agent_registries_lookup
P75 registry aggregation: the cross-lens join applied to agent identity. Incumbent providers each consult only their own registry; this endpoint checks every registry TunnelMind can reach and labels each answer with an explicit state, so a gap can never be mistaken for a clean result:
observed— the subject IS in this registry (record attached)not_present— checked, and it isn't (an observation, not a gap)not_applicable— the registry doesn't key on this subject typedegraded— the check failed (timeout, upstream error)unavailable— the registry is not publicly consultable (closed / platform-scoped); stated in-band because silence would read as clean
Registries (v0): crawler_ranges (operator-published IP feeds —
Googlebot, GPTBot, PerplexityBot…), wba_directory (RFC 9421
Signature-Agent JWKS at the subject domain), mcp_registry
(registry.modelcontextprotocol.io), tunnelmind_known_agents (curated
verifiable/claim-only set), plus honest unavailable rows for Visa TAP,
Mastercard Agent Pay, and Cloudflare Verified Bots.
Use this tool when:
You are deciding whether an agent, bot, or MCP server is registered anywhere that vouches for it — in one call instead of five.
You need the blind spots stated: which registries could NOT be consulted for this subject, and why.
Inputs: subject — an IP (registry membership by published ranges), a
domain (WBA directory + MCP registry), or an agent name/UA fragment
(e.g. gptbot, claudebot). ?receipt=true attaches a signed
Receipt v1.0 committed to the transparency log.
Latency: remote registry checks are KV-cached for 1h; a warm call is edge-fast, a cold one bounded by 5s per-registry timeouts.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| receipt | No | Attach a signed TunnelMind Receipt v1.0 over the aggregation. | |
| subject | Yes | IP address, domain, or agent name / User-Agent fragment. |