attester-mcp
Allows CrewAI agents to call oracle tools for package and symbol verification, version diffing, and paid services like work verification, code research, and judging, with signed attestations.
Provides LangChain agents with tools to verify package and symbol existence, retrieve signatures, compare versions, and access premium oracle services such as research verification and judging, all returning signed attestations.
Offers a tool to check if an npm package name exists, with typosquat-adjacency flags, enabling agents to avoid incorrect package imports.
Offers a tool to check if a PyPI package name exists, with typosquat-adjacency flags, enabling agents to avoid incorrect package imports.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@attester-mcpdoes the package 'requests' exist on PyPI?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
attester-mcp
MCP server for attester.dev: verification and API-existence oracle tools for AI agents, callable from any MCP client (Claude Code, Cursor, Windsurf, LangChain, CrewAI).
Every result ships with a wallet-signed attestation you can verify without
trusting us: POST https://attester.dev/receipts/verify is free.
Quickstart: free oracle tools, no keys
No install needed. Point your MCP client at the hosted endpoint:
{
"mcpServers": {
"attester": {
"url": "https://attester.dev/mcp/"
}
}
}Four oracle tools work immediately: no account, no API key, no wallet. You get 25 free calls per day per client IP, shared across the four tools, resetting 00:00 UTC. (This config block works for Claude Code, Claude Desktop, and Cursor; any MCP client that speaks streamable HTTP.)
Tool | What it does | Price per call |
| Does this PyPI/npm package name really exist? Typosquat-adjacency flags on misses. | Free (25/day keyless); $0.002 paid |
| Does this function, class, or constant exist in the package? Closest-match suggestions on misses. | Free (25/day keyless); $0.005 paid |
| Exact signature, structured params, docstring, deprecation status, resolved at a pinned version. | Free (25/day keyless); $0.01 paid |
| Symbol-level diff between two pinned versions: added, removed, changed, breaking/additive/neutral. | Free (25/day keyless); $0.02 paid |
Run it locally instead (stdio): install from source with
pip install git+https://github.com/maminihds/attester-mcp.git, then use
"command": "attester-mcp" in the config above. A zero-install
uvx attester-mcp command lands once the package is published to PyPI.
Steer your agent: CLAUDE.md / Cursor Rules snippet
- Before installing or importing a package, call attester_package_exists (and attester_symbol_exists for specific functions) to confirm the name exists. Never import a name the oracle says does not exist.Related MCP server: @lpm-registry/mcp-server
Paid tools
Tool | What it does | Price per call |
| Check another agent's work: citation support, code correctness, data/schema validation. Verdict plus signed attestation. | $0.15 USDC |
| Cited coding research; citations are re-checked and the proof attached. | $0.10 USDC |
| Grade an output against your rubric; signed score with per-criterion evidence. | $0.10 USDC |
| Signed 24h report on whether an x402 service honors its advertised prices. | $0.05 USDC |
| Pre-payment counterparty check: should your agent pay this address? | $0.005 USDC |
Payment works two ways:
Prepaid credits (humans, no crypto): buy a $5 pack at this Stripe link, claim the
att_live_...key once athttps://attester.dev/credits/claim?session_id=cs_..., and setATTESTER_API_KEY=att_live_...in the server env. Every paid call deducts from the balance. Check it atGET https://attester.dev/credits/balancewith the key. (CREDITS_API_KEYstill works as an alias.) The free oracle tools honor the key too: the demo routes skip the daily quota for it and never charge.x402 (agents with wallets): set
BUYER_PRIVATE_KEYto a Base wallet with USDC. The wrapper pays per call automatically (402, sign, retry) and sends the wallet address asX-Payer, which keys the paid endpoints' free quotas.
Without any key, the paid endpoints answer HTTP 402 with payment terms in the body.
Agent skill bundle (skills/attester)
The same API, packaged as an Agent Skill so agent configs load it as a
default tool: when-to-use rules, exact curl per endpoint (the keyless
/demo/v1/* free path for oracle checks, X-Payer free quotas for the
rest), verdict reading, and receipt verification.
Install paths:
# Claude Code
/plugin marketplace add maminihds/attester-mcp
# skills.sh CLI (Claude Code, Cursor, Codex, 30+ agents)
npx skills add maminihds/attester-mcp
# OpenClaw (manifestless Claude bundle)
openclaw plugins install https://github.com/maminihds/attester-mcpOr copy skills/attester/ into ~/.claude/skills/ manually. The bundle
has a helper (skills/attester/scripts/call.py, stdlib + httpx) and two
worked transcripts in skills/attester/examples/.
Install from source
pip install -r requirements.txt
python server.py # stdio (default, for agents)
python server.py --http # streamable-http on :8100Environment variables:
SERVER_URL: API base URL, defaults tohttps://attester.dev.ATTESTER_API_KEY: prepaid credits key (att_live_...), optional.BUYER_PRIVATE_KEY: Base wallet for x402 payment, optional.
Example clients
examples/plain_python.py: direct x402-paid call with the official SDK.
examples/langchain_example.py: LangChain tool wrapper.
Links
Site: https://attester.dev
OpenAPI: https://attester.dev/openapi.json
llms.txt: https://attester.dev/llms.txt
Directory listing: https://x402-list.com/services/attester-verification-oracle-verified-research
Available Tools
9 toolsattester_package_existsPackage Exists (free, keyless)ARead-onlyIdempotentInspect
WHAT: checks whether a package name really exists in PyPI or npm. On a miss, typosquat_adjacent flags real names within edit distance 2. WHEN: before installing or importing a package a model suggested; published studies measure 5-20% hallucination rates for suggested package names. WHEN NOT: for private packages outside the public registries. COST: free (25 calls/day per client IP shared across the four attester_* demo tools, reset 00:00 UTC; over quota the response points at the paid route). Paid route /v1/package/exists is $0.002 per call. OUTPUT: {exists, latest_version, typosquat_adjacent, adjacent_to, proof: {artifact_sha256, source_url}, attestation, attestation_hash, signature, served_in_ms}.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Package name (e.g. "requests", "lodash"). | |
| ecosystem | Yes | "pypi" or "npm". |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and non-destructive. The description goes well beyond by disclosing cost limits (25 calls/day, shared quota, reset time), a paid fallback route, and the exact output shape including proof/attestation fields. This adds real decision-making context beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Structured with WHAT/WHEN/WHEN NOT/COST/OUTPUT, front-loaded with the core purpose. Every sentence adds distinct information (cost, quota, typosquat, output). No fluff or redundancy, despite length.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool complexity is moderate due to rate limits, paid route, and typosquat behavior. The description covers all of these, gives the full output shape (also in output schema), and includes cost details. Combined with strong annotations, the description is complete for selecting and invoking this tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for both parameters (name and ecosystem) with examples. The description reinforces these but adds little new syntactic detail—its main additions (typosquat_adjacent, cost) relate to output and usage rather than parameter semantics. Baseline 3 applies since schema carries the load.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a clear WHAT: 'checks whether a package name really exists in PyPI or npm.' This is a specific verb+resource (packages in public registries) and inherently distinguishes from sibling tools like attester_symbol_exists. It adds the typosquat behavior, further clarifying its unique role.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit WHEN: 'before installing or importing a package a model suggested' with supporting evidence (5-20% hallucination rates). Explicit WHEN NOT: 'for private packages outside the public registries.' This gives the agent clear conditions for use and exclusion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
attester_symbol_existsSymbol Exists (free, keyless)ARead-onlyIdempotentInspect
WHAT: checks whether a symbol (function, class, constant) exists in a package at the latest indexed version, with closest-match suggestions on misses. WHEN: before calling an API you are not sure exists; invented symbols are a leading agent compile error. WHEN NOT: for symbols created dynamically at runtime (static analysis ceiling). COST: free (25 calls/day per client IP shared across the four attester_* demo tools, reset 00:00 UTC; over quota the response points at the paid route). Paid route /v1/symbol/exists is $0.005 per call. OUTPUT: {exists, kind, deprecated, since_version, closest_match, version_resolved, proof, attestation, attestation_hash, signature, served_in_ms}.
| Name | Required | Description | Default |
|---|---|---|---|
| symbol | Yes | Symbol to check (e.g. "get", "Session.request"). | |
| package | Yes | Package name (e.g. "requests"). | |
| version | No | Optional version pin (latest indexed version when omitted). | |
| ecosystem | Yes | "pypi" or "npm". |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnly/idempotent annotations, the description discloses the static analysis ceiling (cannot detect runtime-created symbols), free-tier rate limits (25 calls/day shared across attester_* tools), quota fallback to a paid route, and a detailed output structure including proof/attestation fields. This adds substantial behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description uses labeled sections (WHAT/WHEN/WHEN NOT/COST/OUTPUT) to pack information into a scannable format. Every sentence carries distinct information—no filler—making the length justified.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only lookup tool with a full output schema, the description covers purpose, usage, limitations, cost, and output fields. It is self-contained and leaves no major questions about how to invoke or interpret results.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers 100% of parameters with descriptions. The tool description adds that 'symbol' refers to functions, classes, and constants and reinforces the 'latest indexed version' default for the version parameter, slightly enriching the schema. Baseline 3 plus one for the semantic clarification.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'WHAT: checks whether a symbol (function, class, constant) exists in a package at the latest indexed version' — a specific verb and resource with clear scope. It also mentions closest-match suggestions, distinguishing it from sibling tools like package_exists and symbol_signature.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly provides 'WHEN' (before calling an API you are not sure exists) and 'WHEN NOT' (dynamically created symbols), offering clear usage guidance. However, it does not name alternative tools directly, so it stops short of a full 5 on the alternatives criterion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
attester_symbol_signatureSymbol Signature (free, keyless)ARead-onlyIdempotentInspect
WHAT: returns the exact signature, structured params, docstring summary, and deprecation status for one symbol, resolved at a pinned version when given. WHEN: before writing a call against an API you have not used at this version. WHEN NOT: PyPI type annotations are unavailable (the index stores names, not annotations); npm types come from .d.ts as written. COST: free (25 calls/day per client IP shared across the four attester_* demo tools, reset 00:00 UTC; over quota the response points at the paid route). Paid route /v1/symbol/signature is $0.01 per call. OUTPUT: {exists, symbol, kind, signature, params, docstring_first_line, docstring_summary, deprecated, deprecated_since, version_resolved, proof, attestation, attestation_hash, attestation_signature, served_in_ms}. Note: 'signature' is the function signature; the EIP-191 envelope signature ships as attestation_signature.
| Name | Required | Description | Default |
|---|---|---|---|
| symbol | Yes | Symbol to resolve (e.g. "get", "Session.request"). | |
| package | Yes | Package name (e.g. "requests"). | |
| version | No | Optional version pin (latest indexed version when omitted). | |
| ecosystem | Yes | "pypi" or "npm". |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint, but the description adds valuable context: free shared quota (25 calls/day per client IP, reset 00:00 UTC), over-quota behavior pointing to paid route, and clarification of 'signature' vs 'attestation_signature'. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with labeled sections (WHAT, WHEN, WHEN NOT, COST, OUTPUT, Note) and front-loaded with the purpose. Every sentence adds relevant information, and the output field list is clearly separated.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having an output schema, the description explains key output fields and the critical distinction between 'signature' and 'attestation_signature'. It also includes cost, quota, and sibling-tool distinctions, making it complete for selection and invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so each parameter is documented in the schema itself. The description adds slight context (e.g., 'resolved at a pinned version') but not enough to push beyond the baseline for full schemas.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool returns 'the exact signature, structured params, docstring summary, and deprecation status for one symbol' with version resolution, which is specific and distinguishes it from sibling tools like attester_symbol_exists or attester_version_diff.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit WHEN guidance ('before writing a call against an API you have not used at this version') and WHEN NOT ('PyPI type annotations are unavailable'), as well as cost/alternative routing. This fully addresses when to use this tool versus others.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
attester_version_diffVersion Diff (free, keyless)ARead-onlyIdempotentInspect
WHAT: symbol-level diff between two pinned versions of one package: added, removed, changed signatures, new deprecations, and a breaking/additive/neutral classification, signed. WHEN: before upgrading a dependency, or when reviewing what an upgrade breaks. WHEN NOT: unresolvable versions come back as a 422 error dict, never a partial diff. COST: free (25 calls/day per client IP shared across the four attester_* demo tools, reset 00:00 UTC; over quota the response points at the paid route). Paid route /v1/diff is $0.02 per call. OUTPUT: {classification, added, removed, changed, new_deprecations, counts, proof, attestation, attestation_hash, signature, served_in_ms}.
| Name | Required | Description | Default |
|---|---|---|---|
| package | Yes | Package name (e.g. "requests"). | |
| ecosystem | Yes | "pypi" or "npm". | |
| to_version | Yes | Newer version (e.g. "2.32.3"). | |
| from_version | Yes | Older version (e.g. "2.31.0"). |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations (read-only, open-world, idempotent), the description discloses important behavioral traits: rate limits (25 calls/day per client IP), quota reset time, behavior when over quota (redirects to paid route), error behavior for unresolvable versions (422 error, never partial diff), and the signed attestation output. This adds significant context beyond what annotations provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description uses clear section labels (WHAT, WHEN, WHEN NOT, COST, OUTPUT) to front-load the core purpose and provide scannable details. Every sentence contributes value—purpose, usage guidance, error behavior, pricing, and output structure—with no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (4 required parameters, output schema, rate limits, paid routes, signed attestation), the description is remarkably complete. It covers the operation, usage context, failure modes, cost structure, and output keys, leaving little ambiguity for an agent deciding whether and how to invoke it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already documents all four parameters with clear descriptions (ecosystem, package, from_version, to_version) at 100% coverage. The description does not add additional parameter-level meaning beyond what the schema provides, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a precise action: "symbol-level diff between two pinned versions of one package" and enumerates the specific outputs (added, removed, changed signatures, new deprecations, breaking/additive/neutral classification). This clearly distinguishes it from sibling tools like attester_package_exists or attester_symbol_signature, which serve different purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives an explicit use case ("before upgrading a dependency, or when reviewing what an upgrade breaks") and a 'WHEN NOT' statement about unresolvable versions. However, it does not name alternative tools for cases where a diff cannot be performed, so it lacks the explicit alternative guidance that would earn a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
oracle_code_researchVerified Coding Research (paid, credits or x402)ARead-onlyIdempotentInspect
WHAT: answers a coding question (library/API usage, error diagnosis, best practices) with real citations, and ships a signed attestation that the citations were re-checked by an independent verification pipeline. WHEN: you need a grounded, cited answer mid-task and are willing to pay per call. WHEN NOT: for open-ended code generation, for questions needing private/proprietary docs, or when a free unverified answer is good enough (use web search). COST: $0.10 USDC per call (x402 on Base; 25-call free tier). LATENCY: ~2-6s typical (search + citation re-check). OUTPUT: {answer, citations: [{title, url, snippet}], provider, served_in_ms, citation_check: {verdict, confidence}, attestation, attestation_hash, signature}.
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | ||
| context | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| answer | Yes | |
| provider | Yes | |
| citations | Yes | |
| signature | No | |
| attestation | No | |
| served_in_ms | Yes | |
| citation_check | No | |
| attestation_hash | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description reveals cost per call ($0.10 USDC), latency range (~2-6s), the independent verification pipeline, and the attestation mechanism, all beyond the annotations' readOnly/openWorld/idempotent hints. It gives critical operational details without contradicting annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The labeled sections (WHAT, WHEN, WHEN NOT, COST, LATENCY, OUTPUT) make the dense information scannable and front-loaded. There is no redundant wording; every section provides necessary information for an agent to decide and invoke the tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers purpose, usage, exclusions, cost, latency, and output structure, with annotations covering safety. However, the optional 'context' input parameter is not explained, which is a minor completeness gap given the tool's complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description implicitly defines 'query' as the coding question but does not explain the optional 'context' parameter. With 0% schema description coverage, some compensation exists (e.g., query semantics), but the context parameter's purpose remains unclear, leaving a notable gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool answers coding questions (library/API usage, error diagnosis, best practices) and provides real citations with a signed attestation. This specific verb+resource distinguishes it from siblings like oracle_verify_work or oracle_watchtower_report, and the contrast with web search clarifies its niche.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly includes WHEN and WHEN NOT sections: use when you need a grounded, cited answer mid-task and are willing to pay; avoid for open-ended code generation, private/proprietary docs, or when a free unverified answer suffices, citing web search as the alternative. This is exemplary usage guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
oracle_judgeQA Judge (paid, credits or x402)ARead-onlyIdempotentInspect
WHAT: grades an agent output against your rubric and returns a 0-100 weighted score with per-criterion evidence and a signed attestation. Deterministic graders: structure coverage, citation presence, claim support against provided sources, length rules. WHEN: accepting or rejecting another agent's written deliverable, ranking candidate answers, or logging a signed QA receipt before downstream payment. WHEN NOT: for subjective taste calls (style, product direction), for citation truth-checking alone (use oracle_verify_work), or with a vague rubric: the judge is literal and grades exactly what you write. COST: $0.10 USDC per grading (x402 on Base; 3 free gradings). LATENCY: ~1s without source checks, up to ~30s when claim-support fetches sources. OUTPUT: {score, verdict: pass|abstain|fail, per_criterion: [{criterion, score, evidence, weight}], attestation, attestation_hash, signature, served_in_ms}. Bands: >=70 pass, 40-69 abstain, <40 fail.
| Name | Required | Description | Default |
|---|---|---|---|
| output | Yes | The text to grade. | |
| rubric | Yes | Criteria as [{"criterion": str, "weight": float | None}]. | |
| context | No | Optional extra context (instructions, source URLs). |
Output Schema
| Name | Required | Description |
|---|---|---|
| score | Yes | |
| verdict | Yes | |
| signature | No | |
| confidence | No | |
| attestation | No | |
| served_in_ms | No | |
| per_criterion | Yes | |
| attestation_hash | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint. The description adds substantial context beyond these: cost ($0.10 USDC), latency (~1s to ~30s), deterministic grading behavior, the literal interpretation of the rubric, score bands, and output details (signed attestation). This enriches the agent's understanding of side effects, resource usage, and response characteristics without contradicting any annotation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is organized with clear labeled sections (WHAT, WHEN, WHEN NOT, COST, LATENCY, OUTPUT, Bands), making it easy to scan and parse. Every sentence serves a distinct purpose—purpose, usage guidance, exclusions, cost, latency, output format, and thresholds—with no fluff or redundant restatement of schema/annotations.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 3 parameters, an output schema, and rich annotations, the description covers all critical operational aspects: exact use cases, alternatives, cost, latency, determinism, score bands, and output structure. The presence of an output schema means return values need not be exhaustively documented, but the description still summarizes the key output fields and thresholds, leaving no significant gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds meaningful context by explaining that the judge is 'literal and grades exactly what you write,' which directly informs how the rubric parameter should be constructed, and ties the weight parameter to the returned per-criterion weighted score. This goes slightly beyond the schema's structural descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'WHAT: grades an agent output against your rubric and returns a 0-100 weighted score with per-criterion evidence and a signed attestation,' which is a specific verb+resource statement that immediately clarifies the tool's function. It further distinguishes itself from the sibling tool oracle_verify_work by explicitly naming the alternative for citation truth-checking.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description includes explicit 'WHEN' and 'WHEN NOT' sections, listing concrete use cases (accepting/rejecting deliverables, ranking candidate answers, logging QA receipts) and exclusions (subjective taste, citation truth-checking alone, vague rubric). It also names the specific alternative tool, oracle_verify_work, for one of the exclusions, providing clear decision guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
oracle_spend_checkSpend Check (paid, credits or x402)ARead-onlyIdempotentInspect
WHAT: pre-payment counterparty check. Given a 0x address or URL, returns a clear/caution/avoid verdict with per-source evidence (watchtower track record, CDP merchant catalog, address hygiene) and a signed attestation. WHEN: before sending any x402 payment to a service you have not paid before, or before raising a payment limit. WHEN NOT: for services you already trust, for judging delivered work (use oracle_verify_work), or as a guarantee. An unknown payee is always 'caution', never 'clear'. COST: $0.005 USDC per check (x402 on Base; 5 free checks). LATENCY: ~1-3s (catalog lookup + RPC call). OUTPUT: {verdict, confidence, evidence: [...], attestation, attestation_hash, signature, served_in_ms}.
| Name | Required | Description | Default |
|---|---|---|---|
| payTo | Yes | The counterparty you are about to pay (0x address or URL). | |
| amount_usd | No | Optional planned amount; large amounts downgrade clear verdicts to caution. |
Output Schema
| Name | Required | Description |
|---|---|---|
| verdict | Yes | |
| evidence | Yes | |
| signature | No | |
| confidence | Yes | |
| attestation | No | |
| served_in_ms | No | |
| attestation_hash | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark readOnly and idempotent, but the description adds valuable behavioral context: cost per check, latency, the policy that 'An unknown payee is always caution, never clear,' and a detailed output structure. This goes well beyond annotations without contradicting them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description uses labeled sections (WHAT, WHEN, WHEN NOT, COST, LATENCY, OUTPUT) that are concise and front-loaded. Each sentence adds useful information without redundancy or wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has an output schema, but the description still provides a helpful preview of return fields. It also covers cost, latency, usage boundaries, and a key policy caveat. The inclusion of sibling tool references and cost information makes it operationally complete for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%—both payTo and amount_usd are well-described. The description adds some contextual framing (e.g., 'pre-payment' and 'raising a payment limit') but does not introduce parameter-specific meaning beyond the schema. This aligns with the baseline for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific verb+resource: 'pre-payment counterparty check. Given a 0x address or URL, returns a clear/caution/avoid verdict with per-source evidence... and a signed attestation.' It distinguishes from siblings by explicitly pointing to oracle_verify_work for judging delivered work.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit WHEN clauses: 'before sending any x402 payment to a service you have not paid before, or before raising a payment limit.' WHEN NOT is also explicit: 'for services you already trust, for judging delivered work (use oracle_verify_work), or as a guarantee.' This provides clear alternatives and exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
oracle_verify_workVerification Oracle (paid, credits or x402)ARead-onlyIdempotentInspect
WHAT: independently checks another agent's work (citation support, code correctness via sandboxed pytest, or dataset/schema conformance) and returns a verdict plus an EIP-191 signed attestation verifiable offline. WHEN: before paying for subcontracted agent work, before merging agent-produced citations/code/data into a deliverable, or when you need portable proof a third party checked the work. WHEN NOT: for work you produced and already trust, for subjective judgments (style, product decisions), or for languages other than Python (code jobs). COST: $0.15 USDC per call (x402 on Base; 5-call free tier). LATENCY: ~1s (data) to ~30s (citation fetches / code sandbox). OUTPUT: {verdict: pass|fail|partial|abstain, confidence, evidence: [...], attestation, attestation_hash, signature, served_in_ms}. 'abstain' = too ambiguous to call: get a second opinion, do not treat as pass.
| Name | Required | Description | Default |
|---|---|---|---|
| job | Yes | ||
| spec | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| verdict | Yes | |
| evidence | Yes | |
| signature | No | |
| confidence | Yes | |
| attestation | No | |
| served_in_ms | No | |
| attestation_hash | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare read-only/idempotent/non-destructive, and the description adds valuable behavior beyond that: cost ($0.15 USDC, x402, free tier), latency range, output structure, and the meaning of 'abstain'. This is rich, non-redundant context that helps the agent anticipate side effects and results.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long but tightly organized with labeled sections (WHAT, WHEN, WHEN NOT, COST, LATENCY, OUTPUT). Every sentence provides distinct and necessary information, and the most critical what-it-does is front-loaded. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 2 params, no schema descriptions, and an output schema, the description covers purpose, usage conditions, exclusions, cost, latency, output structure, and the abstain semantics. It addresses both selection and invocation contexts comprehensively, leaving very little to infer.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has zero description coverage, and the description does not explain the structure of the `job` or `spec` objects. It mentions three job domains but not how to encode them, leaving parameter usage ambiguous. The description compensates only partially; an agent would still need examples or field-level semantics to invoke correctly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'WHAT: independently checks another agent's work' and enumerates specific domains (citation support, code correctness, dataset/schema conformance). It clearly distinguishes a verification oracle from sibling research/report/spend/judge tools, and it specifies the unique output (verdict + signed attestation).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The 'WHEN' section lists concrete scenarios (before paying for subcontracted work, before merging agent-produced content) and 'WHEN NOT' gives explicit exclusions (already trusted work, subjective judgments, non-Python code). This provides strong guidance on when to choose this tool over alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
oracle_watchtower_reportSLA Watchtower Report (paid, credits or x402)ARead-onlyIdempotentInspect
WHAT: returns the latest signed SLA report for a watched x402 service: uptime_pct, price_match_pct, and current verdict (honoring, price_mismatch, unexpected_status, invalid_payload, unreachable) from probes every 30 minutes, EIP-191 signed. WHEN: before routing paid traffic to an x402 service you do not control, or when checking whether a service still charges its advertised price. WHEN NOT: for real-time health (reports aggregate 24h), for services not yet watched (GET /watchtower/targets lists coverage), or for verifying work products (use oracle_verify_work). COST: $0.05 USDC per report (x402 on Base; 3 free reports). LATENCY: ~1s, reports are pre-computed. OUTPUT: {report: {subject, window, checks, uptime_pct, price_match_pct, current_verdict, timestamp}, attestation, attestation_hash, signature, generated_at}.
| Name | Required | Description | Default |
|---|---|---|---|
| service | Yes | Host or URL substring of the watched service (e.g. "attester.dev"). |
Output Schema
| Name | Required | Description |
|---|---|---|
| report | Yes | |
| signature | No | |
| attestation | No | |
| generated_at | No | |
| attestation_hash | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, so the safety profile is known. The description adds valuable behavioral context: reports are aggregated over 24h, probes run every 30 minutes, reports are pre-computed (~1s latency), EIP-191 signed, and there is a cost of $0.05 USDC with 3 free reports. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-organized with clear labels (WHAT, WHEN, WHEN NOT, COST, LATENCY, OUTPUT) and every sentence provides distinct, useful information. It is concise for the amount of context it delivers, with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers purpose, usage boundaries, cost, latency, output shape, and limitations. The presence of an output schema reduces the need to explain return values, and the description goes beyond what is required, making it fully complete for a 1-parameter tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for the single parameter 'service', and the schema already provides its description ('Host or URL substring of the watched service'). The tool description does not add additional parameter-level detail, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'WHAT: returns the latest signed SLA report for a watched x402 service' and enumerates the exact output fields (uptime_pct, price_match_pct, current_verdict). It clearly distinguishes from siblings by naming oracle_verify_work as the tool for work products, and clarifies the report is for SLA health, not real-time status.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly provides WHEN ('before routing paid traffic to an x402 service you do not control, or when checking whether a service still charges its advertised price'), WHEN NOT ('for real-time health', 'for services not yet watched', 'for verifying work products'), and names an alternative tool (oracle_verify_work). This is exemplary guidance for tool selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
TDQS
Each tool targets a distinct task: code research, work verification, SLA monitoring, counterparty checks, rubric grading, and package/symbol checks. The oracle_* tools are clearly separated from the attester_* demo tools, and even within each family purposes are unambiguous.
Naming is inconsistent across the set: oracle_* uses a mix of verbs (research, verify_work, judge) and nouns (watchtower_report, spend_check), while attester_* follows a different entity-first pattern (package_exists, symbol_signature, version_diff). No uniform verb_noun convention is maintained.
9 tools is a reasonable count for an attestation server, though it splits into two distinct families (oracle_ paid services and attester_ free demos) which makes the set feel slightly broader than one focused domain. Each tool earns its place, so the count is justified.
The core lifecycle is well covered: research, verification, grading, spend checks, and dependency diffing. Minor gaps exist, such as no direct tool to list watchtower targets or inspect raw package metadata, but these are edge cases that don't break workflows.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Package intelligence MCP for AI agents — 22 tools, 19 ecosystems, AGPL SDK, free.
MCP server for AI agents to plan, verify, and deploy Cloudflare-native apps.
MCP server for building and testing AI agents with multi-model experimentation and insights.
MCP server connecting AI agents to 100+ apps (Gmail, Slack, Notion, GitHub) via one-click OAuth.
Related MCP Servers
- FlicenseAqualityDmaintenancePackage intelligence MCP server. Stops AI agents from installing hallucinated/malicious packages across 17 ecosystems. 22 tools, free, no auth.221

@lpm-registry/mcp-serverofficial
AlicenseAqualityCmaintenanceMCP server for the LPM package registry, enabling AI tools to search, browse source code, install packages, check quality, and more.1718ISC- AlicenseNot gradedqualityCmaintenanceAn MCP server that provides tools to fetch live, version-accurate documentation, changelogs, examples, and method signatures for npm and PyPI packages, preventing AI coding agents from hallucinating stale APIs.21ISC
- AlicenseNot gradedqualityAmaintenanceMCP server that provides 25 tools for AI agents to query and modify a dependency graph, enabling impact analysis and provenance tracking for AI-assisted development.8MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/maminihds/attester-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server