Skip to main content
Glama
stillmarcus24

stillos-notary-mcp

stillos-notary-mcp

Verification infrastructure for the agentic economy. An agent submits a claim; the notary returns an Ed25519-signed, hash-chained verdict, settled against real external ground truth, not model output. Free tier, no account, no card.

Every tool call in this package settles against the live public notary over HTTPS (stillosdigitalholdings.com/notary). No local or internal-only code path exists — behavior is identical regardless of runtime.

Install

npx stillos-notary-mcp mcp

Or add to an MCP client config:

{
  "mcpServers": {
    "stillos-notary": { "command": "npx", "args": ["-y", "stillos-notary-mcp", "mcp"] }
  }
}

Related MCP server: Recommend Agentic Trust Layer

Tools

claim_verdict

Submits a claim and a resolver specification. Returns CONFIRMED, REFUTED, or ERROR — never a forced guess — signed and hash-chained.

Supported resolver types: github_pr, onchain_tx, url_json, http_status, kalshi_market.

stillos-notary-mcp claim "your-agent" "example.com returns 200" \
  '{"type":"http_status","url":"https://example.com","expect_code":200}'

verify_receipt

Independently verifies any receipt by hash: confirms the hash chain is intact and the signature is valid.

stillos-notary-mcp verify <receipt_hash>

file_dispute

Files a bonded dispute against a verdict receipt. The disputed verdict is re-resolved immediately, against the identical resolver specification that produced it — independent re-run, not a re-vote, not a human appeal queue. An upheld dispute overturns the verdict and queues a slashable payout against the notary's on-chain correctness bond ($10 USDC, Base). Dispute window: 48 hours from the original receipt's timestamp.

Paying for a paid tool (1.3.0)

Through 1.2.2 this package could only report the paywall: every paid tool returned { payment_required: true } and the call ended there. There was no way, anywhere in the package, to attach a payment and retry — the CLI told you to "attach payment and retry" using a mechanism that did not exist. 1.3.0 implements it.

Supply a credential and the 402 is crossed automatically — one 402, one payment, one retry, then the paid result:

const { callTool } = require('stillos-notary-mcp');

// 1. Preferred: your own payment-capable fetch. We never see a key.
const r = await callTool('screen_entity', { agent: 'me', entity: 'Acme Corp' },
                         { fetch: myX402Fetch });

// 2. Or a viem account / signer object.
await callTool('screen_entity', args, { account: myViemAccount });

// 3. Or, as a documented fallback, a raw key in the environment.
//    export STILLOS_NOTARY_WALLET_KEY=0x...
await callTool('screen_entity', args);

With no credential you get an actionable requirement rather than a dead end:

{
  "ok": false, "paid": false, "code": "PAYMENT_REQUIRED",
  "payment": { "amount_usd": 0.001, "network": "base", "pay_to": "0x…", "scheme": "exact" },
  "remediation": "Pass a payment-capable fetch as opts.fetch, a viem account as opts.account, or set STILLOS_NOTARY_WALLET_KEY, then call again."
}

What it refuses to pay. A 402 is untrusted input. The client will not sign for a network or scheme it does not expect (base / exact only), will not pay a malformed requirement missing payTo or an amount, and will not exceed a per-call ceiling ($1.50 default, STILLOS_NOTARY_MAX_USD or opts.maxUsd to change). It never retries more than once — a second 402 is a hard stop, not a backoff loop, so a rejected payment can never be re-signed into a double spend. Supplying no credential never spends anything. No key is received, logged, persisted, or placed in an error message.

Covered by test/payment-continuation.test.cjs (17 cases, local mocks, no real settlement).

Paid: $1.00 USDC (Base) via x402 — no free tier. A call without an attached x402 payment returns the payment requirement (price, payTo, asset), not a verdict. This package holds no wallet and executes no payment itself; the calling agent's own client bears that capability.

stillos-notary-mcp dispute "your-agent" <receipt_hash>

screen_entity

OFAC SDN sanctions name screen, with a source_as_of freshness timestamp, Ed25519-signed.

Free up to 5/agent/day, then $0.001 USDC (Base) via x402.

stillos-notary-mcp screen "your-agent" "Acme Corp"

distress_score

Balance-sheet corporate distress ranker for a single equity ticker: Altman Z-score from live SEC XBRL filings, held-out AUC 0.769 on 178 real Chapter 11 filings vs 71 date-matched controls. ~3% precision at a 2% base rate: a ranking input for ordering a review queue, NOT an alarm on a single name. The prior "71% sensitivity / 100% specificity" claim (n=14) is withdrawn. Ed25519-signed.

Free up to 3/agent/day, then $0.15 USDC (Base) via x402.

stillos-notary-mcp distress "your-agent" AAPL

Why

Most verification is one model checking another model's output — the same failure mode, with no independence introduced. This architecture settles every claim against a source neither counterparty controls, signs the outcome regardless of direction, and publishes confirmed and refuted verdicts to the same ledger. Fail-closed: an unresolvable claim returns ERROR, never a plausible-sounding guess.

Live docs: https://stillosdigitalholdings.com/notary/docs

Available Tools

5 tools
claim_verdictAInspect

Submits a claim and returns a signed verdict: settled against real external ground truth (GitHub PR, on-chain tx, HTTP status, JSON field, Kalshi market, or multi-exchange price consensus), Ed25519-signed, hash-chained. Free tier — no account, no card. Returns CONFIRMED, REFUTED, or ERROR — never a forced guess.

ParametersJSON Schema
NameRequiredDescriptionDefault
agentYeswho is asking (shown on the public reputation ledger)
claimYesthe claim in plain language, e.g. "PR #42 on owner/repo is merged"
resolverYeswhich external source resolves this claim

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does well: it discloses Ed25519 signing, hash-chaining, three fixed outcomes, no forced guess, and the free tier. However, it doesn't mention the public reputation-ledger side effect (only in schema) and lists 'multi-exchange price consensus' as a ground-truth source that is unsupported by the resolver enum, creating a mild inconsistency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two front-loaded sentences with no waste. The main action and return value lead, and the signing/hash-chaining and free-tier notes are useful context that earns their place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite lacking an output schema, it clearly states the possible return values and key behavioral guarantees. It could add handling for invalid resolvers or the public-ledger effect, but for a 3-parameter tool the description is substantially complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds no parameter-level insight beyond the schema; the claim example already lives in the schema, and the resolver list mismatch introduces confusion rather than clarity.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific action (submits a claim) and a specific return (signed verdict), and enumerates external ground-truth sources. It does not explicitly differentiate from sibling verify_receipt, but the scope is clearly claim veridication against real-world evidence.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool vs siblings like verify_receipt, file_dispute, or screen_entity. It implies claims need external ground truth but provides no exclusions, prerequisites, or alternative routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

distress_scoreAInspect

Validated corporate distress-foresight score for a single equity ticker: Altman Z-score computed from live SEC XBRL filings, backtested 71% sensitivity / 100% specificity with a ~109-day median lead time, Ed25519-signed. Paid: $0.15 USDC (Base) via x402 — no free tier. A call without an attached x402 payment returns the payment requirement, not a verdict.

ParametersJSON Schema
NameRequiredDescriptionDefault
agentYeswho is asking (shown on the public reputation ledger)
tickerYesequity ticker to score, e.g. "AAPL"

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It discloses the paid nature, the exact price, the payment method, the signing mechanism, and the behavior when payment is absent. It does not describe rate limits or failure modes beyond the payment requirement, but the disclosed behaviors are substantial and specific.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and information-dense, with every sentence earning its place. It front-loads the core purpose, then adds validation metrics, payment terms, and the no-payment behavior in a logical order.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a paid single-ticker scoring tool with no output schema, the description covers the essential operational details: what it computes, how it is validated, what it costs, how to pay, and what happens without payment. It does not describe the response format, but the absence of an output schema and the clear payment behavior make the description reasonably complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents both parameters. The description adds context for 'ticker' by giving an example and for 'agent' by explaining it appears on a public reputation ledger, which is useful but not a major addition beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('computes'), a specific resource ('Altman Z-score from live SEC XBRL filings'), and a clear scope ('for a single equity ticker'). It also distinguishes itself from siblings by emphasizing the paid, signed distress-foresight score rather than a generic screen or verification tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly explains the payment requirement and the consequence of calling without payment, which is essential usage guidance. It does not explicitly name alternative tools for when not to use this one, but the sibling list and the phrase 'single equity ticker' imply the scope boundary.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

file_disputeAInspect

Files a bonded dispute against a verdict receipt: the disputed verdict is re-resolved immediately against the identical resolver specification that produced it — independent re-run, not a re-vote. An upheld dispute overturns the verdict and queues a slashable payout against the notary's on-chain correctness bond. Paid: $1.00 USDC (Base) via x402 — no free tier. A call without an attached x402 payment returns the payment requirement (price, payTo, asset), not a verdict.

ParametersJSON Schema
NameRequiredDescriptionDefault
agentYeswho is filing the dispute (shown on the public reputation ledger)
receipt_hashYesthe receipt_hash of the verdict being disputed — must be under 48 hours old

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses that this is an independent re-run rather than a re-vote, that an upheld dispute overturns the verdict and queues a slashable payout against the notary's bond, and that unpaid calls return only the payment requirement. This is strong behavioral disclosure for a paid, consequence-bearing mutation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is four dense sentences with no repetition or filler. It front-loads the core action, then layers mechanics, consequences, cost, and the no-payment response behavior efficiently.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no annotations and no output schema, the description covers most essential context: cost, payment protocol, re-resolution semantics, and outcome of an upheld dispute. It explicitly describes the unpaid-call response but does not state what a successful paid call returns, which is a minor gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Both parameters are fully described in the schema (100% coverage), so the baseline applies. The description adds no new parameter-level detail beyond what the schema already states; the 48-hour constraint and public-ledger visibility are already present in the schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb ('Files') and a clear resource ('a bonded dispute against a verdict receipt'), then explains its unique mechanics: re-resolution against the identical resolver spec, not a re-vote. This clearly distinguishes it from sibling tools like verify_receipt or claim_verdict.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The context for use is clear: to dispute a verdict receipt under 48 hours old, with an attached x402 payment. It notes there is no free tier and explains the unpaid-call behavior, but it does not explicitly compare to sibling tools or state when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

screen_entityAInspect

OFAC SDN sanctions name screen: matches a legal name against the OFAC Specially Designated Nationals list, with a source_as_of freshness timestamp, Ed25519-signed. Paid: $0.001 USDC (Base) via x402 — no free tier. A call without an attached x402 payment returns the payment requirement, not a verdict.

ParametersJSON Schema
NameRequiredDescriptionDefault
agentYeswho is asking (shown on the public reputation ledger)
entityYeslegal name to screen against the OFAC SDN list

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden, and it does this well: it discloses the exact cost, the payment chain and protocol, the absence of a free tier, the behavior when payment is missing, the Ed25519 signature, and the source_as_of freshness timestamp. This is far beyond a minimal description.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three tightly packed sentences: purpose, cost/payment protocol, and unpaid behavior. It is front-loaded with the core purpose and contains no filler or redundant restatements of the tool name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter paid screening tool, the description covers purpose, cost, payment requirement, unpaid response behavior, response freshness, and signing. It does not detail the exact success verdict shape, and there is no output schema, but enough is provided for an agent to invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, and both parameters are already well described in the input schema: 'agent' identifies the caller and 'entity' is the legal name to screen. The description does not add meaning beyond what the schema already provides, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific action ('matches a legal name') against a specific resource (the OFAC Specially Designated Nationals list). This distinguishes it from siblings like file_dispute and verify_receipt, which serve different purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear invocation context: this is a paid tool with no free tier, and a call without an attached x402 payment will return the payment requirement instead of a verdict. It does not explicitly name alternatives or state when not to use it, but the payment prerequisite is clearly communicated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

verify_receiptAInspect

Independently verifies any StillOS notary receipt by its hash: confirms the hash chain is intact and the Ed25519 signature is valid. Read-only, free, no auth.

ParametersJSON Schema
NameRequiredDescriptionDefault
hashYesthe receipt_hash returned by claim_verdict or commit

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It explicitly states the operation is read-only, free, and requires no auth, which is essential behavioral context. It also discloses what verification entails (hash chain and signature). It does not describe the return format, but that is a minor gap for such a simple tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, dense sentence that front-loads the core purpose, then adds the verification details and operational traits. Every clause earns its place with no filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter, read-only verification tool, the description covers purpose, verification mechanism, and operational constraints. It lacks an explicit statement of what the tool returns, but the absence of an output schema and the verb 'confirms' make the intended result reasonably inferable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the parameter schema already explains that hash is the receipt_hash returned by claim_verdict or commit. The description adds only 'by its hash,' which reinforces but does not meaningfully extend the schema's parameter documentation. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('verifies') with a specific resource ('StillOS notary receipt') and names the exact mechanism (hash chain integrity + Ed25519 signature validity). This clearly distinguishes it from siblings like claim_verdict or file_dispute, which perform different actions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description makes the use case clear: verify any notary receipt independently by its hash. It also references receipts returned by claim_verdict or commit in the parameter schema, grounding when the tool is relevant. It does not explicitly list exclusions or alternatives, but the context is sufficient for a single-purpose verification tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 5 tool updates
    • First observedclaim_verdict
    • First observeddistress_score
    • First observedfile_dispute
    • First observedscreen_entity
    • First observedverify_receipt

TDQS

A4.1/5.0

Scored across 5 tools

Disambiguation5/5

Each tool targets a distinct action—general claim resolution, specialized scoring, OFAC screening, dispute filing, and receipt verification. The overlapping 'signed verdict' outputs are clearly differentiated by resolver type, pricing model, and lifecycle role.

Naming Consistency4/5

Most tools follow a clear verb_noun pattern: claim_verdict, file_dispute, screen_entity, verify_receipt. distress_score breaks that pattern as a noun phrase, making it the one inconsistent name in an otherwise coherent set.

Tool Count5/5

Five tools is well-scoped for a notary-style service. The set covers creation, specialized verdict types, dispute handling, and verification without unnecessary redundancy.

Completeness4/5

The core lifecycle is covered: create verdicts, dispute them, and verify receipts. A minor gap is the lack of a general receipt-listing or lookup tool, though verify_receipt by hash mitigates this.

Maintenance

ActivityMaintained
ResponsivenessUnresponsive

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables defining and verifying evidence contracts for claims in READMEs, releases, or product pages using constrained verifiers and generating hash-chained receipts and reports.
    6 npm
    MIT
  • A
    license
    A
    quality
    C
    maintenance
    Provides cryptographic truth infrastructure for AI agents, enabling them to seal content with SHA-256 and Ed25519, verify receipts, anchor them to Bitcoin via OpenTimestamps, generate citations, and audit chains of receipts.
    5
    24 npm
    1
    MIT
  • A
    license
    A
    quality
    C
    maintenance
    Enables agents and clients to fact-check factual claims against live web sources, returning citable verdicts with source details and cryptographically signed receipts for downstream verification.
    1
    307 npm
    MIT