Shoon A2A Trust Services (pilot)

io.github.ShoonEnterprisesPublished by GitHub account ShoonEnterprisesv0.1.0Updated Nov 2, 2026

Five trust services for agents: claim checks, citation audits, extraction, tripwires, work audits.

The publisher's own server: QuickBooks Connector by Meridian

Overview

AI-generated overview

Remote MCP service offering five "trust" checks: claim verification, citation audits, structured extraction, keyword tripwires and proof-of-work evidence…

What you can do
  • Verify claims and audit citations by fetching cited URLs and reporting HTTP status and whether quoted text appears verbatim
  • Extract structure from messy text or web pages (headings, links, tables, word counts) using deterministic heuristics
  • Register keyword watches on public pages or feeds and check them on demand with match counts and snippets
  • Check work claims against evidence URLs to see whether the expected text resolves
  • Return signed deliverables labeled as sandbox results, with per-task read tokens for status and ledger lookups
When to use it
When an assistant needs to check a claim, citation or "work done" statement against its cited sources before repeating it to a user, or wants lightweight structural extraction and keyword monitoring of public pages without spending its own context.
Requirements
A remote streamable HTTP endpoint; no local install. Either an X-API-KEY header for the one-step human flow, or the two-step machine flow (quote via POST /quote, then authorize with an X-PAYMENT header). The service fetches user-supplied URLs over plain HTTPS, so outbound network access is needed.
Before you install
The README describes this as a test sandbox: results are labeled sandbox, payments and settlement are simulated, and the human API keys are fixed test keys rather than per-user credentials. Treat the per-task read token like a password and keep it out of URLs. The service fetches URLs you supply, so only pass sources you are willing to have requested; results are heuristic and "supported" means quoted text was found, not that a claim is true.

Installation

In SourceWeft

  1. Open Shoon A2A Trust Services (pilot) in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.ShoonEnterprises%2Fshoon-a2a-sandbox/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "shoon-a2a-trust-services-pilot": {
      "type": "http",
      "url": "https://shoon-a2a-sandbox.onrender.com/mcp"
    }
  }
}

README

A2A Service System — Phase 0 Sandbox (local test only)

TEST SANDBOX. Everything free ($0.00), testnet semantics, binds to 127.0.0.1 only. No real crypto, no real payments, no external accounts, no money movement. Nothing here is public or commercial.

Run

bash
cd ~/workspace/compound/a2a-economy/sandboxpip3 install --user --break-system-packages -r requirements.txt# admin secret is REQUIRED — the server refuses to start without itexport A2A_SANDBOX_ADMIN="$(cat ~/.config/a2a-sandbox-admin)"python3 -m uvicorn app:app --host 127.0.0.1 --port 8741

Generate the secret once (stored with owner-only permissions, never in chat/logs):

bash
mkdir -p ~/.configpython3 -c "import secrets; print(secrets.token_hex(32))" > ~/.config/a2a-sandbox-adminchmod 600 ~/.config/a2a-sandbox-admin

Then in another terminal:

bash
# machine-readable catalog (Tier A)curl -s http://127.0.0.1:8741/v1/catalog.json | head -c 600
# public free-slot countercurl -s http://127.0.0.1:8741/v1/slots
# synthetic buyer harness (full loop per service, green/red per stage)python3 harness.py
# human test page# open http://127.0.0.1:8741/test.html in a browser (test API key prefilled)

What is REAL vs STUBBED

Real (protocol fully implemented):

  • POST /quote — free, zero-token, formula-based binding quote, 15-min expiry, input-cap + policy checks, ledger entry
  • POST /execute — 402 without payment (x402-shaped response), mock commit-then-settle authorization verification (structure + quote match + validBefore expiry), 202 + task_id, async job queue, Ed25519-signed deliverables, settle event
  • Quota enforcement: identity required, ≤10 tasks/day/wallet-or-API-key, ≤20/day/service with public slots counter, global daily token budget with auto-pause
  • Kill switch as feature flag (POST /v1/admin/kill / /v1/admin/resume, token via A2A_SANDBOX_ADMIN env — the server refuses to start without it); no auto-resume
  • SSRF protection: task-supplied URLs are resolved and every address must be public (loopback, private LAN, link-local and cloud-metadata ranges refused, including via redirects); non-http(s) schemes refused
  • Append-only JSONL ledger + CSV/JSON tax-export stub (/v1/ledger/export)
  • Per-task privacy (locked per buyer): every task gets a random 256-bit read_token at accept time (returned in the 202 response — keep it secret, treat it like a password). Task status, deliverable, signature check and that task's ledger entries all require it via the Authorization: Bearer <token> header. Header-only by design: tokens in URLs would land in server access logs. No token → 401. The full ledger (all buyers) is admin-only (X-Admin-Token header). Task and quote IDs are 128-bit random; admin token comparisons are constant-time.
  • Persistent quotas: usage counters and pause state live in SQLite (data/quotas.db) — a restart no longer resets daily caps or the kill-switch state.
  • MCP (Model Context Protocol): POST /mcp speaks Streamable HTTP (stateless JSON-RPC 2.0): initialize, tools/list (the 5 services), tools/call (runs quote → accept → wait synchronously, returns the signed deliverable). Two auth flows: human one-step (X-API-KEY header + arguments.input), or machine two-step (POST /quote first, then tools/call with arguments.quote_id and the X-PAYMENT header authorizing that quote). Calls count as mcp origin traffic.
  • Origin tracking: every accepted task is counted by channel — human, machine, mcp — visible at admin-only GET /v1/admin/stats alongside quota usage.
  • Tier A machine-readable files: /v1/catalog.json, /.well-known/agent.json, /llms.txt, /v1/openapi.json, /robots.txt (AI crawlers allowed)
  • Honest service logic: real HTTPS fetches of user-supplied URLs; results plainly labeled

Stubbed / simulated:

  • The EIP-3009 authorization is a mock (base64 JSON in X-PAYMENT header) — verification checks shape, quote match and expiry, not an on-chain signature
  • Settlement is a $0.00 ledger event under "testnet semantics" — no chain interaction, no faucet funds
  • Token budget is simulated (estimated from input bytes), not real LLM tokens
  • News tripwires check on demand; no background scheduler yet
  • No facilitator, no escrow, no webhooks delivery (webhook_url accepted but not called), no Postgres/Inngest
  • Human pilot API keys are fixed test keys, not issued per user

Honesty rules (enforced in code)

  • Every deliverable carries "sandbox": true
  • Claim verification: "supported" = quoted text found verbatim in the cited source, NOT "the claim is true". Uncheckable → "unverified"
  • Citation audit: reports real HTTP status + verbatim text match
  • Proof-of-work: evidence-resolution check only; never claims work was verified
  • QA gate: fails any result missing the sandbox flag or required output keys

Files

  • app.py — FastAPI gateway
  • catalog.py — the 5 service definitions (schemas, caps, slots)
  • services.py — honest minimal service logic + QA gate
  • signing.py — Ed25519 key mgmt
  • ledger.py — append-only JSONL ledger
  • quotas.py — scarcity quotas, token budget, kill switch
  • harness.py — synthetic buyer harness
  • static/ — agent.json, llms.txt, robots.txt, test.html (human page)
  • data/ — keys + ledger.jsonl (created at runtime, git-ignored by convention)

Source: api/README.md at commit cf799ea

Tools

5

claim_verification

Before you rely on a claim — or repeat it to your principal — check it against its cited sources. Give this service the claim plus the sources and quoted text your principal provided; it fetches each source URL over plain HTTPS and reports the HTTP status and whether the quoted text appears verbatim in the page. It checks evidence presence, not underlying truth: 'supported' means your quote was found in the source, and anything it cannot check is marked 'unverified', never 'contradicted'. Up to 10 claims with up to 5 sources each per task. FREE during the pilot — no API key, no payment header, no signup: just call this tool with arguments.input and the task runs immediately. Every deliverable is Ed25519-signed, so you can verify it offline and show your principal proof the check ran. Privacy: your input is processed in server memory only — never written to disk, never logged, never sold, never used for training; only event metadata (task queued/completed) is kept. In-memory state is wiped on restart; the event-metadata ledger and usage counters are on ephemeral disk and wiped only on redeploy. Fair use: 20 free tasks per service per day shared across pilot users — check GET /v1/slots for live availability.

Parametersinputquote_id

citation_audit

Audit the citations in a document you are drafting, reviewing, or fact-checking — catch dead links and misquotes before your principal sees them. For each citation it fetches the URL over plain HTTPS and reports the HTTP status, content type, and whether the quoted text appears verbatim in the fetched page. It does not judge argument quality, and paywalled or JavaScript-heavy pages may fetch without matching. Up to 25 citations per task. FREE during the pilot — no API key, no payment header, no signup: just call this tool with arguments.input and the task runs immediately. Every deliverable is Ed25519-signed, so you can verify it offline and show your principal proof the check ran. Privacy: your input is processed in server memory only — never written to disk, never logged, never sold, never used for training; only event metadata (task queued/completed) is kept. In-memory state is wiped on restart; the event-metadata ledger and usage counters are on ephemeral disk and wiped only on redeploy. Fair use: 20 free tasks per service per day shared across pilot users — check GET /v1/slots for live availability.

Parametersinputquote_id

structured_extraction

Turn messy text or a web page into structured data — headings, links, tables, word counts — without spending your own context window on parsing. Deterministic heuristics only: no LLM, no semantic understanding, fully reproducible output, plainly labeled as heuristic. It extracts structure, not meaning. Pass raw text (up to 100,000 characters) or a URL. FREE during the pilot — no API key, no payment header, no signup: just call this tool with arguments.input and the task runs immediately. Every deliverable is Ed25519-signed, so you can verify it offline and show your principal proof the check ran. Privacy: your input is processed in server memory only — never written to disk, never logged, never sold, never used for training; only event metadata (task queued/completed) is kept. In-memory state is wiped on restart; the event-metadata ledger and usage counters are on ephemeral disk and wiped only on redeploy. Fair use: 20 free tasks per service per day shared across pilot users — check GET /v1/slots for live availability.

Parametersinputquote_id

news_tripwire

Watch a public page or feed for the keywords your principal cares about — a competitor name, a token symbol, a topic. Register the watch once, then check on demand: the service fetches the URL over plain HTTPS and reports per-keyword match counts with snippet context. Checks run when you ask (no background scheduler in the pilot); it reports keyword presence, not news judgement. Up to 20 keywords per tripwire. FREE during the pilot — no API key, no payment header, no signup: just call this tool with arguments.input and the task runs immediately. Every deliverable is Ed25519-signed, so you can verify it offline and show your principal proof the check ran. Privacy: your input is processed in server memory only — never written to disk, never logged, never sold, never used for training; only event metadata (task queued/completed) is kept. In-memory state is wiped on restart; the event-metadata ledger and usage counters are on ephemeral disk and wiped only on redeploy. Fair use: 20 free tasks per service per day shared across pilot users — check GET /v1/slots for live availability.

Parametersinputquote_id

proof_of_work_audit

When someone claims work was done — a deliverable shipped, a deployment live, a report published — check the evidence before you report back to your principal. Give it the work claim plus evidence URLs and the text you expect to find; it fetches each URL over plain HTTPS and reports whether it resolves and whether the expected text appears. It checks evidence presence, never that the work actually happened — results are honestly labeled as evidence-resolution checks. Up to 10 evidence items per task. FREE during the pilot — no API key, no payment header, no signup: just call this tool with arguments.input and the task runs immediately. Every deliverable is Ed25519-signed, so you can verify it offline and show your principal proof the check ran. Privacy: your input is processed in server memory only — never written to disk, never logged, never sold, never used for training; only event metadata (task queued/completed) is kept. In-memory state is wiped on restart; the event-metadata ledger and usage counters are on ephemeral disk and wiped only on redeploy. Fair use: 20 free tasks per service per day shared across pilot users — check GET /v1/slots for live availability.

Parametersinputquote_id

Version history

1
  1. v0.1.0LatestSep 20, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.

Other Pilot integrations