Trust Tools

com.obeliskgatePublished by obeliskgate.comOfficial publisherv1.0.0Updated Oct 24, 2026

Website security ratings, token verification, and tamper-evident ledger heads from Obelisk Gate.

VerifiedStreamable HTTPWeb executableDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

A remote Obelisk Gate server for checking website trust ratings, verifying Obelisk-issued tokens and agent run proofs, and reading a signed transparency ledger.

What you can do
Scan an https URL for TLS and security-header posture and get a scored Obelisk Rating, plus an explanation of what a rating number means and what moves it. Look up the public rating, trust band and trend for a registered organization by slug. Verify a JSON Web Token was minted by Obelisk Gate and report its type, subject, assurance and principal. Verify an agent run proof token against Obelisk's published keys and delegation hops, and read an agent's public proof vector by proof id. Read the current signed transparency head of the receipt ledger and the Gate's public liveness facts.
When to use it
Useful when an assistant needs to assess a site's security posture, confirm that a token or agent run proof really came from Obelisk Gate, or check an organization's public trust rating and the ledger head before and after a change.
Requirements
A remote streamable HTTP endpoint at obeliskgate.com; no packages, environment variables or headers are declared. Network access to the endpoint is needed. Some tools take inputs such as an https URL, an organization slug, a JWT, a run proof token or a proof id.
Before you install
Tokens and proof tokens passed to the verification tools are sent to a third-party service; the tools state they never return secrets. The transparency head tool publishes no consistency proofs, so a saved head cannot prove a later head extends it. The optional narrate flag on explain_rating sends the request to a model-written narrative, though it is cached and public-scope.

Installation

In SourceWeft

  1. Open Trust Tools in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/com.obeliskgate%2Ftrust-tools/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "trust-tools": {
      "type": "http",
      "url": "https://obeliskgate.com/mcp"
    }
  }
}

Tools

8

scan_trust

Run Obelisk's public trust scan on an https URL — TLS and security-header posture, scored as an Obelisk Rating. Read-only, SSRF-guarded.

Parametersurlrequired

verify_token

Verify that a JSON Web Token was minted by this Obelisk Gate (ES256, correct issuer) and report its type, subject, assurance, and principal. Never returns secrets.

Parameterstokenrequired

get_org_rating

Read the public Obelisk Rating (0-100 score, trust band, and trend) for a registered organization by its slug.

Parametersorgrequired

verify_agent_run_proof

Verify an Obelisk run proof. Pass run_proof_token, the token Obelisk signs at POST /api/agent-proof/run: the tool checks Obelisk's signature against its published keys, that the named agent is active now with the same key that answered the run challenge, and which delegation hops matched the owner's registry when the token was signed. A bare run_proof envelope is only checked for internal consistency and is never reported as verified, because anyone can build one. Reports the envelope's commitment scheme: a legacy v1 envelope, whose hashes are unsalted, carries the warning unsalted-v1. Does not reveal or infer raw task data.

Parametersrun_proofrun_proof_tokenexpected_agent_idexpected_audience

get_agent_proof

Read an Obelisk agent's public proof vector by opaque proof id. Returns independent claims with freshness and scope; never a scalar trust score or a claim of non-humanness.

Parametersproof_idrequired

transparency_head

Read the current signed transparency head of Obelisk's tamper-evident receipt ledger. Save headAnchorHash with anchorCount and compare later: the count must never go down, and the head at a saved count must not change. No consistency proofs are published, so this cannot show a later head extends a saved one. Same data as /.well-known/obelisk-transparency.json.

Takes no parameters.

gate_status

Read the Gate's public liveness facts: issuer, served code revision, OIDC availability, and supported protocols. No posture internals.

Takes no parameters.

explain_rating

Explain what an Obelisk Rating number means: its trust band, how the public scan scores, and what typically moves a score. Deterministic by default; pass narrate:true for an additional one-line model-written narrative (cached, public-scope, never required). Pure function of the number — no data is read.

Parametersratingrequirednarrate

Version history

1
  1. v1.0.0LatestSep 16, 2026

Score

83% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.