# 5arz — Proof-of-Human MCP server

Prove a real, unique human performed an action — and mint a signed credential
anyone can verify, offline, without trusting us.

**Live endpoint:** `https://mcp.5arz.com` (Streamable HTTP)
**Docs:** <https://5arz.com/mcp> · **Free sandbox key:** no card, no sales call

---

## Why this exists

AI agents now solve CAPTCHAs faster than people do, and the fastest-growing
"user" on the web is an agent acting for a real customer. That breaks the
question everything was built around.

CAPTCHA asks *"can this session pass a puzzle?"* — a negative filter that treats
a helpful agent and an abusive bot identically.

5arz answers a different question: *"is there a real, unique human behind this
action, and can they prove it to everyone downstream?"* That is a credential
problem, not a puzzle problem.

Web Bot Auth, Know Your Agent and the Trusted Agent Protocol all reference a
verified human principal. None of them provide one. This is that layer.

## What you get

A signed **ES256 JWT**, verifiable against a public JWKS with any JWT library:

```json
{
  "iss": "https://5arz.com",
  "vct": "https://5arz.com/credentials/proof-of-personhood",
  "sub_hash": "…",
  "unique_human": true,
  "liveness": true,
  "assurance": "direct_document_liveness",
  "verified_by": "https://5arz.com",
  "method": "didit_document+passive_liveness+face_match",
  "exp": 1790000000
}
```

Two properties worth understanding:

**You never have to trust us.** Verification runs against
`https://api.5arz.com/.well-known/jwks.json`. No SDK, no callback, no dependency
on our uptime — or our continued existence. A receipt only the issuer can
validate is worth what an assertion is worth.

**The credential states its own provenance.** `assurance`, `verified_by` and
`method` say how the human was established. A credential from a partner's own
KYC is labelled `partner_asserted` and does not claim liveness we did not run.
`unique_human` is only ever `true` when uniqueness was actually checked. A
credential is worth exactly the weakest thing that can produce it, so we make
the difference machine-readable instead of hiding it.

## Tools

| tool | does |
|---|---|
| `verify_human` | attest that a verified human performed an action |
| `check_credential` | verify a Proof-of-Human JWT against the public JWKS |
| `register_agent` | create an agent identity + API key |
| `get_account` | credits, usage, recent verifications |
| `buy_credits` | purchase a verification pack |
| `vhh_index` | the Verified Human Hour index |

## Quick start

```bash
# free sandbox key — unlimited, credentials marked test:true
curl -X POST https://api.5arz.com/api/agents/register \
  -H 'content-type: application/json' \
  -d '{"name":"My Agent","contactEmail":"you@co.com","mode":"test"}'
```

Add to an MCP client:

```json
{ "mcpServers": { "5arz": { "url": "https://mcp.5arz.com" } } }
```

## Verify a credential yourself

Nothing below calls 5arz:

```python
import jwt, requests
jwks = requests.get("https://api.5arz.com/.well-known/jwks.json").json()
key  = jwt.PyJWKClient("https://api.5arz.com/.well-known/jwks.json") \
          .get_signing_key_from_jwt(token)
claims = jwt.decode(token, key.key, algorithms=["ES256"],
                    options={"verify_aud": False})
assert claims["iss"] == "https://5arz.com"
assert claims["unique_human"] is True
```

## Connecting your own users

If you run a product and want *your* users verified, you do not need them to
have a 5arz account:

- **You have no IDV** — `POST /api/agents/verify-link` returns a hosted link.
  Send your user; a signed credential arrives at your webhook.
- **You already verify your own users** — `POST /api/agents/humans/assert`.
  We mint, label it `partner_asserted` with your method, and do the rest:
  signing, uniqueness, revocation, delegation, reporting.

Or drop the button on any page:

```html
<script src="https://api.5arz.com/verify.js"
        data-site="agt_your_id" data-ref="your-user-id" async></script>
```

Verified once, reusable anywhere. Returning humans re-prove with a passkey — no
document, no vendor call.

> The browser result is advisory. The authoritative path is the
> `credential.issued` webhook to your server. Never gate access on a
> `postMessage` — your own users can forge it in devtools.

## Run it yourself

```bash
npm install
npm test            # protocol conformance
npx wrangler deploy
```

## Status

101 verified humans · 18 countries · 5,740 verified completions.
Patents pending US 63/979,052 · US 63/979,474.

The verification format is deliberately open. A credential nobody can
independently check has no value.

## License

Apache-2.0 — see [LICENSE](LICENSE).