Ai Vendor Data Trust Index

io.github.oscarlopez-gifPublished by GitHub account oscarlopez-gifv0.1.0Updated Oct 24, 2026

Source-cited data-handling comparison of 11 AI vendors: training, retention, opt-out.

VerifiedStreamable HTTPWeb executableSecurity & MonitoringAI & ML

Overview

AI-generated overview

Remote MCP server giving source-cited answers on how 11 AI vendors handle your data: training on inputs, retention and opt-out.

What you can do
Get a plain-language, cited verdict on one vendor's data handling, including training, retention and opt-out fields, with quotes, source URLs, confidence and check dates; ambiguous cases are marked unclear rather than guessed. Compare a single data-trust field, such as whether a vendor trains on your inputs, across all tracked vendors with citations. Retrieve the full cited record for one vendor through a paid tool. Vendors covered include OpenAI, Anthropic, Google Vertex and Gemini, Azure OpenAI, AWS Bedrock, Microsoft 365 Copilot, GitHub Copilot, Mistral and Meta Llama.
When to use it
Useful when choosing or comparing AI providers and you want quick, quotable evidence on their data-handling policies, or when an assistant needs to answer questions about training on inputs, retention or opt-out with citations.
Requirements
A remote streamable-HTTP endpoint; no local runtime, account, API key or header is declared. The full-record tool is paid and requires an x402-style payment challenge response.
Before you install
The full vendor record tool is paid, so using it may cost money. The README describes the payment flow as a mock x402 implementation and real settlement as not yet built, so payment behavior may be unreliable. Values are policy summaries, not legal advice, and the index covers only 11 vendors.

Installation

In SourceWeft

  1. Open Ai Vendor Data Trust Index in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.oscarlopez-gif%2Fai-vendor-data-trust-index/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "ai-vendor-data-trust-index": {
      "type": "http",
      "url": "https://trust.oscar-lopez.com/mcp"
    }
  }
}

README

AI Vendor Data-Trust Index

[License: MIT] [Data: CC BY 4.0] [MCP]

A source-cited record of how AI products handle your data — whether the vendor trains on your inputs, whether zero data retention is available, and whether you can opt out — across 11 products (OpenAI, Anthropic, Google Vertex & Gemini, Azure OpenAI, AWS Bedrock, Microsoft 365 Copilot, GitHub Copilot, Mistral, Meta Llama). Every value carries a verbatim quote from the vendor's live policy, a source URL, a confidence level, and the date it was checked. Ambiguous cases are marked unclear rather than guessed. An automated verifier re-checks the policies weekly and only publishes a value when a verbatim quote supports it — otherwise it holds the last human-verified value.

For AI agents (MCP)

This is a remote MCP server (streamable-http). Add it to your MCP client:

json
{  "mcpServers": {    "ai-vendor-data-trust": {      "type": "streamable-http",      "url": "https://trust.oscar-lopez.com/mcp"    }  }}

Tools: get_ai_vendor_trust_headline (free — verdict + cited fields for one vendor), get_ai_vendor_trust_compare (free — one field across all vendors), get_ai_vendor_trust (paid, x402 — full cited record). Vendor IDs: openai-api, openai-consumer, anthropic-api, google-vertex, google-gemini-consumer, microsoft-copilot, azure-openai, aws-bedrock, mistral-api, meta-llama, github-copilot.

Endpoints

Free (CORS-enabled):

  • GET /v1/ai-trust/headline?vendor=openai-api — verdict + 3 cited headline fields
  • GET /v1/ai-trust/compare?field=trains_on_your_data — one field across all vendors

Paid (mock x402 — 402 challenge → echo {resource,nonce,mac} in X-PAYMENT):

  • GET /v1/ai-trust/vendor?vendor=openai-api — full cited record
  • GET /v1/ai-trust/all — bulk export

Other: POST /mcp (JSON-RPC: 2 free tools + 1 paid), GET /openapi.json, GET /.well-known/x402, GET /admin/config?key=<STATS_TOKEN> (config lever).

Deploy

bash
cd ai-trust-indexnpm installnpm run db:create                 # → paste the returned database_id into wrangler.jsoncnpm run schema:remote             # create tables (drops existing)npm run seed:remote               # load the 6-vendor provisional seednpx wrangler deploy --dry-run --outdir dist   # verify build (no auth)npm run deploy                    # deploy the Worker# In Cloudflare: add custom domain trust.oscar-lopez.com to this Worker.# Set real secrets before public use:npx wrangler secret put MOCK_PAYMENT_SECRETnpx wrangler secret put STATS_TOKEN

Verifier (v1) — automated weekly re-check

Pipeline in src/verifier.ts: fetch each vendor's pinned policy URLs → content-hash diff (skip if unchanged) → model extraction of {value, quote} (Workers AI by default; frontier via AI Gateway if configured) → verbatim quote-verification (the candidate quote must be a literal substring of the fetched source, else rejected) → confidence gate. Only a quote-verified DEFINITE value auto-publishes (verified_by='auto'); anything else is queued in review_queue and the last good published value is held (never auto-downgraded to unclear). A failed fetch holds the last good value and flags the URL. Runs weekly via cron (0 12 * * 1) and on demand.

Admin endpoints (key-gated by STATS_TOKEN):

  • GET /admin/verify?key=…[&force=1][&vendor=ID] — run the verifier now
  • GET /admin/review?key=… — list open review-queue candidates
  • GET /admin/review-resolve?key=…&id=N&action=approve|reject — approve (publishes as human) or reject
  • GET /admin/verify-selftest?key=… — proves the quote gate rejects a fabricated quote / accepts a verbatim one

Extractor: defaults to Workers AI (EXTRACTOR_MODEL, needs no external key). To use a frontier model, set AI_GATEWAY_URL + AI_GATEWAY_TOKEN (secret) and point EXTRACTOR_MODEL at the provider model.

Not yet built

The /ai-trust site page's changelog view, real x402 settlement, breadth expansion into new vendors (free tier) and the depth/channel schema (paid tier). See ../AI-Trust-Index_v1-Spec_Verifier-and-Depth.md.

Source: README.md at commit 2f7360f

Tools

3

get_ai_vendor_trust_headline

FREE. Plain-language, source-cited verdict on how an AI vendor handles your data (trains-on-data, zero-retention, opt-out).

Parametersvendorrequired

get_ai_vendor_trust_compare

FREE. Compare one data-trust field (default trains_on_your_data) across all tracked vendors, with citations.

Parametersfield

get_ai_vendor_trust

PAID (x402). Full source-cited data-trust record for one vendor: every field, quote, source URL, confidence, date.

Parametersvendorrequired

Version history

1
  1. v0.1.0LatestSep 16, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.