P75 registry aggregation: the cross-lens join applied to agent identity.
Incumbent providers each consult only their own registry; this endpoint
checks every registry TunnelMind can reach and labels each answer with
an explicit state, so a gap can never be mistaken for a clean result:
- `observed` — the subject IS in this registry (record attached)
- `not_present` — checked, and it isn't (an observation, not a gap)
- `not_applicable` — the registry doesn't key on this subject type
- `degraded` — the check failed (timeout, upstream error)
- `unavailable` — the registry is not publicly consultable (closed /
platform-scoped); stated in-band because silence would read as clean
Registries (v0): `crawler_ranges` (operator-published IP feeds —
Googlebot, GPTBot, PerplexityBot…), `wba_directory` (RFC 9421
Signature-Agent JWKS at the subject domain), `mcp_registry`
(registry.modelcontextprotocol.io), `tunnelmind_known_agents` (curated
verifiable/claim-only set), plus honest `unavailable` rows for Visa TAP,
Mastercard Agent Pay, and Cloudflare Verified Bots.
Use this tool when:
- You are deciding whether an agent, bot, or MCP server is registered
anywhere that vouches for it — in one call instead of five.
- You need the blind spots stated: which registries could NOT be
consulted for this subject, and why.
Inputs: subject — an IP (registry membership by published ranges), a
domain (WBA directory + MCP registry), or an agent name/UA fragment
(e.g. `gptbot`, `claudebot`). `?receipt=true` attaches a signed
Receipt v1.0 committed to the transparency log.
Latency: remote registry checks are KV-cached for 1h; a warm call is
edge-fast, a cold one bounded by 5s per-registry timeouts.