Mifori CertAgent Trust Oracle

io.github.manuel-cubikoPublished by GitHub account manuel-cubikov1.0.0Updated Oct 25, 2026

Live AI agent trust oracle: audit synthetic IQ, latency & JSON compliance via x402 or free tokens.

VerifiedStreamable HTTPWeb executableSecurity & MonitoringAI & ML

Overview

AI-generated overview

A remote trust oracle that lets an assistant audit AI agents and MCP servers for reputation, latency and protocol compliance, and look up signed certificates.

What you can do
Run live multi-protocol audits of an agent endpoint, probing MCP JSON-RPC, server cards, A2A cards and challenge-response endpoints, with static REST URLs rejected as non-agents. Submit feedback, score disputes or sandbox credit requests, which returns a free single-use audit credit token. Query a free leaderboard of verified MCP servers and agents ranked by Synthetic IQ and latency. Retrieve and cryptographically validate a signed audit certificate by evaluation ID, or list an agent's public audit history.
When to use it
Useful when you need to check whether an AI agent or MCP server is trustworthy before relying on it, compare agents by measured quality and latency, or verify a signed audit certificate someone presents.
Requirements
A remote endpoint at agent.mifori.com over streamable HTTP; no authentication, API keys or environment variables are declared. The target agent must expose a supported agent protocol rather than a plain REST URL.
Before you install
The audit tool actively probes a target endpoint you supply, so only point it at systems you are authorized to test. Feedback submissions persist data and grant credit tokens; certificates marked private are retrievable by evaluation ID, so treat those IDs as sensitive.

Installation

In SourceWeft

  1. Open Mifori CertAgent Trust Oracle in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.manuel-cubiko%2Fmifori-cert-agent/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "mifori-certagent-trust-oracle": {
      "type": "http",
      "url": "https://agent.mifori.com/mcp"
    }
  }
}

Tools

4

verify_agent_reputation

Verify Agent Reputation (Multi-Protocol Audit)

Executes a live multi-protocol audit against target_bot_url (supporting MCP JSON-RPC 2.0 initialize + tools/list + execution probe over HTTP/SSE, SEP-1649 MCP Server Cards, Google A2A Agent Cards, and Mifori Cognitive challenge-response endpoints; non-agent static REST URLs are strictly rejected with 0 points) to benchmark Synthetic IQ (0-100), steady-state latency, JSON schema compliance, and verified tool capabilities, returning an Ed25519 asymmetrically signed certificate (eval_id). Pass public=false to run a private/confidential audit that returns a signed certificate without publishing target_bot_url to the public leaderboard. Two-step parameter workflow: (1) call with target_bot_url alone (omitting payment_proof) for a free PAYMENT_REQUIRED_402 quote, or call submit_agent_feedback with eval_id='sandbox' to obtain a free single-use 'mfr_fbk_...' credit token without needing a prior dispute; (2) invoke with payment_proof set to a 'mfr_fbk_...' token or a verified $0.005 Base Mainnet USDC transaction hash ('0x...').

Parameterspublicagent_idpayer_walletpayment_prooftarget_bot_urlrequiredtarget_bearer_token

submit_agent_feedback

Submit Telemetry or Request Free Sandbox Audit Credit

Persists machine-to-machine telemetry, score disputes, or initial sandbox credit requests in <100ms with no authentication or payment required, immediately granting 1 free single-use audit credit token ('mfr_fbk_...'). First-time evaluators without a prior audit or dispute can pass eval_id='sandbox' (or 'onboarding') and describe their intended evaluation in reported_issue to receive a legitimate free reward_token for verify_agent_reputation without fabricating a complaint.

Parameterseval_idrequiredreported_issuerequiredsuggested_metric

get_agent_leaderboard

Search & Get Verified Agent Leaderboard

Queries a free, unauthenticated snapshot of verified MCP servers and autonomous AI agents deduplicated by endpoint and ordered by Synthetic IQ descending (0-100) and round-trip latency ascending (ms). Each entry includes protocol_detected ('MCP 2.0', 'Mifori Cognitive v1', etc.) and verified_capabilities (listing verified MCP tool names and server versions). Pass query (e.g. 'wiki', 'search', 'cloudflare', 'crypto', 'docs') to filter agents by tool capability, DID, or domain, and optionally filter by tier ('AAA', 'AA', 'B', 'REJECTED').

Parameterstierlimitquery

get_agent_certificate

Get Agent Audit Certificate & History

Retrieves and cryptographically validates a signed audit certificate by eval_id (including private certificates created with public=false) or lists chronological public audit history for an agent_id in <50ms with no authentication, payment, or rate limits. Pass eval_id alone for an exact single-certificate lookup with asymmetric Ed25519 signature verification against Mifori's public key (/.well-known/jwks.json), or pass agent_id (a DID or target_bot_url) with limit (1-50, default 10) to inspect historical evaluations.

Parameterslimiteval_idagent_id

Version history

1
  1. v1.0.0LatestOct 15, 2026

Score

83% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.