's
Ed25519 private key (algorithm EdDSA) and contain the following
claims:
sub: yourpublic_key_hex(hex-encoded 32-byte public key)action: the literal string"link_agentauth"iat: issued-at Unix timestamp (must be within 300 seconds of now)
Example (Python)::
import jwt, time
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
private_key = Ed25519PrivateKey.from_private_bytes(bytes.fromhex(private_key_hex))
signed_proof = jwt.encode(
{"sub": public_key_hex, "action": "link_agentauth", "iat": int(time.time())},
private_key,
algorithm="EdDSA",
)Args:
access_token: Valid AgentAuth bearer token identifying the target identity.
public_key_hex: Hex-encoded Ed25519 public key used during standalone registration.
signed_proof: JWT signed by the standalone agent's Ed25519 private key,
proving ownership of the key. Must contain sub, action, and
iat claims as described above.
dry_run: When True, validate everything but do not commit any
changes. Returns a preview of what would happen including current
scores. Defaults to False.
Returns:
On success: agent_id (canonical standalone UUID), canonical_agent_id
(same as agent_id), agentauth_id (AgentAuth UUID stored in
metadata), merged (bool), and a confirmation message.
On ``dry_run=True``: ``dry_run`` (``true``), ``would_link_agent_id``,
``agentauth_id``, ``current_scores``, ``interaction_count``,
``capabilities``, and ``message``.Error codes:
- invalid_input: malformed public_key_hex.
- proof_sig_invalid: JWT signature or content check failed.
- proof_expired: JWT iat is outside the 300-second window.
- key_not_found: no standalone agent registered with that public key.
- already_linked: the standalone profile is already linked to AgentAuth.
- authentication_failed: AgentAuth token invalid or expired.
| Name | Required | Description | Default |
|---|---|---|---|
| access_token | Yes | ||
| public_key_hex | Yes | ||
| signed_proof | Yes | ||
| dry_run | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description fully covers behavioral traits: one-time irreversible operation, transfer of history and scores, canonical agent ID contract, authentication change, and detailed error codes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with sections for purpose, steps, contract, JWT requirements, example, arguments, returns, and errors. While comprehensive, it is lengthy but earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (4 params, no output schema, no annotations), the description is thorough: explains parameters, return values, error codes, and behavioral implications. An AI agent can correctly invoke the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds substantial meaning beyond the schema, including detailed explanations for each parameter, JWT claims requirements, and a Python example. This compensates for the 0% schema description coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Link a standalone trust profile to an AgentAuth identity,' specifying the verb and resource. It distinguishes this tool from siblings by its unique linking operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for use, including that it is one-time and irreversible, and explicitly explains the dry-run option. It lacks explicit alternatives or when-not-to-use statements, but the context is sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_my_attestationsA
List your active (non-expired, non-revoked) attestations.
Returns all attestations issued for your agent identity that are still valid. Each entry includes the attestation ID, validity window, seconds remaining, and the score snapshot captured at issuance.
REQUIRES authentication (access_token or public_key_hex).
Example call: list_my_attestations(access_token="eyJ...")
Example response: { "agent_id": "550e8400-...", "attestations": [ { "attestation_id": "b1c2d3e4-...", "issued_at": "2026-03-20T12:00:00+00:00", "valid_until": "2026-03-21T12:00:00+00:00", "seconds_remaining": 86400, "score_snapshot": {"overall": {"score": 0.82, "confidence": 0.71}} } ], "count": 1 }
| Name | Required | Description | Default |
|---|---|---|---|
| access_token | No | ||
| public_key_hex | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description explains that only non-expired, non-revoked attestations are returned, provides example response fields, and notes authentication needs. It does not explicitly state it is read-only, but is strongly implied.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, front-loaded with purpose, and includes a clear example call and response without extraneous information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list tool with two parameters and no output schema, the description provides a full example response and covers authentication and result semantics, making it complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 0% description coverage, but the description compensates by stating that authentication requires at least one of access_token or public_key_hex. However, it does not elaborate on parameter formats or generation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'list' and the resource 'your active attestations', and distinguishes it from siblings like issue_attestation and verify_attestation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description specifies the context (listing one's own active attestations) and authentication requirement, but does not explicitly mention when not to use it or compare with alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_pending_confirmationsA
List interactions reported by counterparties that await your confirmation.
When another agent reports an interaction involving you, it starts as unconfirmed. Use confirm_interaction to confirm their report, which boosts the mutual_confirmed flag and increases credibility weighting.
REQUIRES authentication (access_token with trust.read scope).
since_days: how far back to look (default 30, max 365) limit: max results (default 50, max 200)
Example call: list_pending_confirmations(access_token="eyJ...")
Example response: { "agent_id": "my-uuid", "pending": [ { "interaction_id": "a1b2c3d4-...", "reported_by": "counterparty-uuid", "interaction_type": "transaction", "outcome": "success", "reported_at": "2026-03-20T12:00:00+00:00" } ], "count": 1 }
| Name | Required | Description | Default |
|---|---|---|---|
| access_token | Yes | ||
| since_days | No | ||
| limit | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations, but description fully discloses authentication requirements, effect of confirmation, parameter constraints, and example response with structure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with purpose, context, requirements, params, and example. Slightly long example but informative. No wasted sentences.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema, but example response covers all fields. Describes authentication, parameters, and downstream use. Complete for a list tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage 0%, but description explains access_token as auth, since_days and limit with defaults/max, plus example usage. Adds significant meaning beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states it lists interactions reported by counterparties awaiting confirmation, with specific verb and resource. Distinct from siblings like confirm_interaction or report_interaction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides context about when to use (after counterparty reports) and hints at alternative (confirm_interaction). Mentions authentication scope. Lacks explicit exclusions but sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
register_agentA
Register a new agent in the trust network.
Three registration paths:
AgentAuth (preferred): Provide your AgentAuth
access_token. Your identity is verified via token introspection and your AgentAuthagent_idbecomes your trust profile ID. Zero additional config needed.Standalone: Provide an Ed25519
public_key_hex(hex-encoded 32-byte public key). You get a local trust profile with limited scopes (trust.read+trust.report). You can link to AgentAuth later via thelink_agentauthtool.Auto-generated keys: Omit both
access_tokenandpublic_key_hex(standalone mode only). An Ed25519 key pair is generated for you and returned in the response aspublic_key_hexandprivate_key_hex. Store the private key immediately — it is shown only once.
If the agent profile already exists, returns the existing profile without error (idempotent).
Args:
display_name: Human-readable name for this agent (optional).
capabilities: List of capability tags, e.g. ["code-review", "search"].
metadata: Arbitrary key/value metadata to store on the profile.
access_token: AgentAuth bearer token (AgentAuth path).
public_key_hex: Hex-encoded Ed25519 public key (standalone path).
Omit both access_token and public_key_hex to auto-generate
a key pair (standalone mode only).
Returns:
agent_id, source ("agentauth" or "standalone"), scopes,
created (bool), registered_at, and display_name.
Example call (auto-generated keys — simplest path): register_agent(display_name="my-search-agent", capabilities=["search", "summarize"])
Example response: { "agent_id": "550e8400-...", "source": "standalone", "scopes": ["trust.read", "trust.report"], "created": true, "public_key_hex": "a1b2c3...", "private_key_hex": "d4e5f6...", "warning": "Key pair auto-generated. Store private_key_hex securely." }
| Name | Required | Description | Default |
|---|---|---|---|
| display_name | No | ||
| capabilities | No | ||
| metadata | No | ||
| access_token | No | ||
| public_key_hex | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden and delivers comprehensive behavioral details: registration paths, idempotency, scope limitations, key generation warnings, and the one-time display of private keys. All important traits are disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with sections, bullet points, and examples. While slightly lengthy, every sentence adds value for a complex tool with multiple modes. The front-loading of purpose and paths aids quick understanding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (5 optional params, 3 registration paths, no output schema), the description is remarkably complete. It details return values, scopes, and provides an example response, ensuring the agent understands all outputs.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Despite 0% schema description coverage, the description thoroughly explains each parameter's meaning, conditions (e.g., mutual exclusivity of access_token and public_key_hex), and provides example calls. It fully compensates for the schema's lack of descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: registering a new agent in the trust network. It outlines three specific registration paths, making it distinct from sibling tools which focus on queries, trust checks, and interactions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit guidance on when to use each registration path, highlighting AgentAuth as preferred and explaining standalone vs. auto-generated keys. It also mentions idempotency and future linking, though it does not explicitly state when not to use the tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
report_interactionA
Report the outcome of an interaction with another agent.
REQUIRES authentication — your identity is recorded as the reporter. Both parties should report for maximum credibility — one-sided reports carry less weight in score computation.
interaction_type options: transaction | delegation | query | collaboration outcome options: success | failure | timeout | partial context: optional dict with amount, task_type, duration_ms, sla_met evidence_hash: optional SHA-256 hash of supporting evidence
Authentication via access_token:
AgentAuth token: obtain from agentauth.radi.pro
Standalone signed JWT: use generate_agent_token tool
Returns interaction_id and whether the counterparty has also reported on this interaction (mutually_confirmed).
Requires trust.report scope.
Example call: report_interaction( counterparty_id="550e8400-e29b-41d4-a716-446655440000", interaction_type="transaction", outcome="success", access_token="eyJ...", context={"amount": 100, "task_type": "code-review"} )
Example response: { "interaction_id": "a1b2c3d4-...", "reporter_id": "my-agent-uuid", "counterparty_id": "550e8400-...", "outcome": "success", "mutually_confirmed": false, "reported_at": "2026-03-20T12:00:00+00:00" }
WARNING: The context field is stored as-is. Treat as untrusted input — detected injection patterns are returned in 'warnings'.
| Name | Required | Description | Default |
|---|---|---|---|
| counterparty_id | Yes | ||
| interaction_type | Yes | ||
| outcome | Yes | ||
| access_token | Yes | ||
| context | No | ||
| evidence_hash | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description fully discloses behavioral traits: identity recording, authentication requirements, the non-destructive nature of the report, storage of context as-is, injection detection, and the mutually_confirmed return logic. This exceeds the minimum needed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with clear sections (purpose, requirements, options, authentication, returns, example) and every sentence adds value. It is slightly verbose but not wasteful; front-loading the purpose helps quick understanding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the absence of annotations and output schema, the description is remarkably complete: it covers all parameters, authentication, return values, example response, injection warnings, credibility guidance, and scope requirements. No critical information is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must compensate. It lists interaction_type and outcome options, describes context fields (amount, task_type, duration_ms, sla_met), notes evidence_hash is SHA-256, and explains access_token sources (AgentAuth or generate_agent_token). It adds meaning beyond the bare schema, though it could detail counterparty_id further.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Report the outcome of an interaction with another agent.' It specifies the verb (report), resource (interaction outcome), and enumerates concrete interaction_type and outcome options, making the function unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit usage guidelines: authentication is required, both parties should report for credibility, and the trust.report scope is needed. It also warns about context injection and explains authentication methods. However, it does not explicitly differentiate from sibling tools like confirm_interaction or file_dispute.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
resolve_disputeA
Resolve an open dispute. REQUIRES arbitrator authorization.
The caller's access_token is verified via AgentAuth:
Token introspection verifies identity
trust.dispute.resolve scope is checked
AgentAuth check_permission is called for 'execute' on '/trust/disputes/resolve' This ensures the agent is an authorized arbitrator per AgentAuth policies.
resolution options:
upheld: dispute is valid; penalizes the agent filed against
dismissed: dispute is frivolous; slightly penalizes the filer
split: partial fault on both sides
Returns updated dispute status and resolution.
| Name | Required | Description | Default |
|---|---|---|---|
| dispute_id | Yes | ||
| resolution | Yes | ||
| access_token | Yes | ||
| resolution_note | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description fully discloses behavioral traits: the authorization process, side effects of each resolution option (penalties), and that it returns updated status. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a summary sentence, bulleted auth steps, and list of options. It is slightly verbose on auth details but every sentence adds value. Front-loading is good.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description mentions return of updated dispute status and resolution. It covers resolution options and auth, but could elaborate on error conditions or prerequisites like the dispute being open (already mentioned). Still adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so description must compensate. It explains the 'resolution' parameter via options (upheld, dismissed, split) and clarifies 'access_token' usage. However, 'dispute_id' and 'resolution_note' lack explicit description, though their purpose is easily inferred.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Resolve an open dispute.' It specifies the verb (resolve) and resource (dispute), distinct from sibling 'file_dispute' which would create a dispute.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly requires arbitrator authorization and details the auth flow, but it does not directly compare to alternatives or specify when not to use it. However, the resolution options and auth requirements provide clear context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_agentsA
Search for agents meeting trust criteria.
Filter by minimum score, required capabilities, and minimum interaction count. Returns matching agents ranked by score descending. Use this to find trustworthy agents for a specific task type.
Args:
min_score: Minimum trust score (0.0–1.0). Default 0.0 returns all.
score_type: Score dimension to filter on. One of: overall,
reliability, responsiveness, honesty, or a
domain-specific score like domain:coding.
capabilities: Require agents to have ALL of these capability tags.
min_interactions: Minimum number of recorded interactions.
limit: Maximum results to return (1–100, default 20).
access_token: Optional AgentAuth token (reserved for future
permission-gated filters).
Returns:
agents list (each with agent_id, display_name,
score, interaction_count, capabilities), total
count, and applied filters.
| Name | Required | Description | Default |
|---|---|---|---|
| min_score | No | ||
| score_type | No | overall | |
| capabilities | No | ||
| min_interactions | No | ||
| limit | No | ||
| access_token | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It details filtering, ranking, and return structure, but omits rate limits or authentication requirements beyond optional token.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with Description, Args, and Returns sections, front-loading main purpose. Some verbosity in parameter descriptions, but overall efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 6 parameters and no output schema or annotations, the description covers input semantics, return structure, and usage context. Lacks pagination details, but limit parameter addresses this.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 0% description coverage; the description compensates fully with detailed Args for each parameter, including ranges, allowed values, and defaults.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Search for agents meeting trust criteria' with specific filters (score, capabilities, interactions) and result ranking, distinguishing it from siblings like check_trust or compare_agents.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states 'Use this to find trustworthy agents for a specific task type' and explains default behaviors for parameters, but lacks explicit when-not-to-use or mention of sibling alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sybil_checkA
Run sybil detection checks against an agent.
Detects three suspicious patterns:
ring_reporting: mutual positive feedback loops (A rates B high, B rates A high)
burst_registration: many agents registered in a short time window
delegation_chain: unusually long delegation chains (>3 hops)
Returns risk_score (0.0 clean → 1.0 suspicious), is_suspicious flag, and detailed signals with severity and evidence.
No authentication required — this is a public safety tool.
Example call: sybil_check(agent_id="550e8400-e29b-41d4-a716-446655440000")
Example response: { "agent_id": "550e8400-...", "risk_score": 0.0, "is_suspicious": false, "is_high_risk": false, "signals": [], "checked_at": "2026-03-20T12:00:00+00:00" }
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Since no annotations are provided, the description carries full burden. It details the three detection patterns, describes the return format (risk_score 0.0-1.0, is_suspicious flag, signals), and gives an example response. It does not explicitly state read-only behavior but implies it.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured: purpose statement, list of detection patterns, summary of output format, and example call/response. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the low complexity (single parameter, no output schema), the description is complete. It explains what the tool detects, what it returns, and provides an example. No information is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description compensates by providing a concrete example of the agent_id parameter with a UUID format. It adds value beyond the schema's type and title.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Run sybil detection checks against an agent' and lists three specific suspicious patterns. This distinguishes it from siblings like check_trust and check_trust_batch, which focus on trust scores.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides context by stating 'No authentication required — this is a public safety tool.' It includes an example call, but does not explicitly state when not to use this tool or compare it to alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verify_attestationA
Verify an attestation's signature, check expiry, and confirm it hasn't been revoked.
Returns validity status, the embedded score snapshot, subject agent_id, and time remaining until expiry.
No authentication required — attestations are designed to be portable and verifiable by any party without querying this service. This is by design: third parties can verify trust claims offline.
| Name | Required | Description | Default |
|---|---|---|---|
| jwt_token | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It discloses return values (validity status, score snapshot, agent_id, time remaining) and the stateless nature. Could mention error handling or if any side effects exist, but overall good.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences followed by a list of return fields. No fluff, information is front-loaded. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple 1-parameter tool with no output schema, the description explains all relevant aspects: purpose, return values, and authentication requirements. Complete and sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description adds no detail about the jwt_token parameter beyond its name. It does not specify expected format, length, or encoding, leaving the agent to infer.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (verify signature, check expiry, confirm not revoked) and resource (attestation). It distinguishes from siblings like 'check_trust' by focusing on attestation-specific operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states 'No authentication required' and that attestations are portable and verifiable by any party offline. This tells agents when to use it and that it requires no service-dependent authorization.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verify_link_proofA
Preflight check: validate a link_agentauth proof without writing to the DB.
Runs all the same validation steps as link_agentauth — token
authenticity, key lookup, proof signature, expiry, and whether the
agent is already linked — but never persists any changes. Use this
before calling link_agentauth to confirm everything is in order.
Args:
access_token: AgentAuth bearer token to validate.
public_key_hex: Hex-encoded Ed25519 public key of the standalone agent.
signed_proof: JWT signed by the standalone private key (same format
required by link_agentauth).
Returns: A dict with:
- ``valid`` (bool): ``True`` only when all checks pass.
- ``checks``: individual check results:
- ``token_valid`` — AgentAuth token successfully authenticated.
- ``key_found`` — standalone agent exists with this public key.
- ``proof_sig_valid`` — JWT signature, ``sub``, and ``action`` OK.
- ``proof_not_expired`` — ``iat`` within 300 seconds of now.
- ``already_linked`` — the agent is already linked (blocks linking).
- ``agent_id``: standalone UUID if the key was found, else omitted.
- ``error``: description of the first failing check, if ``valid=False``.
| Name | Required | Description | Default |
|---|---|---|---|
| access_token | Yes | ||
| public_key_hex | Yes | ||
| signed_proof | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Describes all validation steps (token authenticity, key lookup, proof signature, expiry, already linked) and explains that no changes are persisted. With no annotations, the description fully carries the behavioral burden.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with overview, Args, and Returns sections; every sentence is informative and no extraneous content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Comprehensively explains the return value (dict with valid, checks, agent_id, error), compensating for the lack of an output schema and covering all necessary behavioral details.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, but the description provides detailed parameter explanations (e.g., 'AgentAuth bearer token', 'Hex-encoded Ed25519 public key'), adding essential meaning beyond the schema's bare titles and types.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the tool is a preflight check for validating a link_agentauth proof without writing to the DB, distinguishing it from the sibling tool link_agentauth.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says 'Use this before calling link_agentauth', providing clear context for when to use this tool versus the actual linking tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
whoamiA
Check your identity as AgentTrust sees it.
Returns your agent_id, registration source (agentauth or
standalone), trust scores summary, interaction count, active scopes,
and registration date. Useful for verifying your auth is working correctly
before making other calls.
Canonical agent ID contract: for agents that have linked a standalone
profile to AgentAuth via link_agentauth, the agent_id returned
here is always the original standalone UUID. The AgentAuth UUID is stored
as agentauth_id in the profile's metadata_ field. Use the
standalone UUID (canonical ID) as the stable identifier in all API calls.
Args: access_token: AgentAuth bearer token. public_key_hex: Hex-encoded Ed25519 public key (standalone agents).
Returns:
agent_id (canonical standalone UUID), source, trust_level,
scopes, registered_at, display_name, capabilities,
agentauth_linked, and scores (dict of score_type → score).
| Name | Required | Description | Default |
|---|---|---|---|
| access_token | No | ||
| public_key_hex | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so the description carries full burden. It details the return fields and explains the canonical agent ID contract for linked profiles. No side effects mentioned, but likely none. Auth requirements are implicit from parameters.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with paragraphs and a bullet list of returns. It is front-loaded with the main purpose. Slightly lengthy but each part adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description includes a detailed list of return fields. It covers the tool's functionality well. Could mention error scenarios, but not necessary for a simple identity check.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 0% description coverage, but the description adds meaningful detail: 'access_token: AgentAuth bearer token' and 'public_key_hex: Hex-encoded Ed25519 public key (standalone agents).' This goes beyond the schema titles.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Check your identity as AgentTrust sees it' and lists the returned fields, making the tool's purpose immediately obvious. It distinguishes itself from sibling tools like 'get_agent_profile' and 'check_trust' by focusing on the caller's own identity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states 'Useful for verifying your auth is working correctly before making other calls,' which provides clear context for when to use. Does not mention alternatives or when not to use, but for a simple identity check this is sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
23 tool updates
v0.1.5- First observed
agent_status - First observed
check_trust - First observed
check_trust_batch - First observed
compare_agents - First observed
confirm_interaction - First observed
discover - First observed
file_dispute - First observed
generate_agent_token - First observed
get_agent_profile - First observed
get_interaction_history - First observed
get_score_breakdown - First observed
issue_attestation - First observed
link_agentauth - First observed
list_my_attestations - First observed
list_pending_confirmations - First observed
register_agent - First observed
report_interaction - First observed
resolve_dispute - First observed
search_agents - First observed
sybil_check - First observed
verify_attestation - First observed
verify_link_proof - First observed
whoami
TDQS
Every tool has a clearly distinct purpose, from registration and authentication to trust checking, interaction reporting, disputes, attestations, linking, and sybil detection. No two tools overlap in functionality.
Most tools follow a verb_noun pattern (e.g., check_trust, report_interaction, issue_attestation). However, a few deviate (e.g., agent_status, whoami, discover), preventing a perfect score.
23 tools is slightly above the typical 3-15 range for a well-scoped server, but the comprehensive nature of a trust network service justifies the count. It is not excessive or thin.
The tool surface covers the full lifecycle of trust management: registration, authentication, trust querying, interaction reporting, confirmation, disputes, attestations, linking, search, and sybil detection. Only minor gaps like attestation revocation are missing.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Trust infrastructure for AI agents. Portable reputation (JTS 0-5), agent discovery, vouching.
Decay-weighted reputation + tamper-evident trust attestations for the agent economy.
Agent reputation registry: check, register, and endorse AI agents
MCP-native Trust Infrastructure for AI Agents. Persistent encrypted memory with Trust Quotient.
Related MCP Servers
- AlicenseAqualityDmaintenanceMCP server for AI agent identity — verify agents with Ed25519 signatures, check trust scores, sign and verify content, exchange encrypted messages. Built on the Agent Identity Protocol (AIP).8MIT
- AlicenseNot gradedqualityNot gradedmaintenanceProvides AI agents with trust scoring and reputation management capabilities for secure interactions. Enables agents to check trust scores, rate interactions, and manage disputes before transacting with other agents.-
- AlicenseAqualityDmaintenanceMCP server for agent reputation staking — trust through skin-in-the-game. Agents deposit stakes as trust collateral, with slashing for bad behavior and reputation building over time.7MIT
- AlicenseAqualityDmaintenanceMCP server for AI agent trust verification, enabling agents to verify identities, check trust scores, and build reputation across multiple blockchain and web platforms.12241MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/raditotev/agent-trust'
If you have feedback or need assistance with the MCP directory API, please join our Discord server