trustscoreagent/trustscoreagent

Free, open reputation registry for AI microservices. Agents check trust scores before calling any service.
> **Status: Phase 1 (early).** The API, scoring (Beta + EigenTrust), receipt verification,
> Merkle audit trail and MCP server are implemented and tested, but the public dataset is
> still small (seeded by a transparent probe of public APIs), and parts of the design
> (x402 payments, *mandatory* agent signatures) are Phase 2. We publish
> early and openly on purpose: the trust layer for the agentic economy should exist, be
> auditable, and be adoptable *before* it becomes critical. See the trust model in
> SECURITY.md.
What is this?
AI agents increasingly rely on paid microservices. TrustScoreAgent lets any agent:
- **Check** the reputation of a service before calling it
- **Rate** a service after calling it
- **Discover** which services are reliable
No account needed. No API key. Identify services by URL, domain, or DID.
Quick start
Local development
Architecture
- **C# / .NET 8**: ASP.NET Core Minimal API
- **PostgreSQL**: Ratings and service scores
- **Redis**: Score caching, rate limiting, nonce tracking
- **Beta Reputation System**: Bayesian scoring (per-dimension: availability, latency, conformity)
- **EigenTrust**: Anti-Sybil agent trust scoring
- **Merkle Tree**: Audit log with inclusion and consistency proofs (RFC 6962 tree; each leaf commits to what the rating reported)
- **Ed25519 Receipt Verification**: Cryptographic proof of service interaction
- **MCP Server**: Integration with Claude, Cursor, and MCP-compatible agents
API Reference
Core (free, always)
| Endpoint | Description |
|----------|-------------|
| GET /v1/score?service= | Trust score for a service (0.5 neutral for unknown) |
| POST /v1/rate | Submit a rating after calling a service |
| GET /v1/services | List rated services (pagination, sorting, filtering) |
| GET /v1/agent/trust?did= | Check your agent's trust score |
| GET /v1/audit/root | Latest Merkle tree root |
| GET /v1/audit/proof/{id} | Inclusion proof for a rating, with the fields it commits to |
| GET /v1/audit/anchors | History of anchored roots |
| GET /v1/audit/consistency?from=&to= | Proof that a later root extends an earlier one |
| GET /v1/audit/anchors/{id}/ots | OpenTimestamps proof that the root is committed in Bitcoin |
| GET /v1/stats?days= | How much the registry is used (aggregate counts) |
Premium (free for now, x402 micropayments later)
| Endpoint | Description |
|----------|-------------|
| GET /v1/score/history?service= | Daily aggregated score history |
| GET /v1/score/detailed?service= | Latency percentiles, quality distribution |
| POST /v1/scores/bulk | Up to 100 scores in one request |
Service identification
All endpoints accept services in any format (they are normalized internally):
- api.example.com (domain)
- https://api.example.com/v1/translate (URL)
- did:web:api.example.com (DID)
All three resolve to the same service.
MCP Server
TrustScoreAgent is available as an MCP server for Claude, Cursor, and other agents.
See docs/mcp.md for full setup instructions. Also listed on the