hivetrust
Provides parametric insurance escrow using USDC on Coinbase's Base L2, enabling automated claim payouts and on-chain trust operations.
π HiveTrust
βββ βββββββββ βββββββββββββββββββββββββββ βββ ββββββββββββββββββββ
βββ βββββββββ βββββββββββββββββββββββββββββββ ββββββββββββββββββββ
ββββββββββββββ βββββββββ βββ βββββββββββ βββββββββββ βββ
βββββββββββββββ ββββββββββ βββ βββββββββββ βββββββββββ βββ
βββ ββββββ βββββββ ββββββββ βββ βββ ββββββββββββββββββββ βββ
βββ ββββββ βββββ ββββββββ βββ βββ βββ βββββββ ββββββββ βββ "The Equifax + GEICO of the A2A Economy"
HiveTrust is the trust infrastructure layer for the agent-to-agent (A2A) economy. It provides Know-Your-Agent (KYA) identity verification, algorithmic trust scoring, and parametric insurance so that AI agents can transact with each other safely β at machine speed, without human intermediaries.
As autonomous agents start negotiating contracts, processing payments, and managing real assets, the ecosystem needs a credit bureau and an insurer rolled into one. That's HiveTrust.
What HiveTrust Does
πͺͺ KYA Identity Verification
Agents are pseudonymous by default. HiveTrust anchors each agent to a verifiable, unforgeable identity:
DID registration (
did:hive:<uuid>) with Ed25519 public key bindingChallengeβresponse proofs β the agent must sign a random nonce to prove key ownership
Capability manifest validation β declared tools and permissions are logged immutably
W3C Verifiable Credentials issued at each verification tier
Revocation registry with real-time status checks
π Trust Scoring (0 β 1000)
HiveTrust's scoring engine synthesises five behavioural pillars into a single, portable reputation score:
Pillar | Weight | What it measures |
Transaction Success Rate | 35% | SLA completion vs. disputes |
Capital Staked | 25% | USDC locked in collateral pool |
Network Centrality | 15% | PageRank of the transaction graph |
Identity Strength | 15% | DID anchor age, ZKP proofs, checksum stability |
Compliance | 10% | EU AI Act, NIST AI RMF, fidelity probe results |
Trust tiers: unverified (0β199) Β· provisional (200β399) Β· standard (400β599) Β· elevated (600β799) Β· sovereign (800β1000)
π‘οΈ Parametric Insurance
When agents transact with strangers, someone has to absorb the tail risk. HiveTrust provides:
On-demand quote β dynamic premium priced from trust scores and transaction value
Instant bind β policy activated before the transaction settles
Parametric claims β automatic payout triggered by on-chain proof, not human adjudication
Three product lines: transaction coverage Β· performance bonds Β· liability policies
How HiveTrust Complements HiveAgent
HiveAgent is the agent runtime β it executes tasks, manages tool calls, and handles the A2A protocol layer.
HiveTrust is the trust fabric underneath it:
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β Your Application β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β HiveAgent (task execution, A2A) β
β β REST / MCP β
β HiveTrust (identity, reputation, insurance, compliance) β
ββββββββββββββββββββββββββββββββββββ¬βββββββββββββββββββββββββββββββ€
β On-chain (Base L2 / USDC) β Off-chain (SQLite / Events) β
ββββββββββββββββββββββββββββββββββββ΄βββββββββββββββββββββββββββββββHiveAgent calls POST /v1/insurance/quote before any high-value task and GET /v1/verify_agent_risk before accepting an inbound request from an unknown agent. The trust score flows back into HiveAgent's routing and pricing decisions.
Architecture
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β Layer 1 β Identity KYA β
β ββββββββββββββββββ ββββββββββββββββββββ βββββββββββββββββββββ β
β β DID Registry β β Ed25519 Proofs β β W3C-VC Issuance β β
β ββββββββββββββββββ ββββββββββββββββββββ βββββββββββββββββββββ β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β Layer 2 β Reputation Engine β
β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
β β Telemetry Ingest β Pillar Computation β Score 0-1000 β β
β β (35% txSuccess + 25% capital + 15% network + β β
β β 15% identity + 10% compliance) β β
β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β Layer 3 β Insurance Underwriter β
β ββββββββββββββββ ββββββββββββββββ ββββββββββββββββββββββββββββ β
β β Quote Engine β β USDC Escrow β β Parametric Claims β β
β β (dynamic β β (Base L2 β β (on-chain trigger β β β
β β premium) β β Coinbase) β β instant payout) β β
β ββββββββββββββββ ββββββββββββββββ ββββββββββββββββββββββββββββ β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β Layer 4 β Data Moat β
β ββββββββββββββββββββββββ ββββββββββββββββββββββββββββββββββββββ β
β β Behavioural Graph β β Federation (cross-registry sync) β β
β β (audit trail, β β Aggregated data licensing β β
β β PageRank, patterns)β β to enterprise customers β β
β ββββββββββββββββββββββββ ββββββββββββββββββββββββββββββββββββββ β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββQuick Start
# Clone
git clone https://github.com/hiveagentiq/hivetrust.git
cd hivetrust
# Install
npm install
# Configure
cp .env.example .env
# Edit .env with your values
# Seed sample data (optional)
node src/seed.js
# Start
npm start
# Server running on http://localhost:3001The health endpoint confirms it's live:
curl http://localhost:3001/health
# {"status":"ok","version":"1.0.0","uptime":3.14}API Reference
All endpoints are prefixed /v1 unless noted. Authentication via X-API-Key header.
Identity (KYA)
Method | Path | Description | Cost |
|
| Register a new agent (issues DID, stores public key) | $0.01 |
|
| Retrieve full agent profile + current trust tier | Free |
|
| Update agent metadata (creates immutable version snapshot) | $0.01 |
|
| Deactivate agent (adds to revocation registry) | Free |
Credentials
Method | Path | Description | Cost |
|
| Issue a W3C Verifiable Credential | $0.05 |
|
| List all credentials for an agent | Free |
|
| Revoke a credential | Free |
|
| Verify a presented credential (revocation + sig check) | $0.01 |
Trust Score
Method | Path | Description | Cost |
|
| Current composite score + pillar breakdown | $0.01 |
|
| Score over time (pagination supported) | $0.01 |
|
| Fast binary risk check β | $0.01 |
Telemetry
Method | Path | Description | Cost |
|
| Bulk behavioural event ingestion (up to 1 000 events/call) | $0.001/event |
|
| Query the agent's full audit trail | Free |
Insurance
Method | Path | Description | Cost |
|
| Dynamic premium quote (based on trust scores + value) | Free |
|
| Bind policy and deploy USDC escrow on Base L2 | 1.5% of insured value |
|
| Retrieve policy details and coverage status | Free |
|
| File a parametric claim | Free |
|
| Get claim status and payout history | Free |
claim_typenamespace note: HiveTrust'sclaim_typefield (non_delivery | fraud | sla_breach | data_loss | unauthorized_action) is distinct from the CTEF envelope-levelclaim_type(identity | transport | authority | continuity) defined in A2A CTEF v0.3.1. Both tokens coexist at disjoint envelope levels β see docs/CLAIM_TYPE_NAMESPACE.md.
Disputes
Method | Path | Description | Cost |
|
| File a dispute against a counterparty | Free |
|
| Get dispute status and evidence log | Free |
|
| Submit resolution (impacts both parties' scores) | Free |
Webhooks
Method | Path | Description | Cost |
|
| Register a webhook endpoint (HMAC-SHA256 signed) | Free |
|
| List registered webhooks | Free |
|
| Remove webhook | Free |
Federation
Method | Path | Description | Cost |
|
| Register a peer HiveTrust-compatible registry | Free |
|
| List federated peers | Free |
|
| Sync trust scores bidirectionally with a peer | Free |
System
Method | Path | Description | Cost |
|
| Health check (no auth required) | Free |
|
| Platform-wide statistics (total agents, volume, etc.) | Free |
|
| Discovery document | Free |
MCP Integration
HiveTrust exposes all core operations as MCP tools via a single JSON-RPC 2.0 endpoint at POST /mcp. This lets any MCP-compatible agent (including HiveAgent) call HiveTrust natively without REST boilerplate.
List available tools
POST /mcp
Content-Type: application/json
X-API-Key: ht_your_api_key
{
"jsonrpc": "2.0",
"id": 1,
"method": "tools/list"
}Call a tool
POST /mcp
Content-Type: application/json
X-API-Key: ht_your_api_key
{
"jsonrpc": "2.0",
"id": 2,
"method": "tools/call",
"params": {
"name": "hivetrust_get_trust_score",
"arguments": { "agent_id": "a1b2c3d4-..." }
}
}Available MCP Tools
Tool | Description |
| Register a new agent and receive a DID |
| Retrieve agent profile |
| Run a full KYA verification flow |
| Get current trust score + pillar breakdown |
| Fast binary risk check for payment gating |
| Submit behavioural events |
| Issue a W3C Verifiable Credential |
| Verify a presented credential |
| Revoke a credential |
| Get dynamic premium quote |
| Bind policy and deploy escrow |
| File a parametric insurance claim |
| Initiate a dispute resolution |
| Retrieve platform-wide statistics |
CTEF v0.3.1 Endpoint
HiveTrust is the 5th canonicalizer in the CTEF (Composable Trust Evidence Format) v0.3.1 byte-match consortium: AgentGraph + AgentID + APS + Nobulex + HiveTrust. Seat committed at the 2026-04-25 01:48 UTC freeze.
Patent applications 64/049,200 β 64/049,226, priority 2026-04-24, holder: Stephen A. Rotzin / TheHiveryIQ.
Endpoints
Route | Method | Auth | Description |
GET | Public | CTEF v0.3.1 fixture with all 4 vectors | |
| GET | Free (1st/day) | HiveTrust passport tier lookup |
| POST | 10/day free, then $0.01 USDC | Structural verification of a CTEF envelope |
| GET | Public | Ed25519 attestation pubkey for Apr 30 byte-match |
| GET | Public | Run all 4 vectors β returns pass/fail counts |
CTEF Fixture
curl https://hivetrust.onrender.com/.well-known/cte-test-vectors.json | jq '.version'
# "0.3.1"Structural Verification (POST /verify)
# First 10 requests/day per IP are free
curl -X POST https://hivetrust.onrender.com/verify \
-H 'Content-Type: application/json' \
-d '{"type":"TrustAttestation","version":"0.3.1","claim_type":"authority",...}'
# Returns: { verdict: "valid"|"INVALID_CLAIM_SCOPE"|"INVALID_COMPOSITION",
# canonical_sha256: "...", pass: true|false }Beyond 10 free requests/day, the endpoint returns HTTP 402 with an x402 payment challenge: $0.01 USDC on Base chain 8453.
Self-Test
curl https://hivetrust.onrender.com/verify/self-test | jq '.data.summary'Canonicalization
All vectors use RFC 8785 JCS β implemented inline in src/routes/cte.js. The implementation produces byte-identical output to AgentGraph's canonicalize_jcs_strict for all 4 shared test vectors:
envelope_vector SHA-256:
9e7b5031e46de38b5f90e895113a3f24f42a4128d8d99856a2d71e529b0f0d5cverdict_vector SHA-256:
feb42dca4214fc46207138d676ec727d7b3d0caa1eda8c0390d2d6f6fbc28913scope_violation_vector SHA-256:
e584f1cd0885dc938da5fc23ce7e528715a0086e5464c9ed0f3c1c82b364026fcomposition_failure_vector SHA-256:
f9cd10bc4e8bf34ce3aa6a0e5df0d27989e54ff41c4333c69ae3ecfaf8de0cb5
Revenue Model
HiveTrust operates five revenue streams:
Stream | Mechanism | Target |
KYA API Calls | $0.01 per verification call | High-frequency agent interactions |
Enterprise SaaS | $50β$500/month per operator | Compliance teams, regulated industries |
Insurance Premiums | 1.5% take rate on insured transactions | Payment agents, DeFi integrations |
Collateral Staking Yield | 3% spread on USDC collateral pool | Staked capital from high-tier agents |
Data Licensing | Aggregated behavioural insights | Enterprises, risk modellers, AI labs |
Environment Variables
Variable | Default | Required | Description |
|
| No | Server listen port |
|
| No | Node environment |
|
| Yes (prod) | Public base URL |
| β | Yes (prod) | Service-to-service auth token |
| β | Yes | HMAC secret for webhook payloads |
|
| No | HiveAgent platform URL |
| β | Yes (insurance) | Coinbase CDP key ID |
| β | Yes (insurance) | Coinbase CDP key secret |
| β | Yes (insurance) | USDC escrow contract on Base L2 |
|
| No | Base L2 RPC endpoint |
|
| No | SQLite database file path |
| β | Yes (federation) | Shared secret for peer sync |
| β | No | Comma-separated peer URLs |
|
| No | Minimum score for insurance eligibility |
|
| No | Per-transaction coverage cap |
|
| No | Base premium as fraction of insured value |
|
| No | Background score recompute frequency |
|
| No | Logging verbosity |
See .env.example for the full annotated list.
Deployment
Render (recommended for development)
# Push to GitHub, then connect the repo in the Render dashboard
# render.yaml is already configured β click "Apply"
# Or deploy manually:
render deployThe included render.yaml sets free-tier web service, auto-generates secrets, and configures all env vars.
Fly.io (recommended for production)
# Install flyctl: https://fly.io/docs/hands-on/install-flyctl/
fly auth login
fly apps create hivetrust
# Create a persistent volume for SQLite
fly volumes create hivetrust_data --region ord --size 3
# Deploy
fly deploySee fly.toml for the full configuration. Auto-stop/start is enabled to minimise costs.
Docker
# Build
docker build -t hivetrust:latest .
# Run
docker run -p 3001:3001 \
-e NODE_ENV=production \
-e INTERNAL_API_TOKEN=your_token \
-v $(pwd)/data:/app/data \
hivetrust:latestRailway
railway init
railway upSet environment variables in the Railway dashboard using .env.example as the reference.
Tech Stack
Component | Technology |
Runtime | Node.js 22 (ES Modules) |
Framework | Express 5.2.1 |
Database | SQLite via better-sqlite3 12.8.0 (WAL mode) |
Identity | Ed25519 keys (base58), DID:hive, W3C-VC |
Protocol | MCP JSON-RPC 2.0, REST, x402 |
Payments | USDC on Base L2 via Coinbase CDP |
IDs | UUID v4 throughout |
Timestamps | ISO 8601 |
SDK
JavaScript / TypeScript
npm install @hivetrust/sdkimport { HiveTrustClient } from '@hivetrust/sdk';
const trust = new HiveTrustClient('https://hivetrust.hiveagentiq.com', 'ht_your_api_key');
// Register an agent
const agent = await trust.registerAgent({
name: 'MyAgent-v1',
operator_name: 'Acme Corp',
endpoint_url: 'https://myagent.acme.example/mcp',
public_key: 'edPublicKeyBase58...',
});
// Check trust before transacting
const score = await trust.getTrustScore(agent.id);
console.log(score.score, score.tier); // 680 "elevated"
// Get insurance quote
const quote = await trust.getInsuranceQuote(agent.id, counterpartyId, 1000);
console.log(quote.premium_usdc); // 15.00See packages/npm/ for the full SDK source.
Python
pip install hivetrustfrom hivetrust import HiveTrustClient
trust = HiveTrustClient("https://hivetrust.hiveagentiq.com", "ht_your_api_key")
score = trust.get_trust_score("agent-id-here")
print(score["score"], score["tier"])See packages/python/ for the full SDK source.
License
MIT Β© 2026 HiveAgent IQ
Hive Civilization
Hive Civilization is the cryptographic backbone of autonomous agent commerce β the layer that makes every agent transaction provable, every payment settable, and every decision defensible.
This repository is part of the DEFENSIBLE pillar.
thehiveryiq.com
hiveagentiq.com
agent-card: https://hivetrust.onrender.com/.well-known/agent-card.json
Latest Blog Posts
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/srotzin/hivetrust'
If you have feedback or need assistance with the MCP directory API, please join our Discord server