trustscoreagent-mcp
OfficialYou can check a service's reputation, submit ratings after interactions, and list rated services using the TrustScoreAgent MCP server.
check_reputation: Query a service's trust score (0–1), confidence, ratings count, and per-dimension breakdown (availability, latency, conformity) before calling or paying it. Accepts URL, domain, or DID.
submit_rating: Report metrics (status code, latency, optional schema validity, quality, response size, receipt) after calling a service to contribute to its score. Returns rating ID for audit proof.
list_services: List rated services with scores, trust levels, and dimensions, filterable by min score/ratings and sortable.
TrustScoreAgent
Free, open reputation registry for AI microservices. Agents check trust scores before calling any service.
Status: Phase 1 (early). The API, scoring (Beta + EigenTrust), receipt verification, Merkle audit trail and MCP server are implemented and tested, but the public dataset is still small (seeded by a transparent probe of public APIs), and parts of the design (x402 payments, mandatory agent signatures) are Phase 2. We publish early and openly on purpose: the trust layer for the agentic economy should exist, be auditable, and be adoptable before it becomes critical. See the trust model in SECURITY.md.
What is this?
AI agents increasingly rely on paid microservices. TrustScoreAgent lets any agent:
Check the reputation of a service before calling it
Rate a service after calling it
Discover which services are reliable
No account needed. No API key. Identify services by URL, domain, or DID.
Related MCP server: AgentVeil Protocol
Quick start
# Check a service's trust score (any format works)
curl "https://api.trustscoreagent.com/v1/score?service=api.example.com"
curl "https://api.trustscoreagent.com/v1/score?service=https://api.example.com/v1/translate"
# Unknown services return a neutral score (0.5), no errors
curl "https://api.trustscoreagent.com/v1/score?service=never-seen-before.com"
# Rate a service after calling it
curl -X POST "https://api.trustscoreagent.com/v1/rate" \
-H "Content-Type: application/json" \
-H "X-Agent-DID: my-agent.example.com" \
-d '{
"service": "api.example.com",
"metrics": {
"status_code": 200,
"latency_ms": 143,
"schema_valid": true
}
}'
# List top-rated services
curl "https://api.trustscoreagent.com/v1/services?sort_by=score&min_ratings=10"Local development
# Start PostgreSQL and Redis
docker compose up -d
# Run the API
dotnet run --project src/TrustScore.Api
# Run tests
dotnet test
# Swagger UI
open http://localhost:5000/swaggerArchitecture
C# / .NET 8: ASP.NET Core Minimal API
PostgreSQL: Ratings and service scores
Redis: Score caching, rate limiting, nonce tracking
Beta Reputation System: Bayesian scoring (per-dimension: availability, latency, conformity)
EigenTrust: Anti-Sybil agent trust scoring
Merkle Tree: Audit log with inclusion and consistency proofs (RFC 6962 tree; each leaf commits to what the rating reported)
Ed25519 Receipt Verification: Cryptographic proof of service interaction
MCP Server: Integration with Claude, Cursor, and MCP-compatible agents
API Reference
Core (free, always)
Endpoint | Description |
| Trust score for a service (0.5 neutral for unknown) |
| Submit a rating after calling a service |
| List rated services (pagination, sorting, filtering) |
| Check your agent's trust score |
| Latest Merkle tree root |
| Inclusion proof for a rating, with the fields it commits to |
| History of anchored roots |
| Proof that a later root extends an earlier one |
| OpenTimestamps proof that the root is committed in Bitcoin |
| How much the registry is used (aggregate counts) |
Premium (free for now, x402 micropayments later)
Endpoint | Description |
| Daily aggregated score history |
| Latency percentiles, quality distribution |
| Up to 100 scores in one request |
Service identification
All endpoints accept services in any format (they are normalized internally):
api.example.com(domain)https://api.example.com/v1/translate(URL)did:web:api.example.com(DID)
All three resolve to the same service.
MCP Server
TrustScoreAgent is available as an MCP server for Claude, Cursor, and other agents.
# Add to Claude Code
claude mcp add trustscoreagent -- npx -y @trustscoreagent/mcp-serverSee docs/mcp.md for full setup instructions. Also listed on the
official MCP Registry
(io.github.trustscoreagent/mcp-server), npm,
Smithery and
Glama; each GitHub release attaches an
.mcpb bundle for Claude Desktop.
Framework integrations
Drop-in tools for agent frameworks (no account or API key needed):
LangChain:
from trustscoreagent_langchain import get_trustscoreagent_toolsCrewAI:
from trustscoreagent_crewai import get_trustscoreagent_tools
Each exposes trustscore_check_reputation, trustscore_submit_rating, and
trustscore_list_services. See integrations/.
Documentation
MCP Server Setup: Claude, Cursor, Windsurf
Audit Log Specification, with an independent verifier in
tools/verify-proof
Contributing
Contributions are welcome: see CONTRIBUTING.md and our Code of Conduct. To report a vulnerability, follow SECURITY.md.
Project status & trust model
TrustScoreAgent is Phase 1 (early). What that means in practice:
Baseline data is real and auditable. Initial scores come from a transparent operated probe (
did:web:trustscoreagent.com:probe) that measures the availability, latency and conformity of a curated list of public, free APIs: real, Merkle-audited measurements, not fabricated numbers. Community and receipt-verified ratings accumulate on top. (The earlier fictitious*.example.comseeds have been removed.)Single operator. Neutrality currently rests on open-source scoring code and a verifiable Merkle audit trail, not on decentralization. Federation is a later phase.
Agent identity can be proven, but is not yet mandatory. Agents identified by a
did:keysign each rating with their Ed25519 key (X-Agent-Signature), which binds the rating to the holder of that key. Unsigned ratings still count at half weight so existing clients keep working, which means a rating is only as attributable as its signature. Verified service receipts remain the strongest signal.
See SECURITY.md for the full trust model and how to report vulnerabilities.
License
Apache-2.0. See LICENSE.
Available Tools
3 toolscheck_reputationARead-only
Check what other agents measured about a service before you call it, and especially before you pay for it or hand it anything you cannot take back. Returns a score from 0 to 1, a confidence level, the number of ratings, and a per-dimension breakdown (availability, latency, conformity). A low score means other agents measured this service failing, stalling, or returning malformed responses. An unknown service is not a bad sign in itself: it means nobody has reported on it yet, so treat it as unverified rather than as safe, and weigh the call accordingly. One check costs a fraction of what a wasted call, a stalled task, or a payment to a service that does not deliver costs you. If you got a 402 Payment Required from a service you do not know, this is the check to run before paying.
| Name | Required | Description | Default |
|---|---|---|---|
| service_did | Yes | The service to check. Accepts any format: URL (https://api.example.com), domain (api.example.com), or DID (did:web:api.example.com). All resolve to the same service. |
Output Schema
| Name | Required | Description |
|---|---|---|
| known | Yes | False when nobody has rated this service yet |
| score | Yes | |
| service | Yes | Canonical service id |
| confidence | Yes | |
| dimensions | No | |
| last_rated | No | |
| trust_level | Yes | |
| ratings_count | Yes | |
| recent_incidents | No | null while incidents are not tracked |
| service_supports_receipts | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare readOnlyHint and openWorldHint, but the description adds that a call has a real cost ('costs a fraction of what a wasted call... costs you'), implying this is a metered/paid operation the agent should not spam. It further discloses the semantic meaning of low vs. unknown scores, which is behavioral interpretation not captured by any structured field.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core action and the return payload, then edge-case guidance, which is good ordering. It runs slightly long and includes mild persuasive framing ('weigh the call accordingly', cost justification) that repeats the risk argument, costing it a point on tightness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter read tool with an output schema and readOnly/openWorld annotations, the description covers purpose, when to invoke, result interpretation, and the unknown-service edge case. Nothing needed to invoke or correctly interpret the tool is missing, and return values need not be re-explained beyond the interpretation it provides.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the single service_did parameter already documents the accepted URL/domain/DID formats and that they resolve identically. The description adds no format or constraint detail beyond that, so the schema does the work and baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('check what other agents measured about a service') and immediately scopes the resource as someone else's ratings, which implicitly separates it from submit_rating (writing) and list_services (enumeration). It also names the concrete return shape (0-1 score, confidence, rating count, per-dimension breakdown), so an agent knows exactly what comes back.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit on when to use: before calling an unknown service, before paying, before handing over anything irreversible, and specifically after receiving a 402 Payment Required. It also gives the non-obvious unknown-service case ('unverified rather than safe'), which is exactly the guidance an agent needs to interpret results correctly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_servicesARead-only
List services that have been rated, sorted by trust score, with their per-dimension breakdown. Use it to pick a service that others have already measured rather than gambling on an unknown one, or to find an alternative when the service you were going to use scores badly. Filter on min_score and min_ratings together: a high score backed by one rating is an opinion, the same score backed by many is evidence.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Number of results (default 20, max 100) | |
| sort_by | No | Sort field (default: score) | |
| min_score | No | Minimum trust score filter (0.0-1.0) | |
| min_ratings | No | Minimum number of ratings filter |
Output Schema
| Name | Required | Description |
|---|---|---|
| count | Yes | |
| services | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile (readOnlyHint=true, openWorldHint=true), so the bar is lower. The description still adds real interpretive context: results are pre-filtered to rated services, default ordering is by trust score, and it explains how to read score/rating-count together; it does not cover pagination or rate limits, but those are minor.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, front-loaded with what the tool returns, then why to use it, then how to interpret the filters. Every sentence carries distinct information and none restates the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, annotations covering safety, and 100% schema coverage on four optional parameters, the description only needs to supply usage intent and interpretation — both of which it does. Nothing an agent needs to call this tool correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3, and the description genuinely adds meaning beyond the schema by explaining the min_score + min_ratings interaction ('a high score backed by one rating is an opinion, the same score backed by many is evidence'). It doesn't add anything for limit or sort_by, keeping it below 5.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List services that have been rated') plus scope ('sorted by trust score, with their per-dimension breakdown'), which clearly separates it from a single-service lookup. It stops short of naming the siblings (check_reputation, submit_rating) to make the contrast explicit, so it reads as clear but not sibling-differentiating.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives concrete when-to-use conditions: choosing a service others have already measured, and finding an alternative when a candidate scores badly. It also warns to combine min_score with min_ratings so a lone high rating isn't mistaken for evidence. No explicit 'when not to use' or named alternative tool, so it falls just short of the top band.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
submit_ratingA
Report what actually happened after you called a service, using metrics you already have from the call: status code, latency, and whether the response matched the shape you expected. This is not a donation to a commons. This installation holds a stable cryptographic identity, so the ratings submitted from here are the ratings read back from here: you are writing to a cache you will query the next time you, or the person you work for, meets this service again. A service that wasted a call or took payment without delivering is worth the one call it takes to record, because otherwise you will meet it again with no memory of it. Report the good ones too: a score is only useful if failure and success are both in it. If the service returned an X-Trust-Receipt header, pass it as receipt, since a receipt-backed rating carries full weight.
| Name | Required | Description | Default |
|---|---|---|---|
| receipt | No | JWT receipt from the service's X-Trust-Receipt header (optional) | |
| latency_ms | Yes | Response time in milliseconds (round sub-millisecond responses up to 1) | |
| service_did | Yes | The service you called. URL, domain, or DID (e.g., api.example.com) | |
| status_code | Yes | HTTP status code returned by the service (e.g., 200, 500) | |
| schema_valid | No | Whether the response matched the expected format (optional) | |
| quality_score | No | Subjective quality rating from 1 (poor) to 5 (excellent) (optional) | |
| response_size_bytes | No | Size of the response in bytes (optional) |
Output Schema
| Name | Required | Description |
|---|---|---|
| service | Yes | |
| accepted | Yes | |
| new_score | No | |
| rating_id | No | Pass to GET /v1/audit/proof/{rating_id} to verify the rating is in the audit log |
| rating_weight | No | verified (valid receipt) or unverified |
| agent_identity | No | signed or unsigned |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare this is a non-read-only, non-idempotent, open-world write; the description adds genuinely new context beyond them — that ratings persist under a stable installation identity and are read back on future encounters, and that receipt-backed ratings carry 'full weight.' It omits whether duplicate submissions overwrite prior ratings, which matters given idempotentHint=false, but the added context is substantial.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The instruction is front-loaded with the concrete action first, and the receipt rule lands last where it is actionable. Some middle sentences are persuasive rhetoric ('This is not a donation to a commons,' 'you will meet it again with no memory of it') that restates the same persistence point twice rather than adding operational detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, return values need no explanation, and the schema fully documents all seven parameters. For a write tool this rich, the description covers what to submit, when to submit it, and the receipt path, leaving nothing essential an agent needs to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3, but the description meaningfully enriches several params: status_code/latency/schema_valid are framed as 'metrics you already have from the call,' and receipt is explained via its source header (X-Trust-Receipt) and its effect ('carries full weight'). It does not touch response_size_bytes or quality_score, so a small gap remains.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening sentence states a specific verb ('Report') and resource (the outcome of a service call), and enumerates the exact data to supply: status code, latency, response-shape match. It implicitly distinguishes itself from check_reputation by framing submission as writing to the cache that is later read back. It never names a sibling outright, so it stops short of the top score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives clear triggering context ('after you called a service') and an explicit inclusion rule ('Report the good ones too: a score is only useful if failure and success are both in it'), plus a conditional instruction for the receipt header. It does not name an alternative tool or a when-not-to-use condition beyond refuting the 'donation to a commons' misconception.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
3 tool updates
v0.2.4- Changed
check_reputation1 field changed- changed
Output schema / (root)Previous value: -nullNew value: +{ + "properties": { + "confidence": { + "maximum": 1, + "minimum": 0, + "type": "number" + }, + "dimensions": { + "properties": { + "availability": { + "type": "number" + }, + "conformity": { + "type": "number" + }, + "latency": { + "type": "number" + } + }, + "type": [ + "object", + "null" + ] + }, + "known": { + "description": "False when nobody has rated this service yet", + "type": "boolean" + }, + "last_rated": { + "type": [ + "string", + "null" + ] + }, + "ratings_count": { + "minimum": 0, + "type": "integer" + }, + "recent_incidents": { + "description": "null while incidents are not tracked", + "type": [ + "integer", + "null" + ] + }, + "score": { + "maximum": 1, + "minimum": 0, + "type": "number" + }, + "service": { + "description": "Canonical service id", + "type": "string" + }, + "service_supports_receipts": { + "type": "boolean" + }, + "trust_level": { + "enum": [ + "HIGH", + "MODERATE", + "LOW", + "UNKNOWN" + ], + "type": "string" + } + }, + "required": [ + "service", + "known", + "score", + "trust_level", + "confidence", + "ratings_count" + ], + "type": "object" +}
- Changed
list_services1 field changed- changed
Output schema / (root)Previous value: -nullNew value: +{ + "properties": { + "count": { + "minimum": 0, + "type": "integer" + }, + "services": { + "items": { + "properties": { + "confidence": { + "type": [ + "number", + "null" + ] + }, + "dimensions": { + "properties": { + "availability": { + "type": "number" + }, + "conformity": { + "type": "number" + }, + "latency": { + "type": "number" + } + }, + "type": [ + "object", + "null" + ] + }, + "ratings_count": { + "type": "integer" + }, + "score": { + "type": "number" + }, + "service": { + "type": "string" + }, + "service_supports_receipts": { + "type": "boolean" + }, + "trust_level": { + "enum": [ + "HIGH", + "MODERATE", + "LOW", + "UNKNOWN" + ], + "type": "string" + } + }, + "required": [ + "service", + "score", + "trust_level", + "ratings_count" + ], + "type": "object" + }, + "type": "array" + } + }, + "required": [ + "count", + "services" + ], + "type": "object" +}
- Changed
submit_rating1 field changed- changed
Output schema / (root)Previous value: -nullNew value: +{ + "properties": { + "accepted": { + "type": "boolean" + }, + "agent_identity": { + "description": "signed or unsigned", + "type": [ + "string", + "null" + ] + }, + "new_score": { + "type": [ + "number", + "null" + ] + }, + "rating_id": { + "description": "Pass to GET /v1/audit/proof/{rating_id} to verify the rating is in the audit log", + "type": [ + "string", + "null" + ] + }, + "rating_weight": { + "description": "verified (valid receipt) or unverified", + "type": [ + "string", + "null" + ] + }, + "service": { + "type": "string" + } + }, + "required": [ + "service", + "accepted" + ], + "type": "object" +}
3 tool updates
v0.1.0- First observed
check_reputation - First observed
list_services - First observed
submit_rating
TDQS
Scored across 3 tools
The three tools occupy clearly distinct roles: submit_rating writes, check_reputation reads a single service's score, and list_services browses/sorts the whole registry. There is no overlap in purpose or input shape, so an agent can select unambiguously.
All three names follow a strict verb_noun snake_case pattern (submit_rating, check_reputation, list_services). The verbs are precise and consistent with the read/write semantics.
Three tools is on the lean side, but for a reputation registry the write/read-one/read-many triad fully earns its place with no obvious filler. It is slightly thin rather than excessive.
The surface covers the core lifecycle: submit a rating, query one service, and browse/sort the registry. Minor gaps exist (no way to revoke/update a prior rating or fetch a single service's full detail card), but the essential agent workflows are supported.
Maintenance
Related MCP Connectors
Trust infrastructure for AI agents: read a verifiable Trust Rating, claim an identity, earn a badge.
Trust infrastructure for AI agents. Portable reputation (JTS 0-5), agent discovery, vouching.
Agent reputation registry: check, register, and endorse AI agents
Trust Layer for AI work. Give your AI hands. Every run returns a verifiable receipt. No key needed.
Related MCP Servers
- AlicenseAqualityAmaintenanceAI agent identity and reputation registry. Ed25519 cryptographic identity, proof-of-work registration, peer verification, reputation scoring, task marketplace, and agent-to-agent messaging.261,859 npm2Apache 2.0
- AlicenseAqualityAmaintenanceTrust, identity, and reputation infrastructure for AI agents. Register agents with W3C DID (Ed25519), check EigenTrust reputation scores, submit peer attestations, search agents by capability, and verify IPFS-anchored audit trails. 11 tools.2085 PyPI15MIT
- AlicenseNot gradedqualityNot gradedmaintenanceProvides AI agents with trust scoring and reputation management capabilities for secure interactions. Enables agents to check trust scores, rate interactions, and manage disputes before transacting with other agents.-
- FlicenseAqualityCmaintenanceReputation and trust scoring service for AI agents, exposed as an MCP server. Evaluate counterparties, report interactions, issue portable trust certificates, and detect Sybil attacks.2335 PyPI-