Skip to main content
Glama

TrustScoreAgent

Free, open reputation registry for AI microservices. Agents check trust scores before calling any service.

Status: Phase 1 (early). The API, scoring (Beta + EigenTrust), receipt verification, Merkle audit trail and MCP server are implemented and tested, but the public dataset is still small (seeded by a transparent probe of public APIs), and parts of the design (x402 payments, mandatory agent signatures) are Phase 2. We publish early and openly on purpose: the trust layer for the agentic economy should exist, be auditable, and be adoptable before it becomes critical. See the trust model in SECURITY.md.

What is this?

AI agents increasingly rely on paid microservices. TrustScoreAgent lets any agent:

  • Check the reputation of a service before calling it

  • Rate a service after calling it

  • Discover which services are reliable

No account needed. No API key. Identify services by URL, domain, or DID.

Related MCP server: AgentVeil Protocol

Quick start

# Check a service's trust score (any format works)
curl "https://api.trustscoreagent.com/v1/score?service=api.example.com"
curl "https://api.trustscoreagent.com/v1/score?service=https://api.example.com/v1/translate"

# Unknown services return a neutral score (0.5), no errors
curl "https://api.trustscoreagent.com/v1/score?service=never-seen-before.com"

# Rate a service after calling it
curl -X POST "https://api.trustscoreagent.com/v1/rate" \
  -H "Content-Type: application/json" \
  -H "X-Agent-DID: my-agent.example.com" \
  -d '{
    "service": "api.example.com",
    "metrics": {
      "status_code": 200,
      "latency_ms": 143,
      "schema_valid": true
    }
  }'

# List top-rated services
curl "https://api.trustscoreagent.com/v1/services?sort_by=score&min_ratings=10"

Local development

# Start PostgreSQL and Redis
docker compose up -d

# Run the API
dotnet run --project src/TrustScore.Api

# Run tests
dotnet test

# Swagger UI
open http://localhost:5000/swagger

Architecture

  • C# / .NET 8: ASP.NET Core Minimal API

  • PostgreSQL: Ratings and service scores

  • Redis: Score caching, rate limiting, nonce tracking

  • Beta Reputation System: Bayesian scoring (per-dimension: availability, latency, conformity)

  • EigenTrust: Anti-Sybil agent trust scoring

  • Merkle Tree: Audit log with inclusion and consistency proofs (RFC 6962 tree; each leaf commits to what the rating reported)

  • Ed25519 Receipt Verification: Cryptographic proof of service interaction

  • MCP Server: Integration with Claude, Cursor, and MCP-compatible agents

API Reference

Core (free, always)

Endpoint

Description

GET /v1/score?service=

Trust score for a service (0.5 neutral for unknown)

POST /v1/rate

Submit a rating after calling a service

GET /v1/services

List rated services (pagination, sorting, filtering)

GET /v1/agent/trust?did=

Check your agent's trust score

GET /v1/audit/root

Latest Merkle tree root

GET /v1/audit/proof/{id}

Inclusion proof for a rating, with the fields it commits to

GET /v1/audit/anchors

History of anchored roots

GET /v1/audit/consistency?from=&to=

Proof that a later root extends an earlier one

GET /v1/audit/anchors/{id}/ots

OpenTimestamps proof that the root is committed in Bitcoin

GET /v1/stats?days=

How much the registry is used (aggregate counts)

Premium (free for now, x402 micropayments later)

Endpoint

Description

GET /v1/score/history?service=

Daily aggregated score history

GET /v1/score/detailed?service=

Latency percentiles, quality distribution

POST /v1/scores/bulk

Up to 100 scores in one request

Service identification

All endpoints accept services in any format (they are normalized internally):

  • api.example.com (domain)

  • https://api.example.com/v1/translate (URL)

  • did:web:api.example.com (DID)

All three resolve to the same service.

MCP Server

TrustScoreAgent is available as an MCP server for Claude, Cursor, and other agents.

# Add to Claude Code
claude mcp add trustscoreagent -- npx -y @trustscoreagent/mcp-server

See docs/mcp.md for full setup instructions. Also listed on the official MCP Registry (io.github.trustscoreagent/mcp-server), npm, Smithery and Glama; each GitHub release attaches an .mcpb bundle for Claude Desktop.

Framework integrations

Drop-in tools for agent frameworks (no account or API key needed):

  • LangChain: from trustscoreagent_langchain import get_trustscoreagent_tools

  • CrewAI: from trustscoreagent_crewai import get_trustscoreagent_tools

Each exposes trustscore_check_reputation, trustscore_submit_rating, and trustscore_list_services. See integrations/.

Documentation

Contributing

Contributions are welcome: see CONTRIBUTING.md and our Code of Conduct. To report a vulnerability, follow SECURITY.md.

Project status & trust model

TrustScoreAgent is Phase 1 (early). What that means in practice:

  • Baseline data is real and auditable. Initial scores come from a transparent operated probe (did:web:trustscoreagent.com:probe) that measures the availability, latency and conformity of a curated list of public, free APIs: real, Merkle-audited measurements, not fabricated numbers. Community and receipt-verified ratings accumulate on top. (The earlier fictitious *.example.com seeds have been removed.)

  • Single operator. Neutrality currently rests on open-source scoring code and a verifiable Merkle audit trail, not on decentralization. Federation is a later phase.

  • Agent identity can be proven, but is not yet mandatory. Agents identified by a did:key sign each rating with their Ed25519 key (X-Agent-Signature), which binds the rating to the holder of that key. Unsigned ratings still count at half weight so existing clients keep working, which means a rating is only as attributable as its signature. Verified service receipts remain the strongest signal.

See SECURITY.md for the full trust model and how to report vulnerabilities.

License

Apache-2.0. See LICENSE.

Available Tools

3 tools
check_reputationA
Read-only

Check what other agents measured about a service before you call it, and especially before you pay for it or hand it anything you cannot take back. Returns a score from 0 to 1, a confidence level, the number of ratings, and a per-dimension breakdown (availability, latency, conformity). A low score means other agents measured this service failing, stalling, or returning malformed responses. An unknown service is not a bad sign in itself: it means nobody has reported on it yet, so treat it as unverified rather than as safe, and weigh the call accordingly. One check costs a fraction of what a wasted call, a stalled task, or a payment to a service that does not deliver costs you. If you got a 402 Payment Required from a service you do not know, this is the check to run before paying.

ParametersJSON Schema
NameRequiredDescriptionDefault
service_didYesThe service to check. Accepts any format: URL (https://api.example.com), domain (api.example.com), or DID (did:web:api.example.com). All resolve to the same service.

Output Schema

ParametersJSON Schema
NameRequiredDescription
knownYesFalse when nobody has rated this service yet
scoreYes
serviceYesCanonical service id
confidenceYes
dimensionsNo
last_ratedNo
trust_levelYes
ratings_countYes
recent_incidentsNonull while incidents are not tracked
service_supports_receiptsNo

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnlyHint and openWorldHint, but the description adds that a call has a real cost ('costs a fraction of what a wasted call... costs you'), implying this is a metered/paid operation the agent should not spam. It further discloses the semantic meaning of low vs. unknown scores, which is behavioral interpretation not captured by any structured field.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core action and the return payload, then edge-case guidance, which is good ordering. It runs slightly long and includes mild persuasive framing ('weigh the call accordingly', cost justification) that repeats the risk argument, costing it a point on tightness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter read tool with an output schema and readOnly/openWorld annotations, the description covers purpose, when to invoke, result interpretation, and the unknown-service edge case. Nothing needed to invoke or correctly interpret the tool is missing, and return values need not be re-explained beyond the interpretation it provides.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the single service_did parameter already documents the accepted URL/domain/DID formats and that they resolve identically. The description adds no format or constraint detail beyond that, so the schema does the work and baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('check what other agents measured about a service') and immediately scopes the resource as someone else's ratings, which implicitly separates it from submit_rating (writing) and list_services (enumeration). It also names the concrete return shape (0-1 score, confidence, rating count, per-dimension breakdown), so an agent knows exactly what comes back.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit on when to use: before calling an unknown service, before paying, before handing over anything irreversible, and specifically after receiving a 402 Payment Required. It also gives the non-obvious unknown-service case ('unverified rather than safe'), which is exactly the guidance an agent needs to interpret results correctly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_servicesA
Read-only

List services that have been rated, sorted by trust score, with their per-dimension breakdown. Use it to pick a service that others have already measured rather than gambling on an unknown one, or to find an alternative when the service you were going to use scores badly. Filter on min_score and min_ratings together: a high score backed by one rating is an opinion, the same score backed by many is evidence.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoNumber of results (default 20, max 100)
sort_byNoSort field (default: score)
min_scoreNoMinimum trust score filter (0.0-1.0)
min_ratingsNoMinimum number of ratings filter

Output Schema

ParametersJSON Schema
NameRequiredDescription
countYes
servicesYes

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnlyHint=true, openWorldHint=true), so the bar is lower. The description still adds real interpretive context: results are pre-filtered to rated services, default ordering is by trust score, and it explains how to read score/rating-count together; it does not cover pagination or rate limits, but those are minor.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, front-loaded with what the tool returns, then why to use it, then how to interpret the filters. Every sentence carries distinct information and none restates the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, annotations covering safety, and 100% schema coverage on four optional parameters, the description only needs to supply usage intent and interpretation — both of which it does. Nothing an agent needs to call this tool correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3, and the description genuinely adds meaning beyond the schema by explaining the min_score + min_ratings interaction ('a high score backed by one rating is an opinion, the same score backed by many is evidence'). It doesn't add anything for limit or sort_by, keeping it below 5.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('List services that have been rated') plus scope ('sorted by trust score, with their per-dimension breakdown'), which clearly separates it from a single-service lookup. It stops short of naming the siblings (check_reputation, submit_rating) to make the contrast explicit, so it reads as clear but not sibling-differentiating.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives concrete when-to-use conditions: choosing a service others have already measured, and finding an alternative when a candidate scores badly. It also warns to combine min_score with min_ratings so a lone high rating isn't mistaken for evidence. No explicit 'when not to use' or named alternative tool, so it falls just short of the top band.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

submit_ratingA

Report what actually happened after you called a service, using metrics you already have from the call: status code, latency, and whether the response matched the shape you expected. This is not a donation to a commons. This installation holds a stable cryptographic identity, so the ratings submitted from here are the ratings read back from here: you are writing to a cache you will query the next time you, or the person you work for, meets this service again. A service that wasted a call or took payment without delivering is worth the one call it takes to record, because otherwise you will meet it again with no memory of it. Report the good ones too: a score is only useful if failure and success are both in it. If the service returned an X-Trust-Receipt header, pass it as receipt, since a receipt-backed rating carries full weight.

ParametersJSON Schema
NameRequiredDescriptionDefault
receiptNoJWT receipt from the service's X-Trust-Receipt header (optional)
latency_msYesResponse time in milliseconds (round sub-millisecond responses up to 1)
service_didYesThe service you called. URL, domain, or DID (e.g., api.example.com)
status_codeYesHTTP status code returned by the service (e.g., 200, 500)
schema_validNoWhether the response matched the expected format (optional)
quality_scoreNoSubjective quality rating from 1 (poor) to 5 (excellent) (optional)
response_size_bytesNoSize of the response in bytes (optional)

Output Schema

ParametersJSON Schema
NameRequiredDescription
serviceYes
acceptedYes
new_scoreNo
rating_idNoPass to GET /v1/audit/proof/{rating_id} to verify the rating is in the audit log
rating_weightNoverified (valid receipt) or unverified
agent_identityNosigned or unsigned

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare this is a non-read-only, non-idempotent, open-world write; the description adds genuinely new context beyond them — that ratings persist under a stable installation identity and are read back on future encounters, and that receipt-backed ratings carry 'full weight.' It omits whether duplicate submissions overwrite prior ratings, which matters given idempotentHint=false, but the added context is substantial.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The instruction is front-loaded with the concrete action first, and the receipt rule lands last where it is actionable. Some middle sentences are persuasive rhetoric ('This is not a donation to a commons,' 'you will meet it again with no memory of it') that restates the same persistence point twice rather than adding operational detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, return values need no explanation, and the schema fully documents all seven parameters. For a write tool this rich, the description covers what to submit, when to submit it, and the receipt path, leaving nothing essential an agent needs to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3, but the description meaningfully enriches several params: status_code/latency/schema_valid are framed as 'metrics you already have from the call,' and receipt is explained via its source header (X-Trust-Receipt) and its effect ('carries full weight'). It does not touch response_size_bytes or quality_score, so a small gap remains.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence states a specific verb ('Report') and resource (the outcome of a service call), and enumerates the exact data to supply: status code, latency, response-shape match. It implicitly distinguishes itself from check_reputation by framing submission as writing to the cache that is later read back. It never names a sibling outright, so it stops short of the top score.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives clear triggering context ('after you called a service') and an explicit inclusion rule ('Report the good ones too: a score is only useful if failure and success are both in it'), plus a conditional instruction for the receipt header. It does not name an alternative tool or a when-not-to-use condition beyond refuting the 'donation to a commons' misconception.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 3 tool updatesv0.2.4
    • Changedcheck_reputation1 field changed
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "properties": {
        +    "confidence": {
        +      "maximum": 1,
        +      "minimum": 0,
        +      "type": "number"
        +    },
        +    "dimensions": {
        +      "properties": {
        +        "availability": {
        +          "type": "number"
        +        },
        +        "conformity": {
        +          "type": "number"
        +        },
        +        "latency": {
        +          "type": "number"
        +        }
        +      },
        +      "type": [
        +        "object",
        +        "null"
        +      ]
        +    },
        +    "known": {
        +      "description": "False when nobody has rated this service yet",
        +      "type": "boolean"
        +    },
        +    "last_rated": {
        +      "type": [
        +        "string",
        +        "null"
        +      ]
        +    },
        +    "ratings_count": {
        +      "minimum": 0,
        +      "type": "integer"
        +    },
        +    "recent_incidents": {
        +      "description": "null while incidents are not tracked",
        +      "type": [
        +        "integer",
        +        "null"
        +      ]
        +    },
        +    "score": {
        +      "maximum": 1,
        +      "minimum": 0,
        +      "type": "number"
        +    },
        +    "service": {
        +      "description": "Canonical service id",
        +      "type": "string"
        +    },
        +    "service_supports_receipts": {
        +      "type": "boolean"
        +    },
        +    "trust_level": {
        +      "enum": [
        +        "HIGH",
        +        "MODERATE",
        +        "LOW",
        +        "UNKNOWN"
        +      ],
        +      "type": "string"
        +    }
        +  },
        +  "required": [
        +    "service",
        +    "known",
        +    "score",
        +    "trust_level",
        +    "confidence",
        +    "ratings_count"
        +  ],
        +  "type": "object"
        +}
    • Changedlist_services1 field changed
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "properties": {
        +    "count": {
        +      "minimum": 0,
        +      "type": "integer"
        +    },
        +    "services": {
        +      "items": {
        +        "properties": {
        +          "confidence": {
        +            "type": [
        +              "number",
        +              "null"
        +            ]
        +          },
        +          "dimensions": {
        +            "properties": {
        +              "availability": {
        +                "type": "number"
        +              },
        +              "conformity": {
        +                "type": "number"
        +              },
        +              "latency": {
        +                "type": "number"
        +              }
        +            },
        +            "type": [
        +              "object",
        +              "null"
        +            ]
        +          },
        +          "ratings_count": {
        +            "type": "integer"
        +          },
        +          "score": {
        +            "type": "number"
        +          },
        +          "service": {
        +            "type": "string"
        +          },
        +          "service_supports_receipts": {
        +            "type": "boolean"
        +          },
        +          "trust_level": {
        +            "enum": [
        +              "HIGH",
        +              "MODERATE",
        +              "LOW",
        +              "UNKNOWN"
        +            ],
        +            "type": "string"
        +          }
        +        },
        +        "required": [
        +          "service",
        +          "score",
        +          "trust_level",
        +          "ratings_count"
        +        ],
        +        "type": "object"
        +      },
        +      "type": "array"
        +    }
        +  },
        +  "required": [
        +    "count",
        +    "services"
        +  ],
        +  "type": "object"
        +}
    • Changedsubmit_rating1 field changed
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "properties": {
        +    "accepted": {
        +      "type": "boolean"
        +    },
        +    "agent_identity": {
        +      "description": "signed or unsigned",
        +      "type": [
        +        "string",
        +        "null"
        +      ]
        +    },
        +    "new_score": {
        +      "type": [
        +        "number",
        +        "null"
        +      ]
        +    },
        +    "rating_id": {
        +      "description": "Pass to GET /v1/audit/proof/{rating_id} to verify the rating is in the audit log",
        +      "type": [
        +        "string",
        +        "null"
        +      ]
        +    },
        +    "rating_weight": {
        +      "description": "verified (valid receipt) or unverified",
        +      "type": [
        +        "string",
        +        "null"
        +      ]
        +    },
        +    "service": {
        +      "type": "string"
        +    }
        +  },
        +  "required": [
        +    "service",
        +    "accepted"
        +  ],
        +  "type": "object"
        +}
  2. 3 tool updatesv0.1.0
    • First observedcheck_reputation
    • First observedlist_services
    • First observedsubmit_rating

TDQS

A4.3/5.0

Scored across 3 tools

Disambiguation5/5

The three tools occupy clearly distinct roles: submit_rating writes, check_reputation reads a single service's score, and list_services browses/sorts the whole registry. There is no overlap in purpose or input shape, so an agent can select unambiguously.

Naming Consistency5/5

All three names follow a strict verb_noun snake_case pattern (submit_rating, check_reputation, list_services). The verbs are precise and consistent with the read/write semantics.

Tool Count4/5

Three tools is on the lean side, but for a reputation registry the write/read-one/read-many triad fully earns its place with no obvious filler. It is slightly thin rather than excessive.

Completeness4/5

The surface covers the core lifecycle: submit a rating, query one service, and browse/sort the registry. Minor gaps exist (no way to revoke/update a prior rating or fetch a single service's full detail card), but the essential agent workflows are supported.

Maintenance

ActivityActive
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    A
    maintenance
    AI agent identity and reputation registry. Ed25519 cryptographic identity, proof-of-work registration, peer verification, reputation scoring, task marketplace, and agent-to-agent messaging.
    26
    1,859 npm
    2
    Apache 2.0
  • A
    license
    Not graded
    quality
    Not graded
    maintenance
    Provides AI agents with trust scoring and reputation management capabilities for secure interactions. Enables agents to check trust scores, rate interactions, and manage disputes before transacting with other agents.
    -
  • F
    license
    A
    quality
    C
    maintenance
    Reputation and trust scoring service for AI agents, exposed as an MCP server. Evaluate counterparties, report interactions, issue portable trust certificates, and detect Sybil attacks.
    23
    35 PyPI
    -