GAIP Trust & Assurance Agent

io.github.tjcgraham-rgbPublished by GitHub account tjcgraham-rgbv1.5.0Updated Oct 31, 2026

Now part of GAIP Witness: verifies GAIP receipts; evidence packs and incident bundles.

VerifiedStreamable HTTPWeb executableSecurity & MonitoringAI & ML

Overview

AI-generated overview

GAIP Trust & Assurance Agent: a free, read-only remote MCP server that returns signed receipts and evidence about AI agents, MCP servers and suppliers.

What you can do
  • Inspect evidence about a counterparty agent before delegating, with coverage, conflicts and gaps
  • Compile evidence packs for a subject (agent or supplier) with conformance, watch, witness, repair and incident records plus Merkle proofs
  • Verify a GAIP receipt's integrity and export it as x402, erc8004 or W3C-VC-like JSON-LD
  • Build a source-attributed incident timeline from receipt IDs and observations
  • Check an x402 SAR-shaped receipt for missing fields, ID match and signature validity
When to use it
Useful when an assistant must decide whether to delegate to another agent, or when an insurer, auditor, buyer or incident responder needs dated, verifiable evidence about an agent or supplier. It reports observations, not trust scores, certifications or liability findings.
Requirements
Remote streamable HTTP endpoint at www.gaipagents.com/mcp; no sign-in, API key or environment variables. Inputs must be public and non-personal identifiers or URLs.
Before you install
Answers are observations at a stated time, not certification, endorsement, ranking, or legal, financial or insurance advice. Receipt verification proves integrity only, not that the underlying claim is true. Inputs are sent to a third-party service, so avoid personal or confidential data.

Installation

In SourceWeft

  1. Open GAIP Trust & Assurance Agent in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.tjcgraham-rgb%2Fgaip-trust-assurance/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "gaip-trust-assurance-agent": {
      "type": "http",
      "url": "https://www.gaipagents.com/mcp/agents/trust-assurance"
    }
  }
}

README

GAIP

[GAIP logo]

GAIP, the Governed Agentic Intelligence Platform, keeps an independent, dated record of what AI agents, MCP servers and online shops publish, and answers questions about that record with signed receipts. Free, read-only, no key; facts at a stated time, never an assessment.

First call: gaip_check with a url on https://www.gaipagents.com/mcp. This one runs as-is; then use the URL of the agent, MCP server or API you care about:

bash
curl -s https://www.gaipagents.com/mcp \  -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' \  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"gaip_check","arguments":{"url":"https://mcp.deepwiki.com/mcp"}}}'

Without MCP: GET https://www.gaipagents.com/v1/free/conformance/check?url=<url>.

The map: every question GAIP answers, grouped by who asks, with its tool and HTTP route: https://www.gaipagents.com/v1/free/map. Every completed answer carries a continuity handle; send it back and the answer is bound to your own history with GAIP.

One line to connect

WhereOne line
Any MCP clienthttps://www.gaipagents.com/mcp (streamable HTTP, no sign-in)
Claude Codeclaude mcp add --transport http gaip https://www.gaipagents.com/mcp, or the plugin (MCP server and skill): /plugin install gaip --marketplace tjcgraham-rgb/gaip-agents
Claude Desktop / claude.aiCustomize > Connectors > Add custom connector, URL https://www.gaipagents.com/mcp, no sign-in
Agent Skills (Claude Code, Cursor, Codex and others)npx skills add tjcgraham-rgb/gaip-agents (installs skills/gaip/SKILL.md)
Cursor, VS Codethe buttons below, or { "mcpServers": { "gaip": { "url": "https://www.gaipagents.com/mcp" } } }
Gemini CLIgemini extensions install https://github.com/tjcgraham-rgb/gaip-agents
OpenAI Agents SDKHostedMCPTool(tool_config={"type": "mcp", "server_label": "gaip", "server_url": "https://www.gaipagents.com/mcp", "require_approval": "never"})
Vercel AI SDKawait createMCPClient({ transport: { type: 'http', url: 'https://www.gaipagents.com/mcp' } }) (from @ai-sdk/mcp)
LangChainpip install langchain-gaip, then from langchain_gaip import get_tools
CrewAIAgent(..., mcps=["https://www.gaipagents.com/mcp"])
A2A (1.0 and 0.3.0)agent card https://www.gaipagents.com/.well-known/agent-card.json; plain text works
x402nothing to set up: GAIP is free and never answers with HTTP 402 (https://www.gaipagents.com/.well-known/x402)
Windsurf~/.codeium/windsurf/mcp_config.json: { "mcpServers": { "gaip": { "serverUrl": "https://www.gaipagents.com/mcp" } } }
Cline{ "mcpServers": { "gaip": { "type": "streamableHttp", "url": "https://www.gaipagents.com/mcp" } } } (see llms-install.md)
Everything else, with copy-paste codehttps://www.gaipagents.com/docs/quickstart

[Add to Cursor] [Install in VS Code]

In CI: two GitHub Actions

GAIP Watch fails your build when an MCP server or agent your agent depends on changed its tools, schemas, sign-in or prices, with dated receipts (watch/):

yaml
- uses: tjcgraham-rgb/gaip-agents/watch@main  with:    urls: https://mcp.example.com/mcp

GAIP Agents check runs gaip_check on your own agent card, MCP server or OpenAPI document on every push:

yaml
- uses: tjcgraham-rgb/gaip-agents@v1  with:    agent-url: https://your-agent.example/.well-known/agent-card.json    fail-on-error: "true"

Outputs: verdict (READY, FIXES_NEEDED, UNREACHABLE or NOT_CHECKED), receipt-id, error-count, warning-count. Providers can show their own dated record with the badge https://www.gaipagents.com/v1/free/watch/badge.svg?url=<your endpoint>.

In this repository

PathWhat it is
registry/The Official MCP Registry records: gaip-broker.json (GAIP itself) and one record per specialist agent
listing-kit.jsonThe sentence, the first call, the map's rows, endpoints and example calls for directories (also served at /v1/free/discovery/listing-kit)
skills/gaip/SKILL.mdGAIP as an Agent Skill (agentskills.io format; also served at /.well-known/agent-skills/gaip/SKILL.md)
.claude-plugin/Claude Code plugin and marketplace manifests: the skill plus the remote MCP server
.cursor-plugin/plugin.json, mcp.jsonCursor plugin manifest and its MCP server
gemini-extension.json, GEMINI.mdGemini CLI extension: installs GAIP's MCP server and tells the model when to use each tool
packages/gaip-check/Python client: check_agent("https://other-agent.example")
action.yml, packages/gaip-check-action/The check Action (uses: tjcgraham-rgb/gaip-agents@v1)
watch/The GAIP Watch Action
packages/aipref-signals/Dependency-free parser and test vectors for AI-preference signals (IETF AI Preferences Content-Usage, RSL licence links, W3C TDMRep, Content Signals)
assets/GAIP logo (SVG, and a 400×400 PNG) and the specialist icons (SVG)
llms-install.mdInstall steps for AI assistants that set up MCP servers themselves (Cline)

The registry records, listing kit, packages, Watch Action, skill and Gemini extension are copies of what GAIP's service generates; a check in the service's repository warns when a copy here falls out of step. The service itself runs at www.gaipagents.com.

What an answer means

Every answer states what was observed and when. It is not a certification, endorsement, ranking or universal score, and not legal, financial or insurance advice. Receipts are signed with GAIP's Ed25519 key, published at https://www.gaipagents.com/.well-known/gaip-receipt-keys.json.

Licence

MIT (see LICENSE) for everything in this repository.

Source: README.md at commit 0bfeca4

Tools

6

inspect_counterparty_evidence

What evidence exists about this agent?

Use this when asked what evidence exists about an agent before delegating to it. Pass its `counterparty_id` and any `observations`. Returns task-specific evidence coverage, conflicts, gaps and GAIP's own earlier checks of it, with a receipt. Never a trust score or recommendation. Free, read-only, no account; inputs must be public and non-personal.

Parameterssyntheticepisode_idtask_classmax_age_daysobservationscounterparty_idcontinuity_handledata_classificationindependent_operator_id

gaip_receipt_export

Export a GAIP receipt

Use this when you need a GAIP receipt in another format. Pass `receipt_id` and `format`: x402 (attestation style), erc8004 (validation-response shape) or vc (W3C-VC-like JSON-LD). Ed25519-signed when the runtime key is available; hash chain and Merkle proof; no on-chain write. Free, read-only, no account; inputs must be public and non-personal.

Parametersformatrequiredreceipt_idrequired

verify_gaip_receipt

Verify a GAIP receipt

Use this when you hold a GAIP receipt_id and want to confirm it ("is this receipt genuine?"). Returns the retained record, hash chain and Merkle inclusion proof. Integrity only: it does not make the underlying claim true. Free, read-only, no account; inputs must be public and non-personal.

Parameterssyntheticepisode_idreceipt_idrequiredcontinuity_handledata_classificationindependent_operator_id

gaip_evidence_pack

Build an evidence pack

Use this when an insurer, auditor or buyer asks what evidence exists about an agent or supplier. Pass its `subject` (public id or https URL). Returns conformance, watch, witness, repair and incident records with Merkle proofs, plus gaps. A compilation, not certification or advice. Free, read-only, no account; inputs must be public and non-personal.

Parametersscopesubjectrequiredrequester

gaip_incident_bundle

Build an incident evidence bundle

Use this when something went wrong with an agent and you need the facts in order. Pass the `receipt_ids` you hold and attributed `observations`. Returns a verified, source-attributed timeline with an EU AI Act Art. 73 reference aid. No fault, cause or liability finding. Free, read-only, no account; inputs must be public and non-personal.

Parameterstitlereceipt_idsobservationsai_system_refdata_classification

gaip_check_sar_receipt

Check an x402 SAR receipt

Use this when handed an x402 SAR-shaped receipt (draft proposal shape; may change). Pass `sar_receipt`, optionally the issuer's `public_key`. Returns missing fields, whether receipt_id matches the core and whether the signature checks out against that key. Free, read-only, no account; inputs must be public and non-personal.

Parameterspublic_keysar_receiptrequired

Version history

6
  1. v1.5.0LatestOct 10, 2026
  2. v1.4.0Oct 2, 2026
  3. v1.2.0Sep 30, 2026
  4. v1.1.1Sep 29, 2026
  5. v1.1.0Sep 28, 2026
  6. v1.0.0Sep 27, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts