Skip to main content
Glama
AOTrust - PDR Notarization

AOTrust - PDR Notarization

AOTrust — Cryptographic Proof of Existence for AI Agents

Official MCP Registry M8ven Score Protected by AOTrust Mainnet Live License PDR v2.3/v2.4 x402

AOTrust issues PDRs (Provenance Data Records) — 239-byte cryptographic receipts proving a digital artifact existed at a specific time. $0.01 USDC via x402 — pay on Base (EVM) or Solana (SVM, via MCP). Anchored hourly to NEAR blockchain. No account needed. Supports ordinary (v0x03) and bilateral (v0x04) signatures.

Positioning: an Independent External Provenance Checkpoint. Native attestations (Sigstore, GitHub artifact attestations) verify a build inside the CI system that produced it. AOTrust complements them: it issues a signed certificate outside GitHub/Microsoft infrastructure and anchors it hourly to the NEAR blockchain — so provenance survives even if the repository is rewritten, the CI logs disappear, or the attestation store is unavailable. Use both.

Agent Checkpoint (new)

Connect your AI coding agent in 60 seconds and make it notarize plan/patch/release checkpoints — free tier, no account: agent-checkpoint/ — mcp.json drop-ins for Cursor, Cline, and any MCP client, plus a copy-paste AGENTS.md block (Provenance: <Shield ID> in commits).

Related MCP server: x402 Notary MCP

Authorship Claims (bilateral signatures)

Beyond agent workflows, AOTrust supports bilateral PDRs (v0x04): the artifact is signed by you (Ed25519) and countersigned by the notary — a binding hash ties your public key to the content. This turns "I wrote/published this first" into a verifiable claim for any digital artifact: manuscripts, designs, photos, research notes, legal correspondence. Verification is public at https://verify.aotrust.link — no account, no software install for the reader. Signing guide (Ed25519, NEP-413): SKILL.md → Bilateral Signature. See pdr-spec.md §v2.4 for the binding-hash construction.

Quickstart

Prefer one-click? See INTEGRATIONS.md — ready MCP configs for Cursor, Windsurf, Cline, Claude Desktop, plus a "notarize before commit" rule for your assistant and LangChain/CrewAI examples.

# 1. Compute SHA-256 hash of your artifact
HASH=$(echo -n "Hello AOTrust" | sha256sum | cut -d' ' -f1)

# 2. Request notarization → get 402 payment details
curl -X POST https://api.aotrust.link/notarize \
  -H "Content-Type: application/json" \
  -d "{\"work_hash\":\"$HASH\",\"agent_sig\":\"\",\"agent_pubkey\":\"\"}"

# 3. Pay $0.01 USDC on Base (EIP-3009), then POST with x-payment header
# Full example: see SKILL.md → "Step 3: Pay"

For full EIP-3009 signing code (Python + ethers.js examples), see SKILL.md.

Interfaces

Interface

Best for

Auth

HTTP API

Developers, scripts, CI/CD

x402 payment (no API key needed); free tier 5/day/IP

MCP

AI agents (Claude, Cursor, Cline)

None for discovery + free tools (notary_free 5/day/IP)

Authentication & keys

Notarization is keyless. Standard notarization (free tier and x402 micropayments) never requires an API key — payment is in-band (x402 x-payment header) and free calls are IP rate-limited.

AO_TRUST_KEY is optional and only used by the GitHub Action (action/notarize.py) to unlock the dedicated CI rate limit (50/24h per key, via X-Api-Key on /v1/shield/free) instead of the shared per-IP free limit (5/24h). It is an opt-in convenience for CI pipelines — nothing else reads it, and no secret ever enters a PDR.

Endpoints:

  • API: https://api.aotrust.link/notarize

  • MCP: https://api.aotrust.link/mcp

  • Verify: https://verify.aotrust.link

  • Docs: https://docs.aotrust.link

Verify API (public, embeddable)

Verification is a standalone public API — no account, no rate limits, no payment. Embed it in your product (dashboards, audit tools, escrow flows) or call it from the terminal:

# Verify a PDR (base64url-encoded bundle):
curl https://api.aotrust.link/v1/pdr/verify/<pdr_b64url>
# → {"valid": true, "checks": {...}, "error": null}

# Look up a PDR by Shield ID (8 hex chars):
curl https://api.aotrust.link/v1/shield/lookup/<shield_id>
# → {"found": true, "pdr_b64": "...", "shield_id": "..."}

# Get the notary public key for offline verification:
curl https://api.aotrust.link/v1/notary/pubkey

Prefer full offline trust? pdr_parser.py verifies any PDR locally — zero dependencies, no network, no trust in our servers.

Offline Merkle verification (anchored receipts)

Anchored PDRs carry the hourly Merkle root committed on-chain in the NEAR contract notary-node.near — readable from any public NEAR RPC, forever, independent of our servers. The verify API returns merkle_proof, merkle_index, merkle_leaf and merkle_tree_size for anchored PDRs. Save the verify JSON response — then verify it forever, offline:

# (once) save the verify response when the receipt is fresh:
curl https://api.aotrust.link/v1/pdr/verify/<pdr_b64url> > verify.json

# (any time, no AOTrust server needed) check inclusion:
python3 verify_merkle_inclusion.py \
  --leaf <merkle_leaf> --proof <comma-joined merkle_proof> \
  --index <merkle_index> --root <merkle_root> \
  --tree-size <merkle_tree_size>
# → VALID

# the root can always be re-checked against the chain itself via any
# NEAR RPC: contract notary-node.near, method get_root({"seq": N})

verify_merkle_inclusion.py is standalone and zero-dependency (RFC 9162 §2.1.3.2 walk, same hashing as the anchoring engine). tree_size must be taken from the verify response (or a published anchor snapshot), not chosen by the verifier.

PDR Specification & Tools

Comparison

Feature

AOTrust

Chainlink

OpenTimestamps

Notary.fyi

Price/PDR

$0.01

$0.25+

Free (slow)

$0.50+

Payment rail

x402 USDC

LINK

Bitcoin TX

Stripe

PDR format

239B binary

Oracle data

OTS file

PDF

AI agent native

MCP + HTTP

No

No

No

Blockchain anchor

NEAR (hourly)

Ethereum

Bitcoin

None

Offline verify

Yes (pdr_parser.py)

No

Yes

No

GitHub Action

Notarize build artifacts or AI-generated files directly in CI/CD — free, no wallet needed.

- uses: GitSerge-crypto/aotrust-skills@v1.1
  with:
    files: dist/*

Outputs: shield_id, verify_url, pdr_b64. Results appear in $GITHUB_STEP_SUMMARY as a markdown table with verification links.

Example workflow

name: Release
on:
  release:
    types: [published]

jobs:
  notarize:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: GitSerge-crypto/aotrust-skills@v1.1
        with:
          files: dist/*
      - name: Show shield ID
        run: echo "Shield ID: ${{ steps.notarize.outputs.shield_id }}"

License

MIT

Available Tools

5 tools
notary_freeA

Create a free cryptographic proof of existence (PDR) for a digital artifact without payment. Dual mode: pass work_hash (Mode A, client-computed SHA-256 hex) OR content (Mode B, raw text/code ≤60KB — server hashes it, zero retention). Subject to rate limits (5/IP/day, 1000/day global). Returns shield_id, pdr_b64, and verify_url. For on-chain settlement proof, use notary_notarize_paid ($0.01 USDC on Base).

NameRequiredDescriptionDefault
contentNo
metadataNo
work_hashNo

Output Schema

NameRequiredDescription

No output parameters

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it does well: it discloses free operation, rate limits (5/IP/day, 1000/day global), zero content retention, server-side hashing, and the returned identifiers. The one notable gap is the ambiguous 'OR' between work_hash and content — it does not state what happens if both are provided, nor does it mention metadata behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four focused sentences, each earning its place: purpose, modes, limits, returns, and alternative route. Front-loaded with the core purpose and free nature, with supporting constraints and final routing. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with an output schema, the description need not enumerate return values, but it does anyway — nice. It covers the main operational limits, retention behavior, and alternative. The gaps are the missing metadata parameter description and the unclear behavior when both content and work_hash are passed. Overall quite complete for a small free tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It adds useful semantics for work_hash ('client-computed SHA-256 hex') and content ('raw text/code ≤60KB — server hashes it, zero retention'), but it completely omits the metadata parameter. The OR relationship between work_hash and content is also underspecified around mutual exclusivity.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific action and resource: 'Create a free cryptographic proof of existence (PDR) for a digital artifact without payment.' It clearly distinguishes itself from the paid on-chain sibling by naming notary_notarize_paid and contrasting the free nature. The dual-mode explanation further clarifies what the tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use this tool (free proof, no payment) and when not to: 'For on-chain settlement proof, use notary_notarize_paid.' It also provides mode selection guidance for work_hash vs content. This is strong routing guidance that helps the agent choose correctly among siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

notary_notarizeA

Submit a work artifact for on-chain notarisation (NEAR_DIRECT payment path). PREREQUISITE: Send the NEAR amount from notary_quote to the sink account, then provide the resulting tx_hash here. The server verifies the on-chain payment and submits the notarisation. Payment binding: pass payer_account (the NEAR account that paid) and bind_sig — a base64 Ed25519 NEP-413 signature over 'AOTrust AITP-BIND v1 work_hash:<64hex> tx_hash:<tx_hash>'. Returns job_id — use notary_verify to poll for the signed PDR. Step 3 of the notarisation flow: quote -> pay -> notarize -> verify.

NameRequiredDescriptionDefault
tx_hashYes
bind_sigNo
metadataNo{}
agent_sigNo
work_hashYes
agent_pubkeyNo
artifact_uriNo
payer_accountNo

Output Schema

NameRequiredDescription

No output parameters

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does well: it discloses that the server independently verifies the on-chain payment, that a base64 Ed25519 NEP-413 binding signature over a specific message format is required, and that the call returns a job_id. It omits failure behavior (invalid/duplicate tx_hash, insufficient amount) and idempotency, which for a payment-gated mutation matters.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose and precondition are front-loaded, and the flow summary at the end closes the loop cleanly. The embedded multi-line signature template bloats the middle, but it is load-bearing information rather than filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a payment-gated, multi-step tool this covers prerequisites, binding requirements, and the handoff to verification, and an output schema exists so return values need little prose. The main gap is the four undocumented optional parameters (agent_sig, agent_pubkey, artifact_uri, metadata), which matter for an artifact-submission call.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must document the 8 parameters itself. It gives real meaning for tx_hash, payer_account, bind_sig (including the exact signed message template) and implicitly work_hash, but leaves metadata, agent_sig, agent_pubkey and artifact_uri entirely unexplained in both schema and description — half the surface is still opaque.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a concrete verb+resource ('Submit a work artifact for on-chain notarisation') and scopes it to the NEAR_DIRECT payment path, which implicitly separates it from notary_free and notary_notarize_paid. The placement as 'Step 3 of the notarisation flow' further pins down its role, though the paid/free siblings are never named explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit prerequisite (pay the notary_quote amount to the sink account first), the ordering of the flow (quote -> pay -> notarize -> verify), and names notary_verify as the polling follow-up. It does not, however, say when to choose this over notary_notarize_paid or notary_free, so the alternative selection remains inferred from the payment-path parenthetical.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

notary_notarize_paidA

Notarize a work hash on AOTrust (mainnet NEAR + Base USDC receipt). $0.01 USDC via x402-over-MCP: call without payment to receive PaymentRequired; retry with params._meta['x402/payment'] = signed PaymentPayload (EIP-3009, scheme exact, eip155:8453). HTTP clients: POST /notarize with x-payment header.

NameRequiredDescriptionDefault
agent_sigNo
work_hashYes
agent_pubkeyNo

Output Schema

NameRequiredDescription

No output parameters

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden, and it does well: it discloses the two-phase payment flow, the exact payment scheme (EIP-3009), chain ID (eip155:8453), and the HTTP alternative. It does not mention side effects or reversibility, but the payment requirement is the most critical non-obvious behavior and is clearly explained.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded with the main purpose, then the payment flow, then the HTTP note. It is dense but every sentence adds operational detail. Minor formatting improvements could separate the protocol steps, but there is essentially no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the two-step payment complexity, the description is largely complete: it covers the mainnet NEAR + Base USDC receipt, the EIP-3009 payload, and the HTTP header. An output schema exists, so return values do not need description. However, it omits the optional agent_sig/agent_pubkey semantics and does not explicitly differentiate this tool from the notarize siblings.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It gives context for work_hash ('a work hash') and documents the payment meta-parameter, but it never explains agent_sig or agent_pubkey, which are optional schema fields. The agent is left guessing what those values should be or why they are needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a clear verb and resource: 'Notarize a work hash on AOTrust'. It further specifies the paid nature ('$0.01 USDC via x402-over-MCP'), which distinguishes it from the sibling tools like notary_free and notary_notarize by payment model.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives a concrete invocation strategy: call without payment, receive PaymentRequired, retry with a signed PaymentPayload. However, it never explicitly states when to choose this tool over notary_notarize or notary_free, leaving the selection decision to inference from the name and payment wording.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

notary_quoteA

Request a notarisation quote for a work artifact. Returns the cost ($0.01 USDC or NEAR equivalent), a quote_id valid for 600 seconds, the sink account to send payment to, and the PDR schema version. Step 1 of the notarisation flow: quote -> pay -> notarize -> verify.

NameRequiredDescriptionDefault
work_hashNo
pdr_versionNo2.3

Output Schema

NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It discloses the key stateful facts: it returns a quote_id that is 'valid for 600 seconds,' the sink account, cost, and PDR schema version, while the flow sequence implies no payment or notarization happens at this step. It does not discuss side effects, idempotency, or failure behavior, but the main contract is transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is only three sentences with no filler. It front-loads the action, then the return values, then the flow placement. Every sentence adds useful information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that an output schema exists and the parameter names are fairly self-explanatory, the description covers the important operational context: purpose, payment details, quote expiry, and flow order. The main gap is explicit parameter guidance, but the overall tool is simple enough that the description is largely sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It gives semantic hints by mentioning a 'work artifact' (mapping to work_hash) and 'PDR schema version' (mapping to pdr_version), but it never explicitly explains the hash format, the optionality/defaults of the two parameters, or that pdr_version selects the schema version used. This is adequate but not complete.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb-resource pair ('Request a notarisation quote for a work artifact') and immediately distinguishes the tool from siblings by placing it as 'Step 1 of the notarisation flow: quote -> pay -> notarize -> verify.' This clearly separates it from notary_notarize, notary_notarize_paid, and notary_verify, and the mention of cost/payment separates it from notary_free.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The explicit flow 'quote -> pay -> notarize -> verify' tells an agent that this tool is the entry point and should precede the pay/notarize/verify siblings. It does not name alternatives like notary_free or state conditions for when not to use the tool, so it falls short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

notary_verifyA

Verify a notarisation by job_id. Returns status (pending/anchored/error). If anchored, returns the full PDR record (base64, 239 bytes) with Ed25519 signature verification. Step 4 of the notarisation flow: quote -> pay -> notarize -> verify. Can be polled repeatedly until status changes from 'pending' to 'anchored'.

NameRequiredDescriptionDefault
job_idYes

Output Schema

NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It discloses polling behavior, return types (status, PDR record with size and signature algorithm), and that the status transitions from pending to anchored. Could mention idempotency or rate limits, but good overall.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, front-loaded with the action, no redundant information. Every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The presence of an output schema reduces the need to describe return values in detail. The description covers status transitions, PDR record content, and signature verification. Could elaborate on error conditions, but overall complete for the tool's simplicity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is only one parameter (job_id) with 0% schema coverage. The description mentions 'by job_id' but does not explain what it is or where to obtain it. For a single required param, this is adequate but not excellent.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it verifies a notarisation by job_id, lists return statuses and what happens when anchored. It explicitly places itself as step 4 of the flow, distinguishing it from sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains it is step 4 of the flow (quote -> pay -> notarize -> verify) and that it can be polled until status changes. It does not explicitly mention when not to use it, but the context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 5 tool updatesv1.0.0
    • First observednotary_free
    • First observednotary_notarize
    • First observednotary_notarize_paid
    • First observednotary_quote
    • First observednotary_verify

TDQS

A4/5.0

Scored across 5 tools

Disambiguation3/5

Most tools are distinct, but notary_notarize and notary_notarize_paid both perform paid notarisation on different payment rails, and the generic name notary_notarize can be mistaken for the default paid path. The descriptions clarify the quote/pay/notarize/verify flow, but the overlap still risks misselection.

Naming Consistency4/5

All tools consistently use the notary_ prefix and action-oriented suffixes, which is predictable. However, notary_notarize vs notary_notarize_paid is slightly misleading because notary_notarize is itself a paid NEAR_DIRECT path, not the general or free operation.

Tool Count5/5

Five tools are well-scoped for a focused notarisation workflow: free proof, quote, two paid notarisation rails, and verification. Each tool has a clear role in the lifecycle.

Completeness4/5

The surface covers the core lifecycle of quote, payment, notarisation, and verification, plus a free proof path. Minor gaps include no direct retrieval of paid PDRs by a shield_id or listing of past notarisation jobs, but these are workarounds rather than critical dead ends.

Maintenance

ActivityActive
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers