Skip to main content
Glama

Inam Protocol Registry

spec npm PyPI npm CI License

Check who your agent is about to pay, before it pays. Free, no signup, no key. Pick one:

curl "https://api.inamprotocol.org/v1/check?target=https://x402.coinstats.app/markets"
npx inamprotocol check https://x402.coinstats.app/markets
claude mcp add --transport http inam https://api.inamprotocol.org/mcp

Each one looks up the seller's payment details, wallet history and domain age, then answers pass, caution or fail. Swap in any web address, 0x wallet or did:key. Python: python -m inamprotocol check <target> (from sdk-python).

More ways in

Local demo. An x402 payment only goes out if the payee's INAM ID proved control of the payTo wallet and has work a real counterparty countersigned; a server that borrows a reputable agent's ID gets nothing (recording below, runnable under Try it).

The command line reads the 402 (payTo, network, price), looks the payTo up in ERC-8004 (identity and whether any feedback is tied to delivered work), the INAM registry, the host's Web Bot Auth key directory and the domain's RDAP age, and prints what it found. Exit code 1 when a key check fails, so it can gate a payment or a CI step. Details: sdk-js/README.md. The same check is also the MCP tool inam_check and the A2A skill check. The API answer adds a next step and cachedAt (cached 10 minutes).

Badge for sellers. Show buyers your pre-payment verdict in your README (grey unknown when the target is invalid):

![INAM](https://api.inamprotocol.org/v1/badge?target=https://your-api.example/endpoint)

GitHub Action. Gate a workflow on the same check (composite action, calls the free hosted /v1/check with curl and jq, read-only, no secrets):

- id: inam
  uses: inamprotocol/inam-protocol/actions/check@v1
  with:
    target: https://x402.coinstats.app/markets   # x402 URL, 0x wallet or did:key
    fail-on: fail                                # or "caution" to be stricter
- run: echo "verdict ${{ steps.inam.outputs.verdict }}"

Output verdict is pass, caution or fail (error when the API could not be reached or answered 4xx/5xx; an error never passes). The job summary lists every check. The step exits 1 when the verdict meets fail-on, 2 on an error. Optional api-base points at a self-hosted registry. Details: actions/check/README.md. Test: node actions/check/test.mjs.

/v1/check stays free. GET https://api.inamprotocol.org/v1/x402/check is its paid twin over x402 (0.001 USDC on Base, listed in x402 Bazaars) for agents that shop there: same parameters, same answer. Payment never changes a verdict or a score (GOVERNANCE: scores are not for sale). Send INAM-Requester: <your did:key> and the response carries an INAM-Receipt you can countersign (SPEC §15; inamFetch does it for you).

Try it (one command, local, no real money, no signup):

git clone https://github.com/inamprotocol/inam-protocol && cd inam-protocol
npm install && npm --prefix sdk-js install
npm run demo:x402

Give your own agent an identity and its first countersigned receipt, in about a minute, against the live registry. The registry's demo agent is the other party (SPEC §14; demo receipts never count toward reputation):

npm i inamprotocol
curl -sO https://raw.githubusercontent.com/inamprotocol/inam-protocol/main/examples/quickstart.mjs && node quickstart.mjs

The key is saved to ./inam-agent.key and reused on later runs; that keypair is your agent's identity (a did:key), there is no signup.

Check any agent's reputation, no install and no key (this is a maintainer-run reference agent):

curl -s https://api.inamprotocol.org/v1/agents/did:key:z6MkjE6iZEFoKkBoxR3QygfWaFUkLUUkj1ry527tUWQB8Gpk/reputation

evidenceLevel says how much to believe trustScore: none, countersigned (both parties signed), or independently_verified. Browse agents in the explorer.

In your own agent it is one wrapper around fetch: withInamX402Gate(fetch, client, { minEvidence: "countersigned" }) (TypeScript SDK, examples/x402-verify-before-pay.ts, SPEC §11.2). The thresholds are yours; checkTrust() gives the same allow / escrow / deny decision outside x402.

Underneath, INAM is an open record of agent work: both sides sign a receipt for every finished job, and reputation is computed only from those receipts. INAM is not an agent communication protocol (that's MCP/A2A), not an identity or authorization replacement (that's AgentPass/AITP/Passport Alliance/DID), and not an agent runtime — it's the neutral record of "this work actually happened between these two agents, and here's their evidence-based track record." Full specification: SPEC.md, also readable at docs.inamprotocol.org alongside an interactive API reference generated from openapi.yaml (source in docs-site/).

Related MCP server: AgentVeil Protocol

Why this exists

A 2026 empirical study of ERC-8004, the Ethereum agent-reputation standard (arXiv 2606.26028), found that 95–100% of its feedback was tied to no task and no payment, and that 59–91% of reviewers showed coordinated Sybil behavior. Its conclusion was that the registry "cannot function as a reliable trust signal." Anyone can post a score, so scores mean little.

INAM has no free-standing score to post. Every trust signal is built from evidence:

  1. Two-party signed receipts. An agent's reputation comes only from Execution Receipts that both parties signed, each naming a job, a spec hash, and an output hash. The receipt ID is the hash of its content, so it can't be edited afterward.

  2. Sybil-discounted scoring. Counterparties are weighted by their own trust, repeat pairs count sub-linearly, and old history decays. Throwaway identities vouching for each other don't move the score.

  3. Operator-authorized verifiers. Independent attestations count only from verifiers the registry operator explicitly granted (no self-service). A rejected verdict scores as a failure. Every reputation reports its evidenceLevel: none, countersigned, or independently_verified. The maintainers run a live integrity verifier against the public registry every hour.

  4. Tamper-evident history. Every finalized receipt is appended to an RFC 6962-style Merkle transparency log. An external monitor checks each new tree head for consistency every hour, and its history is public on the monitor-state branch.

INAM composes with ERC-8004 rather than competing with it at the identity layer: an ERC-8004 identity can be linked to an INAM ID with a standard wallet signature (SPEC §11.1).

What these defences do not cover is listed in THREAT-MODEL.md. Who decides what, and what the public registry's operator commits to, is in GOVERNANCE.md.

This repository

This directory is the Node/TypeScript reference implementation: Express registry server, did:key identity, sybil-resistant reputation engine, and the InamClient SDK. The SDK itself is published standalone as inamprotocol (source in sdk-js/ — the exact code this server and the Worker deployment import, not a separate build). A parity Python SDK is published as inamprotocol on PyPI (source in sdk-python/). Node 22 — zero native dependencies (pure-JS crypto and the built-in node:sqlite store), so npm install never needs a C++ toolchain.

Run it

New here? Pick your role on the quickstart page (buyer, seller, agent developer), or start with QUICKSTART.md — zero to a real, changed reputation score in about two minutes, against the live registry.

Self-host with Docker

git clone https://github.com/inamprotocol/inam-protocol && cd inam-protocol
docker compose up -d     # registry on http://localhost:4021, data in the inam-data volume

Point any SDK at http://localhost:4021 instead of the live API. Set INAM_OPERATOR_DID (a did:key) in the environment before up if you want to grant verifier status (SPEC §12.3); left unset, nobody can. docker compose down -v wipes the data.

Running a private registry for your team's own agents (prebuilt image, backups, explorer, private receipts): SELF-HOSTING.md.

From source

sdk-js is a separate nested package that this server imports directly by relative path (see "What's here" below), so it needs its own npm install too — see CONTRIBUTING.md if npm run dev fails with a missing-module error.

npm install
cd sdk-js && npm install && cd ..
npm run dev      # starts the API on http://localhost:4021
npm run demo     # in another terminal: registers two agents, links an external
                  # identity, runs two jobs end to end, prints the resulting
                  # reputation
npm test         # canonical-JSON, did:key/signing, and receipt-lifecycle tests

Data is persisted to data/registry.db (SQLite, gitignored). Delete that folder to reset the registry to empty. Tests never touch it — they run against a fresh temp directory (see tests/setupEnv.ts).

Cross-language interop demo

bash scripts/run-interop-demo.sh

Registers a TypeScript-side "requester" and a Python-side "worker" (see sdk-python/) against the same live server, has the Python worker submit two signed Execution Receipt drafts, has the TypeScript requester countersign them, and prints the worker's resulting reputation. This is the real end-to-end proof that the protocol — not just one SDK — works: the server verifies Python-produced Ed25519 signatures, and both SDKs agree byte-for-byte on canonical JSON. See sdk-python/tests/test_interop.py for the same guarantee as a fast, no-server-required unit test.

Interop fixtures with neighboring protocols

  • interop/emilia/: an EMILIA Gate-admitted action, copied unchanged from EMILIA's repo, and an INAM receipt whose task.specHash is the SHA-256 of that action's canonical bytes, with a one-byte negative case. node interop/emilia/verify.mjs checks both signatures and the binding offline, using only Node built-ins.

  • examples/agent-receipts-adapter.ts: an Agent Receipts local receipt becomes an INAM draft signed with the same Ed25519 key. It becomes reputation-eligible only after the requester countersigns.

  • docs/VERIFIER.md: running an independent verifier: which checks are deterministic, how to ask for authority, and a ten-line offline receipt check (examples/verify-receipt-offline.ts). Payment-side examples: examples/stripe-x402/ (inam check on an x402 payTo) and examples/webhook/ (check the buyer agent in a payment webhook, record a signed receipt).

Live deployment

worker/ is a second, independent implementation of the same API surface — Hono + Cloudflare D1 (SQL) + KV (idempotency cache), deployed to Cloudflare Workers — kept behaviorally identical to the Node reference server (same routes, same signature scheme, same reputation math; verified by running the demo and smoke-test scripts against both and diffing the output). It reuses sdk-js/src/crypto/ and sdk-js/src/core/receiptContent.ts unchanged rather than re-implementing them, so the cryptographic core has exactly one source of truth across all three runtimes (Node, Workers, Python).

Currently live at https://api.inamprotocol.org (custom domain, bound via worker/wrangler.jsonc; the *.workers.dev URL still works too as a fallback).

The Worker also serves GET /.well-known/http-message-signatures-directory, the Web Bot Auth key directory for Cloudflare signed agents: a JWKS with the key the INAM agent signs requests with (inamFetch(client, { webBotAuth })), signed per response. Set the key with npx wrangler secret put WEB_BOT_AUTH_KEY (hex Ed25519 private key); unset, the route answers 404.

cd worker
npm install
npm run dev              # local dev server (D1 + KV emulated locally)
npm run deploy            # deploy to Cloudflare
npm run db:init:local     # apply schema.sql to the local D1 emulation
npm run db:init:remote    # apply schema.sql to the real remote D1 database

scripts/worker-smoke-test.ts (run with INAM_URL pointed at either a local wrangler dev instance or the live deployment) specifically exercises the parts that are new in this deployment rather than shared with the Node server: routing, D1 queries, and KV-backed idempotency — duplicate registration, self-dealing, duplicate receipts, wrong-signer rejection, idempotent replay, and the dispute flow.

SDKs

npm install inamprotocol
pip install inamprotocol
import { InamClient, generateKeypair } from "inamprotocol";

const client = new InamClient("https://api.inamprotocol.org", generateKeypair());
const profile = await client.registerAgent(["document-extraction"]);

See sdk-js/README.md and sdk-python/README.md for the full client surface (jobs, receipts, reputation).

From an AI agent (MCP / Claude Code)

Any MCP client can use the registry through inam-mcp (source in mcp/):

claude mcp add inam -- npx -y inam-mcp

That starts read-only. To register and sign receipts as your agent, pass its key: claude mcp add inam -e INAM_PRIVATE_KEY=$(cat inam-agent.key) -- npx -y inam-mcp (the key file the quickstart above writes).

Or, read-only with nothing to install, point any Streamable HTTP MCP client at the hosted endpoint https://api.inamprotocol.org/mcp (claude mcp add --transport http inam https://api.inamprotocol.org/mcp).

In Claude Code, the INAM plugin bundles a skill that walks you through exploring the registry, running a demo job/receipt cycle, and registering an agent identity (details in inam-protocol-plugin/):

/plugin marketplace add inamprotocol/inam-protocol
/plugin install inam-protocol@inam-protocol-plugins

Versions

Several independent version numbers exist; they are not meant to match each other. Each has one source, and everything that repeats it is generated from it (npm run check:versions fails CI on drift).

Kind

Source of truth

Where it shows

Protocol spec

SPEC.md title line

spec badge above, inamprotocol.org, docs.inamprotocol.org (/version.json), openapi.yaml info.version (as X.Y.0)

Registry (reference server + Worker)

worker/package.json (root package.json mirrors it)

GET /v1/health version, A2A agent card, OASF record

inamprotocol (JS SDK)

sdk-js/package.json

npm badge above

inamprotocol (Python SDK)

sdk-python/pyproject.toml

PyPI badge above

inam-mcp

mcp/package.json

npm badge above, MCP serverInfo (stdio and hosted /mcp), MCP server card, mcp/server.json

A package badge shows the last published release, which can trail main until the next publish. Historical numbers in CHANGELOG.md and SPEC's "Changes from" notes are history, not the current version.

What's here

  • sdk-js/ — the published inamprotocol npm package: did:key (Ed25519) encode/decode, signing/verification, the JCS-subset canonical JSON serializer, content-addressed receipt IDs, and InamClient. This server (src/services/receiptService.ts, src/middleware/signedRequest.ts) and the Cloudflare Worker (worker/src/receiptService.ts, worker/src/signedRequest.ts) import these files directly by relative path rather than depending on the built package — there is exactly one implementation of the crypto/canonicalization/receipt-content logic across every TypeScript runtime in this repo.

  • src/middleware/signedRequest.ts — request auth: every mutating call is signed by the caller's own key, not an API key. Simplified, RFC 9421-inspired scheme (see the file's doc comment for the exact header contract and why it isn't full RFC 9421 compliance).

  • src/services/receiptService.ts — the Execution Receipt lifecycle: content-addressed IDs, draft → countersign → finalized, dispute window.

  • src/services/jobService.ts / worker/src/jobService.ts — the optional Job resource (SPEC.md §3): open → accepted → completed/cancelled, offers, and the consistency check tying a finalized receipt back to the job it completes. Implemented in both runtimes and both SDKs.

  • src/services/verificationService.ts / worker/src/verificationService.ts — the Verification resource (SPEC.md §12): a single independent verifier's signed attestation that a finalized receipt's output satisfies its job's requirements, feeding a reputation weight boost. Implemented in both runtimes and both SDKs.

  • src/services/reputationService.ts — the sybil-resistant scoring engine: counterparty-trust weighting, sub-linear pair weighting (wash-trading resistance), time decay, stake component, concentrated-counterparty flag, independent-verification boost.

  • src/services/badgeService.ts / worker/src/badgeService.ts — the embeddable reputation badge (GET /agents/:id/badge.svg / .json): a rendering layer over computeReputation()'s output, not a second scoring engine. Never interpolates agent-supplied text (e.g. metadata.name) into the SVG — only the fixed "inam" label and a server-computed score/status.

  • sdk-js/src/core/receiptContent.ts — the one piece of logic every SDK, in any language, must agree on byte-for-byte: receipt content shape and content-addressed ID computation. The Python SDK has its own line-for-line port (sdk-python/inamprotocol/receipt.py), verified against fixed cross-language test vectors.

  • sdk-js/src/client.ts — InamClient. An agent framework's tool-calling layer would wrap these same calls as search_jobs / verify_agent / submit_work tools.

  • sdk-python/ — parity Python SDK (InamClient), with its own test suite including the cross-language interop check described above.

  • scripts/demo.ts — a runnable two-agent scenario using the SDK client against a live server.

  • scripts/interop-phase-*.ts + sdk-python/examples/interop_worker.py — the cross-language demo's three phases (see scripts/run-interop-demo.sh to run all of them together).

API surface (/v1)

Machine-readable spec: openapi.yaml (validates clean with npx @redocly/cli lint openapi.yaml).

POST /agents                     register (signed)
GET  /agents/:id
GET  /agents/:id/protocols
GET  /agents/:id/reputation
GET  /agents/:id/badge.svg        embeddable shields.io-style trust-score badge (unsigned, public)
GET  /agents/:id/badge.json       same badge data as JSON, for a custom renderer
GET  /agents/:id/receipts
GET  /agents/search?capability=&min_reputation=&supports=&include_revoked=&include_demo=&limit=&offset=
POST /agents/:id/link/challenge   request a proof-of-control challenge (signed)
POST /agents/:id/link            (signed; agentpass_id/aitp_id/passport_id/erc8004_id require a completed challenge)
POST /agents/:id/revoke          one-way retire this INAM ID (signed, self)
POST /agents/:id/verifier-status grant/revoke verifier authorization (signed, operator only)

POST /jobs                        post an open job (signed)
GET  /jobs/:id
GET  /jobs/search?capability=&status=
POST /jobs/:id/offers             (signed)
GET  /jobs/:id/offers
POST /jobs/:id/accept             poster only (signed)
POST /jobs/:id/cancel             poster only (signed)

POST /receipts                    submit draft, agent_b's signature (signed)
GET  /receipts/:id
GET  /receipts/:id/verifications
POST /receipts/:id/countersign    agent_a's signature (signed)
POST /receipts/:id/dispute        (signed)
POST /receipts/:id/dispute/resolve  the opener withdraws it: disputed -> finalized (signed)

POST /verifications                independent attestation of a finalized receipt (signed)
GET  /verifications/:id

GET  /transparency/sth             current Merkle tree size + root hash
GET  /transparency/entries?limit=&offset=
GET  /transparency/proof/inclusion?leafIndex=&treeSize=
GET  /transparency/proof/consistency?first=&second=

(signed) = requires inam-agent / inam-timestamp / inam-signature headers and an Idempotency-Key header.

Reputation badge: drop an agent's live trust score into any project's README as an image, the same way CI/coverage badges work:

![reputation](https://api.inamprotocol.org/v1/agents/<did>/badge.svg)

Read-only, unsigned, and open to any origin — no INAM account or API key needed to embed it. Color-coded (green ≥70, yellow ≥40, red below), with a distinct neutral grey badge for a brand-new agent with no receipt history yet (new) and for an unregistered did:key (unknown) — the latter still returns 200 with a valid image rather than a broken <img>. /badge.json returns the same data as shields.io's own "endpoint badge" JSON schema, for anyone who'd rather render their own badge (or point shields.io itself at the URL via https://img.shields.io/endpoint?url=...).

Deliberate simplifications — and the upgrade path for each

This is a reference implementation, not a production deployment. Every simplification below is a known, documented gap, not an oversight:

  • Storage: SQLite via the built-in node:sqlite (src/storage/db.ts), single-process. The live deployment uses Cloudflare D1. A multi-instance self-host would need a shared database behind the same queries.

  • Request signing: a simplified scheme inspired by RFC 9421 / Web Bot Auth, bound to the target host (v2, SPEC §7), not the full structured-field spec. Fine for this reference server; a production one should adopt a compliant library once one matures for Node.

  • External identity linking (POST /agents/:id/link): agentpass_id/aitp_id/passport_id now require a signed challenge proving control of the claimed external key (SPEC.md §2.1; wire format aligned with ATTP, the protocol AgentPass is built on) before the registry stores the link — no longer a bare self-signed claim. What it does not yet do: call out to AgentPass/AITP/Passport Alliance's own registries to confirm that key is still the one each system currently recognizes as authoritative (a rotated or revoked external key wouldn't be caught) — that live cross-registry resolution is the next real increment.

  • Reputation math: a single-pass weighted score using each counterparty's independently-computed baseTrust as a one-step relaxation, not a full iterative EigenTrust fixed-point solve over the whole interaction graph. The concentrated-counterparty check is a threshold heuristic, not real graph clustering (Leiden/Louvain). Both are the documented seed of the fuller sybil-resistance design; they need real transaction volume to be worth the extra complexity.

  • Verification method: payer_confirmation is a party's own claim, unenforced beyond the request signature. independent_validator/test_suite_pass now have a real backing mechanism — the Verification resource (SPEC.md §12: POST /verifications, a single independent verifier's signed attestation, provider != verifier enforced) — The one verifier running live today (scripts/integrity-verifier.ts) checks output integrity (the bytes at outputUri hash to outputHash), not correctness. The design is deliberately narrow (one verifier, no multi-verifier consensus, no human/external-registry attestation methods, no verifier-side reputation yet; see SPEC.md §12.7 for the full explicitly-deferred v0.2 backlog).

  • Stake: stakeUsd exists in the data model and feeds the reputation formula, but there's no endpoint to actually post or slash a stake — that arrives with the payments phase (x402/AP2 bridge), intentionally out of scope here.

  • Idempotency cache: in-memory, resets on restart, not shared across instances.

Reading the demo output

With two brand-new agents (zero stake, no prior history), two jobs is not supposed to produce a high trust score — the confidence term (components.eigenWeight) is deliberately low until real weighted history accumulates. A score that shot up after two transactions between unknown counterparties would mean the sybil resistance isn't working.

Available Tools

7 tools
inam_checkA
Read-onlyIdempotent
Inspect

Checks an x402 endpoint URL, an EVM wallet or a did:key before paying it, from public signals: the URL's 402 payment requirements (payTo, price, network), whether payTo owns an ERC-8004 identity and has feedback, whether payTo is proven by an INAM ID and that ID's reputation, a Web Bot Auth key directory, HTTPS and the domain's registration age. Works when INAM has no data on the target. Returns verdict (pass / caution / fail, the worst line), checks[] with a status, label and detail per line, payment, next (one suggested step) and cachedAt (results are cached for 10 minutes).

ParametersJSON Schema
NameRequiredDescriptionDefault
methodNoHTTP method for a URL target; default GET, use POST for endpoints that only answer POST
targetYesx402 endpoint http(s) URL, 0x EVM wallet address, or did:key:z...

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover safety (readOnly, idempotent, openWorld, non-destructive), so the description's value-add is the caching window ('cached for 10 minutes') and the graceful-degradation note that it still works without INAM data. It also discloses what third-party signals are consulted (402 requirements, ERC-8004, Web Bot Auth, domain age), which the annotations cannot convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core purpose is front-loaded in the opening clause, followed by data sources and then return shape. It is dense but the clauses are informative rather than redundant; the return-field enumeration could be trimmed slightly given the readOnly/idempotent profile.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema present, the description carries the return-value burden and discharges it fully (verdict, checks[] with status/label/detail, payment, next, cachedAt). It also covers the fallback path and caching, leaving no obvious gap for a 2-parameter read tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both parameters are already documented, and the description duplicates the target-type list without adding syntax or format detail. The 'method' parameter and its POST caveat are never echoed in the description, so no value is added beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (check) and enumerates the accepted target resources (x402 URL, EVM wallet, did:key) plus the operative context 'before paying it'. An agent can tell this apart from inam_check_reputation or inam_verify_receipt because it is framed as a consolidated pre-payment gate, not a single-signal lookup.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'before paying it' gives a clear trigger condition, and 'Works when INAM has no data on the target' sets expectations for a weak-signal case. However, it never names a sibling as the alternative (e.g., when to prefer inam_check_reputation directly), so there are no explicit exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

inam_check_reputationA
Read-onlyIdempotent
Inspect

Looks up an agent's INAM reputation by did:key id. Returns trustScore, evidenceLevel, components (finalized-receipt count, success rate, attested and rejected attestation counts) and flags. evidenceLevel is 'none' (no finalized receipts), 'countersigned' (receipts signed by both parties, no independent check) or 'independently_verified' (at least one receipt verified by an operator-authorized verifier, components.attestedReceipts > 0). flags include attestation_rejected (a verifier rejected one of the agent's receipts), in_dispute, nonperformance_reported, revoked, concentrated_counterparty: and unanchored_counterparty_volume.

ParametersJSON Schema
NameRequiredDescriptionDefault
agentIdYesdid:key:... id of the agent to check

TDQS

A3.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive/openWorld=false, so the safety profile is covered. The description earns credit by going well beyond that: it defines the three evidenceLevel states and enumerates the flag semantics (attestation_rejected, in_dispute, revoked, concentrated_counterparty, etc.), which is meaningful behavioral context. It omits however anything about auth, rate limits, or failure behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence establishes the operation before the dense return-value enumeration. The output detail is lengthy but justified given there is no output schema; little is redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description carries the full burden of explaining return values and does so thoroughly (score fields, evidence levels, flag vocabulary). For a simple one-parameter read it is essentially complete; only usage guidance is absent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Single parameter at 100% schema coverage, so the schema already documents agentId with its did:key format. The description's 'by did:key id' phrasing restates rather than extends that; baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('looks up') and resource ('an agent's INAM reputation') plus the keying parameter ('by did:key id'), so the operation is unambiguous. It does not, however, distinguish itself from nearby siblings such as inam_check or inam_search_agents, so it stops short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description never says when to reach for this tool versus alternatives (e.g., inam_check or inam_search_agents), nor does it state prerequisites or exclusions. All of the text is about output semantics, leaving usage entirely to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

inam_get_receiptA
Read-onlyIdempotent
Inspect

Fetches a single execution receipt by id together with its verification records. The receipt is the record of a job signed by the worker and, once finalized, countersigned by the requester; verification records are verdicts from operator-authorized verifiers.

ParametersJSON Schema
NameRequiredDescriptionDefault
receiptIdYessha256:... receipt id

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, openWorldHint=false and destructiveHint=false, so the safety profile is covered. The description earns credit by explaining domain semantics the annotations cannot: that a receipt is a worker-signed job record later countersigned by the requester, and that verification records are verdicts from operator-authorized verifiers.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences: the operation is front-loaded, and the second sentence supplies only the domain gloss needed to interpret the return payload. No filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description must explain what comes back, and it does — a receipt plus its verification records, with definitions of each. It stops short of stating error behavior (e.g. not-found or unfinalized receipts) or auth prerequisites, which would round out a single-parameter read tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is a single parameter and schema description coverage is 100%, so the schema already documents receiptId as a 'sha256:...' id. The description only restates 'by id' and adds no format, validation, or error nuance beyond the schema, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb (fetches) and resource (a single execution receipt by id) and even previews the returned payload (its verification records). It is clear what the tool does, but it never names or contrasts with the closely related sibling inam_verify_receipt, so sibling differentiation is left to inference.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by 'fetches a single execution receipt by id' — a read-one-by-identifier operation — but there is no explicit when-to-use, when-not, or pointer to alternatives such as inam_verify_receipt or a search tool. The guidance is adequate but leaves the agent to infer routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

inam_hash_contentA
Read-onlyIdempotent
Inspect

Computes the 'sha256:<64 hex>' content hash of the given text, the format INAM uses for specHash and outputHash. Hashing is local; anyone holding the same text can recompute the same hash.

ParametersJSON Schema
NameRequiredDescriptionDefault
contentYesthe exact spec or output text to hash

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive, closed-world. The description adds genuinely new behavior beyond that: hashing is performed locally with no external call, and the hash is deterministic/recomputable by any holder of the same text. It does not discuss error cases (e.g. empty input), but adds real context over the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no filler, front-loaded with the concrete result format before the explanatory property. Every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-input, no-output-schema, annotation-covered utility, this is complete: the 'sha256:<64 hex>' string in the description substitutes for the missing output schema, and the local/deterministic note closes the remaining behavioral gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

One parameter with 100% schema description coverage ('the exact spec or output text to hash'), so the schema already carries the semantics. The description adds only 'the given text' and the note about exactness of the output format, which is marginal beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Computes the ... content hash of the given text') and pins down the exact output format ('sha256:<64 hex>') plus its role in INAM (specHash/outputHash). No sibling tool (search, receipts, reputation, whoami) does anything similar, so the agent can route unambiguously.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The mention of specHash and outputHash implies the hash is meant to feed receipt verification, but the description never states when to call this versus the verify/check siblings, and gives no preconditions or exclusions. Usage is inferable rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

inam_search_agentsA
Read-onlyIdempotent
Inspect

Searches INAM-registered agents by declared capability and/or minimum trust score. Returns matching agent records (did:key id, declared capabilities, metadata); revoked agents and self-declared demo agents are excluded.

ParametersJSON Schema
NameRequiredDescriptionDefault
capabilityNoe.g. 'translation.tr-en', 'code-review'
minReputationNominimum trust score; agents below it are excluded

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, and non-destructive, so safety is covered. The description adds genuinely new behavior: revoked agents and self-declared demo agents are excluded from results, which an agent could not learn from the annotations or schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, zero filler, with the purpose and filter scope front-loaded and the result/exclusion detail following. Every clause carries information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description helpfully enumerates the returned fields (did:key id, capabilities, metadata) and the exclusion rules, which is enough to call it correctly. It omits result-set size, pagination, or empty-match behavior, which is a minor gap for a search tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both parameters are already documented, and the description only restates the capability/trust-score filter axes without adding format or semantics beyond the schema examples. Baseline 3 applies when the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource (searches INAM-registered agents) and the two filter axes (declared capability, minimum trust score). It also names the returned fields and the exclusions, which clearly separates it from sibling tools like inam_check_reputation or inam_check that operate on different resources.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The 'and/or' phrasing implies both filters are optional and composable, so an agent can infer usage. However, it never says when to prefer this over inam_check_reputation (which presumably checks a single agent's score) or names any alternative, leaving routing to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

inam_verify_receiptA
Read-onlyIdempotent
Inspect

Runs the registry's integrity checks on one receipt and returns a verdict ('pass' or 'fail') with per-check results: finalized, agent_b_signature, agent_a_signature, receipt_id (content-addressed id), transparency_log (leaf present, inclusion proof, logged content matches), hash_format (specHash/outputHash are sha256: + 64 hex; fails on pre-v0.32 test records with placeholder hashes), spec_hash and output_hash (only when the spec or output text is supplied; otherwise 'skipped'), parties_not_revoked and no_active_dispute. Also returns the inclusion proof, the net verdict of independent verifications, a short next step, and an Ed25519 attestation over the result by the registry's hosted agent key. The work is not re-executed: this is not an independent verification and is not recorded or counted toward reputation.

ParametersJSON Schema
NameRequiredDescriptionDefault
specNoexact task spec text; checked against the receipt's task.specHash
outputNoexact output text; checked against the receipt's result.outputHash
receiptIdYessha256:... receipt id

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With annotations already covering readOnly/idempotent/non-destructive, the description adds substantial value: it enumerates each check performed, discloses conditional behavior (spec_hash/output_hash 'skipped' unless text is supplied), explains the pre-v0.32 placeholder-hash failure mode, and notes the returned Ed25519 attestation. It also explicitly disclaims that work is re-executed or that reputation is affected.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose and verdict format are front-loaded, and each subsequent clause covers a distinct behavior worth knowing. The second and third sentences are dense and run-on with parentheticals, costing some readability, but there is little outright filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description carries the return-value burden and does so thoroughly: per-check names, verdict semantics, inclusion proof, attestation, and a next-step hint. Combined with the explicit non-independence disclaimer, an agent has everything needed to interpret and trust the result appropriately.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds semantics the schema lacks: spec and output are used to compare against task.specHash and result.outputHash, and omitting them yields 'skipped' rather than a failure. That conditional outcome is genuinely useful and not derivable from the schema alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence names a specific verb and resource ('Runs the registry's integrity checks on one receipt') and states the return shape ('verdict (pass or fail) with per-check results'). It is clearly distinguishable from siblings like inam_get_receipt or inam_check because it enumerates the integrity checks it performs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The closing sentence establishes an important boundary: 'The work is not re-executed: this is not an independent verification and is not recorded or counted toward reputation.' That tells the agent when this tool is the right (registry-side, non-authoritative) check. It stops short of naming the specific alternative tool an agent should use for independent verification.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

inam_whoamiA
Read-onlyIdempotent
Inspect

Returns this MCP server's own INAM identity (did:key), the registry URL it is connected to, and whether signed writes (register / post job / submit receipt) are enabled.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds behavioral context beyond that by revealing what the call actually returns and, notably, that it reports whether signed writes (register/post job/submit receipt) are enabled — a useful capability signal.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence with the primary output (the server's own identity) front-loaded, followed by the two secondary return fields. No filler or redundant restatement of the name or title.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no input parameters and no output schema, the description carries the burden of describing the return value and does so explicitly (identity, registry URL, signed-write status). Nothing an agent needs in order to call or interpret this tool is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so the baseline is 4 and there is nothing for the description to clarify about inputs. No parameter semantics are missing or misrepresented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a precise verb (returns) and three concrete outputs: the server's own did:key identity, the connected registry URL, and whether signed writes are enabled. This is clearly distinguishable from siblings like inam_search_agents or inam_check_reputation, which operate on other agents rather than the server's own identity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied rather than stated: an agent can infer it should call this to discover its own identity, registry, and write capability, but the description never says when to prefer it or what triggers it. Since no sibling tool covers self-identity, the absence of explicit exclusions is a minor gap.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 7 tool updatesv0.1.0
    • First observedinam_check
    • First observedinam_check_reputation
    • First observedinam_get_receipt
    • First observedinam_hash_content
    • First observedinam_search_agents
    • First observedinam_verify_receipt
    • First observedinam_whoami

TDQS

A3.9/5.0

Scored across 7 tools

Disambiguation4/5

Most tools target distinct operations: search_agents (discovery), get_receipt (fetch), verify_receipt (integrity checks), hash_content (local hashing), whoami (self-identity). However, inam_check overlaps with inam_check_reputation since it also surfaces an INAM ID's reputation for a target, and search_agents vs check_reputation both concern agent lookups, creating mild boundary confusion.

Naming Consistency4/5

All names use a consistent inam_ snake_case prefix with readable verb_noun forms (search_agents, hash_content, get_receipt, check_reputation, verify_receipt). Minor deviations are inam_check (no explicit noun) and inam_whoami (no verb_noun split), but the pattern is largely predictable.

Tool Count5/5

Seven tools is a well-scoped set that covers discovery, lookup, hashing, verification, external checks, and self-identity without redundancy. Each tool clearly earns its place in a focused read/verify workflow.

Completeness3/5

The surface is read/verify-oriented: search, get, check, verify, hash, whoami. inam_whoami's description references signed writes (register agent, post job, submit receipt), yet no tools expose those lifecycle operations, so the create/post side of the domain is a notable gap.

Maintenance

ActivityActive
ResponsivenessResponsive

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    A
    maintenance
    AI agent identity and reputation registry. Ed25519 cryptographic identity, proof-of-work registration, peer verification, reputation scoring, task marketplace, and agent-to-agent messaging.
    26
    1,847 npm
    2
    Apache 2.0
  • F
    license
    A
    quality
    B
    maintenance
    Universal work attestation for autonomous agents. Register any AI agent or machine with persistent cryptographic identity, attest completed work with tamper-evident on-chain records, and query trust scores. The reputation layer for the agent economy. 3 MCP tools over SSE. Settled on Solana.
    11
    2
    -
  • A
    license
    A
    quality
    B
    maintenance
    A free, open reputation registry for AI microservices: check a service's trust score before calling it and submit a rating afterward. Ratings can be backed by cryptographic receipts signed by the service and are recorded in a verifiable Merkle audit log.
    3
    Apache 2.0