ai.djzsPublished by djzs.aiOfficial publisherv1.0.0Updated Oct 24, 2026
Deterministic pre-execution audit for trading agents. PASS/WAIT/FAIL, reproducible verdict_hash.
Audits a trading agent's stated reasoning before capital is committed, returning PASS, WAIT or FAIL with flagged defects and a reproducible hash.
Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.
Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.
Read https://sourceweft.com/mcp/ai.djzs%2Ftrust-mcp/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.Add this to your client's mcpServers config.
{
"mcpServers": {
"djzs-trust": {
"type": "http",
"url": "https://mcp.djzs.ai/mcp"
}
}
}DJZS audits the reasoning behind an autonomous agent's move before capital is committed, and returns one of three verdicts PASS, WAIT, or FAIL with the specific reasoning defects flagged and a reproducible hash of the decision.
The wedge: transaction-security tools answer "is this transaction safe to sign?". DJZS answers a different question "should this position be taken at all?". A perfectly safe transaction can still rest on broken reasoning; DJZS is the layer that catches the bad thesis.
verify_pm_trade is deployed as a Model Context Protocol tool (streamable HTTP) on a
Cloudflare Worker. Add it to an MCP-capable agent in one line:
Then call verify_pm_trade with a free-text prediction-market trade thesis. It extracts the
reasoning, audits it against the calibrated DJZS-M taxonomy, and returns
PASS → PROCEED / FAIL / WAIT → HALT, with the flagged defects and a verdict_hash.
First external audit on record. An outside agent audited a benchmark thesis
(pm-block-008) through the deployed tool and received:
Behavioral parity against the offline batteries (verdict + flags + extracted input) is green. Hash parity is a pending re-mint the calibration key lapsed during deployment so the live hash above stands as the record until it is re-run.
Beyond the MCP transport above, verify_pm_trade is now payable over the HTTP x402
transport, live on Base mainnet:
An unpaid request returns an HTTP 402 challenge (exact scheme, eip155:8453, USDC, 2.00
USDC to the treasury); the client signs an EIP-3009 authorization and retries. This is the
same rail Base MCP, MetaMask Agent Wallet, and x402-axios speak, so any HTTP x402
client can pay the gate directly - no MCP integration required.
Free-refusal is preserved on both transports: an out-of-scope intent is answered 402 and never settled, so a refused audit costs nothing. Verified end to end on Base Sepolia (paid settlement plus an on-chain zero-delta refusal) before the mainnet deploy.
DJZS separates the model-bound step from the trusted step:
Why this shape: the verdict rules are model-independent. The LLM only turns messy text into a structured struct; the audit rules that decide the verdict are frozen code. Swap the model and the extraction quality changes the rules, weights, and hash do not.
Determinism by construction. The same AuditInput always yields the same verdict and the same
hash:
WAIT is never silent. An under-specified thesis — one where a decision-critical fact is
unknown — resolves to WAIT, mapped to HALT for the caller, with unknown_fields returned so
the agent knows exactly what to clarify. Abstention is a first-class outcome, never a guessed
PASS or FAIL.
DJZS-PM-v1.0) the calibrated, live pathWeights sum to 100; FAIL threshold 25. All four codes are implemented and calibrated.
M04 is advisory-grade. On its own it does not block a lone M04 rides a PASS with the flag on the certificate (weight 15 is below the FAIL threshold). It contributes to a block only by stacking with another finding (e.g. M03 + M04 = 40 → FAIL, as in the first audit above).
verify_pm_trade is PM-only: if the intent does not extract as a prediction-market thesis
(including the undetermined case), it returns in_scope: false rather than silently running a
perpetuals audit.
DJZS-LF-v1.1)Weights sum to 200. The taxonomy is frozen at 11 codes; 3 are wired live in the engine today (marked ●). The rest are defined and weighted but not yet firing — coverage is stated honestly rather than implied.
Both weight tables are hash-locked (WEIGHTS_HASH / TAXONOMY_HASH, and the PM equivalents, are
exported constants); changing a weight is a deliberate re-derive, not a hot patch.
The deployed Worker exposes three tools over streamable HTTP at /mcp:
What the tool does not do yet — recorded deliberately, to be re-ruled before the gate is broadly promoted:
verify_pm_trade returns a verdict_hash but does not yet
anchor a certificate. Existing Irys certificates are prior-architecture lineage, not output of
this tool.The response contract today is: verdict, action, risk_score, flags, unknown_fields,
disagreements (the per-field sample-agreement telemetry), verdict_hash, extraction_failsafe,
in_scope, and taxonomy versions.
failCount counts WAIT as FAILquery_agent_trust excludes WAIT verdicts from both sides of the fail rate and reports them as
wait_count. Anyone reading the subgraph directly, rather than through the tool, gets a
different answer. djzs-subgraph/src/trust-score.ts handleScoreUpdated increments
failCount on an else branch (verdict == "PASS" / else), so a WAIT — an abstention, not a
failure — lands in failCount and inflates the rate for any agent that ever received one.
The Worker recomputes from per-audit verdicts, so the tool is right. The indexed counters are
not, and they stay that way until the mapping is corrected and re-indexed. Both numbers are
returned side by side (subgraph_counters, labelled) so the discrepancy is visible rather than
discovered. Tracked as a follow-up; deliberately not folded into the read-layer fix, because a
mapping change needs a subgraph redeploy and a re-index.
Before the MCP gate, DJZS ran as a paid HTTP audit service. Those endpoints remain for
backward compatibility the MCP gate above is the current surface. The tiers are metered in
USDC on Base Mainnet via an x-payment-proof header:
POST /api/audit aliases the Micro tier, and an escrow-settled variant (POST /api/audit/escrow)
takes on-chain escrow in place of a payment header. These tiers run the older detection path, not
the Architecture C engine — treat their output as legacy.
The A2A manifest (agent.json) attests four DJZS contracts on Base Mainnet, each marked
verified. Source for each lives in contracts/:
Addresses are as recorded in agent.json; verify any of them on BaseScan.
A fifth contract, contracts/DJZSProofOfLogicNFT.sol, exists as source only — it is not in the
deployed manifest, and this document makes no claim that certificate NFTs are live or mintable.
Prior ProofOfLogic certificates live on the Irys datachain and are readable via the
query_pol_certificates MCP tool. They are prior-architecture lineage, not output of
verify_pm_trade.
The commit history is the product's own audit trail: each verdict-bearing change ships with a
PENDING note naming what is still unproven, and the next commit that closes it discharges that
note explicitly. Every claim a recall number, a parity result, a live verdict hash — is cited to
a specific run at the moment it is pushed, not asserted after the fact. If you want to know what is
proven versus deferred, git log is the source of truth and this file is downstream of it.
These are configured outside the repository. They are recorded here because nothing in the tree enforces them, and a silent revert would change live behaviour with no diff to point at.
A 403 with server: cloudflare and a text/plain body reading error code: 1010 is always the
edge, never the Worker. The Worker reads user-agent in exactly one place — a telemetry INSERT
— and never blocks on it.
server/engine-v2/ — Architecture C: deterministic-engine.ts (the frozen decider),
extraction-layer.ts (N=3 consensus extraction), audit-input-schema.ts, hash.ts, and the
calibration/ bench + scorer.shared/audit-schema.ts — the DJZS-LF perpetuals taxonomy (source of the table above).shared/pm-taxonomy.ts — the DJZS-M prediction-market taxonomy.djzs-trust-mcp/ — the Cloudflare Worker: the MCP server and the verify_pm_trade tool,
importing the engine and shared taxonomies frozen via a build alias.server/ (older tiers) — the prior HTTP audit path and its ProofOfLogic / settlement plumbing,
retained for backward compatibility. Its legacy detection tier historically used a Venice-hosted
model; the Architecture C path does not depend on it.The deterministic core runs with zero external dependencies. The extraction step is the only model-bound component, isolated to a single swappable function.
Source: README.md at commit b4ef33c
Query DJZS ProofOfLogic Certificates
Query immutable ProofOfLogic certificates stored on Irys Datachain by DJZS Protocol. USE THIS TOOL when you need to verify audit history for an agent or project before delegating work, check FAIL verdicts, or retrieve certificates by Irys tx ID. DO NOT use for on-chain trust scores — use query_agent_trust for those.
tierlimitto_msfrom_msverdicttargetSystemQuery DJZS Agent Trust Score
Query an agent's DJZS trust score, aggregated on-chain (Base mainnet) from its audit history and indexed via the DJZS subgraph. USE BEFORE delegating work, releasing escrow, or executing agent transactions. Returns scored_audits, pass/fail counts, the raw fail rate, and a Wilson 95% lower bound on it, plus latest verdict/risk and DJZS-S01/DJZS-X01 flag counts. WAIT verdicts are abstentions: they are excluded from BOTH the numerator and the denominator of the fail rate and are reported separately as wait_count. Below 10 scored audits the tool returns INSUFFICIENT_HISTORY and NO rate - a 0-of-0 record is not evidence of reliability and must not compare as better than a 3-of-50. This tool returns evidence, not a decision: it applies no threshold and emits no HALT. Interpreting the bound against your own risk tolerance is the caller's job.
agentAddressrequiredVerify Prediction-Market Trade Thesis (DJZS pre-execution audit)
Deterministic pre-execution audit of a prediction-market trade thesis, run before capital is committed. USE THIS TOOL before opening, sizing, or increasing any prediction-market position, and whenever a user or an upstream agent asks whether a thesis is sound, carries a falsification condition, or has a sourced probability basis. Audits against the calibrated DJZS-M taxonomy (M01 narrative/resolution gap, M02 falsification absent, M03 probability unsourced, M04 consensus-as-edge advisory) and returns PASS->PROCEED, WAIT->HALT, or FAIL with the flagged defects and a reproducible verdict_hash. DO NOT use to retrieve past verdicts or certificates - use query_pol_certificates for those. DO NOT use for an agent's historical trust score - use query_agent_trust for that. DO NOT use for spot, perpetuals, or equities: out-of-scope submissions are refused WITHOUT CHARGE. Audit before act. Paid tool: 2 USDC per audit via x402 on Base.
intentrequiredagent_addresstarget_systemtarget_system_subjecttarget_system_signatureVerify Perpetual / Spot Trade Thesis (DJZS pre-execution audit)
Deterministic pre-execution audit of a perpetual or spot TRADE thesis (direction, size, leverage, entry, stop, target, venue, and the REASON), run before capital is committed. USE THIS TOOL before opening, sizing, or increasing any perpetual or spot position. Returns PASS / WAIT / FAIL with a reproducible verdict hash. A position stated with no thesis FAILS (DJZS-S01); an unbounded position FAILS (DJZS-X01); an unresolvable stop or thesis WAITs. Prediction-market bets are refused here (use verify_pm_trade) and are not charged. Price 2.00 USDC per audit on Base.
intentrequiredagent_addresstarget_systemtarget_system_subjecttarget_system_signature90% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
Declare a license in the repository or the registry entry.
claude mcp add --transport http djzs-trust https://mcp.djzs.ai/mcpverdict: FAILflags: DJZS-M03 (PROBABILITY_UNSOURCED), DJZS-M04 (CONSENSUS_NO_EDGE)risk_score: 40disagreements: []verdict_hash: 0x85918814b3dffa31b00d6892c2e00b2001efd35f7e0044b4cd3789fe1df14937POST https://mcp.djzs.ai/x402/verifyfree-text intent │ ▼EXTRACTION (LLM, N=3 consensus) reports observable FACTS, never a verdict · per-field state unanimity across the 3 samples; any disagreement → unknown · quote gates: a claimed "absent" must quote the intent verbatim, or it demotes to unknown · evidence-unanimity: a critical-driving "absent" needs the same quote across all samples │ ▼AuditInput (each fact is tri-state: present / absent / unknown) │ ▼DETERMINISTIC ENGINE (pure code — no model, no network, no clock) rules fire → weighted score → verdict │ ▼PASS · WAIT · FAIL + verdict_hashverdict_hash = sha256(canonicalize({ verdict, risk_score, flags: codes.sorted(), unknown_fields }))