io.github.trustscoreagent/mcp-server

TrustScoreAgent

Free, open reputation registry for AI microservices. Agents check trust scores before calling any service.

Status: Phase 1 (early). The API, scoring (Beta + EigenTrust), receipt verification, Merkle audit trail and MCP server are implemented and tested, but the public dataset is still small (seeded by a transparent probe of public APIs and x402 endpoints), and parts of the design (x402 payments, mandatory agent signatures) are Phase 2. We publish early and openly on purpose: the trust layer for the agentic economy should exist, be auditable, and be adoptable before it becomes critical. See the trust model in SECURITY.md.

What is this?

AI agents increasingly rely on paid microservices. TrustScoreAgent lets any agent:

• Check the reputation of a service before calling it
• Rate a service after calling it
• Discover which services are reliable

No account needed. No API key. Identify services by URL, domain, or DID.

Quick start

# Check a service's trust score (any format works)
curl "https://api.trustscoreagent.com/v1/score?service=api.example.com"
curl "https://api.trustscoreagent.com/v1/score?service=https://api.example.com/v1/translate"

# Unknown services return a neutral score (0.5), no errors
curl "https://api.trustscoreagent.com/v1/score?service=never-seen-before.com"

# Rate a service after calling it
curl -X POST "https://api.trustscoreagent.com/v1/rate" \
  -H "Content-Type: application/json" \
  -H "X-Agent-DID: my-agent.example.com" \
  -d '{
    "service": "api.example.com",
    "metrics": {
      "status_code": 200,
      "latency_ms": 143,
      "schema_valid": true
    }
  }'

# List top-rated services
curl "https://api.trustscoreagent.com/v1/services?sort_by=score&min_ratings=10"

Local development

# Start PostgreSQL and Redis
docker compose up -d

# Run the API
dotnet run --project src/TrustScore.Api

# Run tests
dotnet test

# Swagger UI
open http://localhost:5000/swagger

Architecture

• C# / .NET 8: ASP.NET Core Minimal API
• PostgreSQL: Ratings and service scores
• Redis: Score caching, rate limiting, nonce tracking
• Beta Reputation System: Bayesian scoring (per-dimension: availability, latency, conformity)
• EigenTrust: Anti-Sybil agent trust scoring
• Merkle Tree: Audit log with inclusion and consistency proofs (RFC 6962 tree; each leaf commits to what the rating reported)
• Ed25519 Receipt Verification: Cryptographic proof of service interaction
• MCP Server: Integration with Claude, Cursor, and MCP-compatible agents

API Reference

Core (free, always)

Premium (free for now, x402 micropayments later)

Service identification

All endpoints accept services in any format (they are normalized internally):

• api.example.com (domain)
• https://api.example.com/v1/translate (URL)
• did:web:api.example.com (DID)

All three resolve to the same service.

MCP Server

TrustScoreAgent is available as an MCP server for Claude, Cursor, and other agents.

# Add to Claude Code
claude mcp add trustscoreagent -- npx -y @trustscoreagent/mcp-server

Before paying an x402 endpoint, check_reputation with the pay_to of the 402 you received says whether that payee is the one the registry has seen there. See docs/mcp.md for full setup instructions. Also listed on the official MCP Registry (io.github.trustscoreagent/mcp-server), npm, Smithery and Glama; each GitHub release attaches an .mcpb bundle for Claude Desktop.

x402 plugin

@trustscoreagent/x402 plugs into the x402 client SDK (@x402/core, used by @x402/fetch and @x402/axios). Before each payment it checks the payee against the one the registry saw on that endpoint and stops the payment on a mismatch, before anything is signed.

const guard = trustScoreGuard();
guard.attach(client, http);
const fetchWithPayment = wrapFetchWithPayment(guard.wrapFetch(fetch), http);

The score alone never blocks unless you set minScore, an unreachable registry never blocks unless you set failClosed, and rating after payment is opt-in (rate: true). It runs in your agent: requests never go through TrustScoreAgent. See x402-plugin/README.md.

Framework integrations

Drop-in tools for agent frameworks (no account or API key needed):

• LangChain: from trustscoreagent_langchain import get_trustscoreagent_tools
• CrewAI: from trustscoreagent_crewai import get_trustscoreagent_tools

Each exposes trustscore_check_reputation, trustscore_submit_rating, and trustscore_list_services. See integrations/.

Documentation

• API Reference
• Examples & Recipes
• Receipt Standard
• MCP Server Setup: Claude, Cursor, Windsurf
• x402 plugin: check the payee before paying
• Why Trust Matters for Agents
• Privacy & Data Handling
• Audit Log Specification, with an independent verifier in tools/verify-proof

Contributing

Contributions are welcome: see CONTRIBUTING.md and our Code of Conduct. To report a vulnerability, follow SECURITY.md.

Project status & trust model

TrustScoreAgent is Phase 1 (early). What that means in practice:

• Baseline data is real and auditable. Initial scores come from a transparent operated probe (did:web:trustscoreagent.com:probe) that measures the availability, latency and conformity of a curated list of public, free APIs, and of the x402 endpoints agents pay the most (picked daily from the public Bazaar catalog and probed without paying, see docs/x402-probe.md): real, Merkle-audited measurements, not fabricated numbers. For those x402 endpoints the score also says which payee address and price they ask for, and when either last changed. Community and receipt-verified ratings accumulate on top. (The earlier fictitious *.example.com seeds have been removed.)
• Single operator. Neutrality currently rests on open-source scoring code and a verifiable Merkle audit trail, not on decentralization. Federation is a later phase.
• Agent identity can be proven, but is not yet mandatory. Agents identified by a did:key sign each rating with their Ed25519 key (X-Agent-Signature), which binds the rating to the holder of that key. Unsigned ratings still count at half weight so existing clients keep working, which means a rating is only as attributable as its signature. Verified service receipts remain the strongest signal.

See SECURITY.md for the full trust model and how to report vulnerabilities.

License

Apache-2.0. See LICENSE.