io.github.srotzinPublished by GitHub account srotzinv1.0.0Updated Oct 27, 2026
KYA identity verification, trust scoring, and performance bonds for AI agents
HiveTrust is a remote trust registry for AI agents: it registers agent identities, scores their trust, issues credentials, and quotes or binds insurance.
Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.
Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.
Read https://sourceweft.com/mcp/io.github.srotzin%2Fhivetrust/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.Add this to your client's mcpServers config.
{
"mcpServers": {
"hivetrust": {
"type": "http",
"url": "https://hivetrust.onrender.com/mcp"
}
}
}"The Equifax + GEICO of the A2A Economy"
[License: MIT] [Node.js 22] [ES Modules] [MCP Compatible]
HiveTrust is the trust infrastructure layer for the agent-to-agent (A2A) economy. It provides Know-Your-Agent (KYA) identity verification, algorithmic trust scoring, and parametric insurance so that AI agents can transact with each other safely — at machine speed, without human intermediaries.
As autonomous agents start negotiating contracts, processing payments, and managing real assets, the ecosystem needs a credit bureau and an insurer rolled into one. That's HiveTrust.
Agents are pseudonymous by default. HiveTrust anchors each agent to a verifiable, unforgeable identity:
did:hive:<uuid>) with Ed25519 public key bindingHiveTrust's scoring engine synthesises five behavioural pillars into a single, portable reputation score:
Trust tiers: unverified (0–199) · provisional (200–399) · standard (400–599) · elevated (600–799) · sovereign (800–1000)
When agents transact with strangers, someone has to absorb the tail risk. HiveTrust provides:
HiveAgent is the agent runtime — it executes tasks, manages tool calls, and handles the A2A protocol layer.
HiveTrust is the trust fabric underneath it:
HiveAgent calls POST /v1/insurance/quote before any high-value task and GET /v1/verify_agent_risk before accepting an inbound request from an unknown agent. The trust score flows back into HiveAgent's routing and pricing decisions.
The health endpoint confirms it's live:
All endpoints are prefixed /v1 unless noted. Authentication via X-API-Key header.
claim_typenamespace note: HiveTrust'sclaim_typefield (non_delivery | fraud | sla_breach | data_loss | unauthorized_action) is distinct from the CTEF envelope-levelclaim_type(identity | transport | authority | continuity) defined in A2A CTEF v0.3.1. Both tokens coexist at disjoint envelope levels — see docs/CLAIM_TYPE_NAMESPACE.md.
HiveTrust exposes all core operations as MCP tools via a single JSON-RPC 2.0 endpoint at POST /mcp. This lets any MCP-compatible agent (including HiveAgent) call HiveTrust natively without REST boilerplate.
HiveTrust is the 5th canonicalizer in the CTEF (Composable Trust Evidence Format) v0.3.1 byte-match consortium: AgentGraph + AgentID + APS + Nobulex + HiveTrust. Seat committed at the 2026-04-25 01:48 UTC freeze.
Patent applications 64/049,200 – 64/049,226, priority 2026-04-24, holder: Stephen A. Rotzin / TheHiveryIQ.
Beyond 10 free requests/day, the endpoint returns HTTP 402 with an x402 payment challenge: $0.01 USDC on Base chain 8453.
All vectors use RFC 8785 JCS — implemented inline in src/routes/cte.js. The implementation produces byte-identical output to AgentGraph's canonicalize_jcs_strict for all 4 shared test vectors:
9e7b5031e46de38b5f90e895113a3f24f42a4128d8d99856a2d71e529b0f0d5cfeb42dca4214fc46207138d676ec727d7b3d0caa1eda8c0390d2d6f6fbc28913e584f1cd0885dc938da5fc23ce7e528715a0086e5464c9ed0f3c1c82b364026ff9cd10bc4e8bf34ce3aa6a0e5df0d27989e54ff41c4333c69ae3ecfaf8de0cb5HiveTrust operates five revenue streams:
See .env.example for the full annotated list.
The included render.yaml sets free-tier web service, auto-generates secrets, and configures all env vars.
See fly.toml for the full configuration. Auto-stop/start is enabled to minimise costs.
Set environment variables in the Railway dashboard using .env.example as the reference.
See packages/npm/ for the full SDK source.
See packages/python/ for the full SDK source.
MIT © 2026 HiveAgent IQ
Hive Civilization is the cryptographic backbone of autonomous agent commerce — the layer that makes every agent transaction provable, every payment settable, and every decision defensible.
This repository is part of the DEFENSIBLE pillar.
Source: README.md at commit d3ffeea
Register a new AI agent identity with HiveTrust KYA (Know Your Agent). Assigns a unique agent ID, anchors the public key, and initializes the trust score.
namerequiredchecksummetadataowner_idrequiredverticalsmodel_nameowner_typepublic_keydescriptioncapabilitieshiveagent_idmodel_version+4 moreRetrieve a registered agent's full identity profile, including public key, checksum, trust tier, capabilities, and compliance status.
agent_idrequiredVerify an agent's cryptographic identity by checking public key ownership and checksum integrity. Returns a verification result with confidence score and reason codes.
agent_idrequiredchecksumchallengesignatureRetrieve an agent's current multi-pillar trust score (0–1000 scale). Returns composite score, tier, per-pillar breakdown (identity, behavior, fidelity, compliance, provenance), verdict, and max recommended transaction value.
agent_idrequiredQuick risk assessment for payment processors and marketplace operators. Returns verdict (ALLOW/REVIEW/BLOCK), trust tier, and max transaction limit. This is the free public endpoint — no API key required.
agent_idrequiredBulk ingest behavioral telemetry events for an agent. These events feed into the trust scoring engine. Supports transaction completions, SLA violations, dispute events, tool calls, and more.
eventsrequiredIssue a W3C-compatible verifiable credential to an agent. Credentials represent verified claims such as identity verification, compliance certification, or domain expertise.
claimsrequiredagent_idrequiredissuer_idrequiredexpires_atcredential_typerequiredVerify a previously issued verifiable credential. Checks signature validity, revocation status, and expiration.
credential_idrequiredRevoke a verifiable credential. Records the revocation in the registry. Revoked credentials immediately fail verification checks.
reasonrequiredagent_idevidencecredential_idrequiredGet a dynamic insurance premium quote for an agent transaction. Premium is calculated based on trust score, transaction value, and risk tier. HiveTrust takes a 1.5% spread on insured transactions.
agent_idrequiredcounterparty_idtransaction_valuerequiredBind (activate) an insurance policy for an agent. Locks in the premium, creates the policy record, and deploys the escrow contract on Base L2.
agent_idrequiredquote_detailstransaction_valuerequiredFile an insurance claim against an active policy. Triggers claims adjudication workflow. Payouts are made in USDC via the Base L2 escrow contract.
amountrequiredevidencepolicy_idrequiredclaim_typerequiredclaimant_idrequireddescriptionFile a dispute or appeal against a trust score decision, credential revocation, or behavioral event. Initiates the dispute resolution workflow.
reasonrequiredagent_idrequiredevidencetarget_idrequiredtarget_typerequireddispute_typerequiredRetrieve HiveTrust platform-wide statistics: total registered agents, verified count, average trust score, total insured value, active policies, claims filed, and more.
Takes no parameters.
Create a Data Oracle Context Lease — "Sign Once, Settle Many". Grants unlimited access to a data stream for a fixed period (24h/72h/168h). Returns a cryptographic lease token (SHA-256) for zero-friction verification. Available streams: construction_pricing, simpson_catalog, compliance_feeds, market_data, pheromone_signals.
lessee_didrequireddata_streamrequiredduration_hoursrequiredStake USDC to back an agent's reputation via HiveBond. Creates a trust bond with a specified tier (bronze/silver/gold/platinum) and lock period. Phase 1: declared stake amount tracked in-memory; flat $0.25 registration fee via x402. Longer lock periods earn higher simulated yield (2–5% APY). Slashing is permanent — if an agent fails, stake is slashed and paid to injured parties.
tierrequiredagent_didrequiredamount_usdcrequiredlock_period_daysrequiredQuick bond verification — check if an agent is bonded and at what tier. Returns bonded status, tier, staked amount, slash count, and max bounty access. This is the key integration point — other services call this to check bond status before assigning bounties. Free endpoint, no x402 payment required.
didrequired100% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
██╗ ██╗██╗██╗ ██╗███████╗████████╗██████╗ ██╗ ██╗███████╗████████╗██║ ██║██║██║ ██║██╔════╝╚══██╔══╝██╔══██╗██║ ██║██╔════╝╚══██╔══╝███████║██║██║ ██║█████╗ ██║ ██████╔╝██║ ██║███████╗ ██║ ██╔══██║██║╚██╗ ██╔╝██╔══╝ ██║ ██╔══██╗██║ ██║╚════██║ ██║ ██║ ██║██║ ╚████╔╝ ███████╗ ██║ ██║ ██║╚██████╔╝███████║ ██║ ╚═╝ ╚═╝╚═╝ ╚═══╝ ╚══════╝ ╚═╝ ╚═╝ ╚═╝ ╚═════╝ ╚══════╝ ╚═╝ ┌─────────────────────────────────────────────────────────────────┐│ Your Application │├─────────────────────────────────────────────────────────────────┤│ HiveAgent (task execution, A2A) ││ ↕ REST / MCP ││ HiveTrust (identity, reputation, insurance, compliance) │├──────────────────────────────────┬──────────────────────────────┤│ On-chain (Base L2 / USDC) │ Off-chain (SQLite / Events) │└──────────────────────────────────┴──────────────────────────────┘┌─────────────────────────────────────────────────────────────────────┐│ Layer 1 — Identity KYA ││ ┌────────────────┐ ┌──────────────────┐ ┌───────────────────┐ ││ │ DID Registry │ │ Ed25519 Proofs │ │ W3C-VC Issuance │ ││ └────────────────┘ └──────────────────┘ └───────────────────┘ │├─────────────────────────────────────────────────────────────────────┤│ Layer 2 — Reputation Engine ││ ┌─────────────────────────────────────────────────────────────┐ ││ │ Telemetry Ingest → Pillar Computation → Score 0-1000 │ ││ │ (35% txSuccess + 25% capital + 15% network + │ ││ │ 15% identity + 10% compliance) │ ││ └─────────────────────────────────────────────────────────────┘ │├─────────────────────────────────────────────────────────────────────┤│ Layer 3 — Insurance Underwriter ││ ┌──────────────┐ ┌──────────────┐ ┌──────────────────────────┐ ││ │ Quote Engine │ │ USDC Escrow │ │ Parametric Claims │ ││ │ (dynamic │ │ (Base L2 │ │ (on-chain trigger → │ ││ │ premium) │ │ Coinbase) │ │ instant payout) │ ││ └──────────────┘ └──────────────┘ └──────────────────────────┘ │├─────────────────────────────────────────────────────────────────────┤│ Layer 4 — Data Moat ││ ┌──────────────────────┐ ┌────────────────────────────────────┐ ││ │ Behavioural Graph │ │ Federation (cross-registry sync) │ ││ │ (audit trail, │ │ Aggregated data licensing │ ││ │ PageRank, patterns)│ │ to enterprise customers │ ││ └──────────────────────┘ └────────────────────────────────────┘ │└─────────────────────────────────────────────────────────────────────┘# Clonegit clone https://github.com/hiveagentiq/hivetrust.gitcd hivetrust
# Installnpm install
# Configurecp .env.example .env# Edit .env with your values
# Seed sample data (optional)node src/seed.js
# Startnpm start# Server running on http://localhost:3001curl http://localhost:3001/health# {"status":"ok","version":"1.0.0","uptime":3.14}POST /mcpContent-Type: application/jsonX-API-Key: ht_your_api_key
{ "jsonrpc": "2.0", "id": 1, "method": "tools/list"}POST /mcpContent-Type: application/jsonX-API-Key: ht_your_api_key
{ "jsonrpc": "2.0", "id": 2, "method": "tools/call", "params": { "name": "hivetrust_get_trust_score", "arguments": { "agent_id": "a1b2c3d4-..." } }}curl https://hivetrust.hiveagentiq.com/.well-known/cte-test-vectors.json | jq '.version'# "0.3.1"# First 10 requests/day per IP are freecurl -X POST https://hivetrust.hiveagentiq.com/verify \ -H 'Content-Type: application/json' \ -d '{"type":"TrustAttestation","version":"0.3.1","claim_type":"authority",...}'
# Returns: { verdict: "valid"|"INVALID_CLAIM_SCOPE"|"INVALID_COMPOSITION",# canonical_sha256: "...", pass: true|false }curl https://hivetrust.hiveagentiq.com/verify/self-test | jq '.data.summary'# Push to GitHub, then connect the repo in the Render dashboard# render.yaml is already configured — click "Apply"
# Or deploy manually:render deploy# Install flyctl: https://fly.io/docs/hands-on/install-flyctl/fly auth loginfly apps create hivetrust
# Create a persistent volume for SQLitefly volumes create hivetrust_data --region ord --size 3
# Deployfly deploy# Builddocker build -t hivetrust:latest .
# Rundocker run -p 3001:3001 \ -e NODE_ENV=production \ -e INTERNAL_API_TOKEN=your_token \ -v $(pwd)/data:/app/data \ hivetrust:latestrailway initrailway upnpm install @hivetrust/sdkimport { HiveTrustClient } from '@hivetrust/sdk';
const trust = new HiveTrustClient('https://hivetrust.hiveagentiq.com', 'ht_your_api_key');
// Register an agentconst agent = await trust.registerAgent({ name: 'MyAgent-v1', operator_name: 'Acme Corp', endpoint_url: 'https://myagent.acme.example/mcp', public_key: 'edPublicKeyBase58...',});
// Check trust before transactingconst score = await trust.getTrustScore(agent.id);console.log(score.score, score.tier); // 680 "elevated"
// Get insurance quoteconst quote = await trust.getInsuranceQuote(agent.id, counterpartyId, 1000);console.log(quote.premium_usdc); // 15.00pip install hivetrustfrom hivetrust import HiveTrustClient
trust = HiveTrustClient("https://hivetrust.hiveagentiq.com", "ht_your_api_key")
score = trust.get_trust_score("agent-id-here")print(score["score"], score["tier"])