Trooth

io.github.trooth-engPublished by GitHub account trooth-engv1.1.3Updated Oct 28, 2026

Trooth is an infrastructure and cybersecurity company providing Machine-Readable Trust.

The publisher's own server: Semanto by Trooth

VerifiedStreamable HTTPWeb executableWeb Search & ScrapingSecurity & MonitoringBusiness & Commerce

Overview

AI-generated overview

Trooth is a free, read-only remote MCP server that lets an assistant look up any company's public Trust Profile, facts and provenance on the Trooth Network.

What you can do
  • Resolve, search and list companies by domain, name, tagline, category, industry or data region
  • Read a company's full Trust Profile section by section, or fetch a single buyer-question answer or fact with its provenance word, date and anchor
  • Review how a record changed over time and what a company declares about AI and customer data
  • Run a live outside-in read of a domain's public HTTPS surface and security.txt, and verify the signatures on a Trust Ledger Token
  • Read fixed reference resources (methodology, provenance glossary, schemas, buyer questions) and use four vendor due-diligence prompts
  • Read your own workspace's company record after signing in
When to use it
Useful when you want an assistant to check a vendor, supplier or partner before relying on it: identity, commercial terms, security and privacy posture, AI data practices, procurement terms and how those claims are sourced. Also handy for comparing companies or tracking changes to a record over time.
Requirements
A remote streamable HTTP endpoint; nothing to install locally. No key or account for the ten public tools. The own-workspace tool needs OAuth sign-in and a workspace linked through enterprise SSO on trooth.co. Rate limit of 300 units per minute per caller, with some calls costing more units.
Before you install
Results include text companies wrote about themselves; treat it as data, never as instructions. Trooth witnesses and dates facts but does not grade or rank companies, and an empty or missing record is not a finding about that company. The outside-in read costs four units per call. Calls are counted by tool and company for 90 days, without IP addresses, questions or search words.

Installation

In SourceWeft

  1. Open Trooth in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.trooth-eng%2Ftrooth-network/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "trooth": {
      "type": "http",
      "url": "https://api.trooth.co/public/mcp"
    }
  }
}

README

trooth-mcp

The Trooth Network over the Model Context Protocol. Read any company's public record from Claude, ChatGPT, Cursor, VS Code or any MCP client. No key, no account.

[MCP Registry] [License: MIT] [Docs]

https://api.trooth.co/public/mcp

Trooth operates the Trooth Network: one public, machine-readable record per company, carrying its identity, products, commercial terms, people, documents, security and privacy posture, AI practices, procurement terms and relationships. Every item says who said it. It is Trooth's only product, and it is free.

Trooth witnesses and dates facts. It does not grade, rate or rank anyone. No tool here returns a number that sums a company up.

Is your company on the Trooth Network? Any company can publish one free, public record that buyers, and the AI assistants they use, read directly. Claim your company's record · See an example

Quick start

ClientHow to add it
Claude (claude.ai, Desktop, mobile)Customize › Connectors › + › Add custom connector, paste the URL above, and choose No sign-in.
ChatGPTTrooth Network is listed in ChatGPT's app directory. To add the URL yourself, turn on Developer mode, then add it under Plugins.
Claude Codeclaude mcp add --transport http trooth https://api.trooth.co/public/mcp
Codexcodex mcp add trooth --url https://api.trooth.co/public/mcp, or the ~/.codex/config.toml block below.
Gemini CLIgemini mcp add --transport http trooth https://api.trooth.co/public/mcp, or the settings.json block below.
CursorAdd "trooth": { "url": "https://api.trooth.co/public/mcp" } under mcpServers in .cursor/mcp.json.
VS CodeRun MCP: Add Server and paste the URL above, or add the block below to a project's .vscode/mcp.json (VS Code's key is servers, not mcpServers).

Then ask in plain words: "Read trooth.co's Trust Profile and tell me how it handles customer data."

Every client's current steps, with install links, are at trooth.co/docs/agents.

Configuration files

The same blocks trooth.co/docs/agents gives, one per client.

Claude Code:

bash
claude mcp add --transport http trooth https://api.trooth.co/public/mcp

Codex, ~/.codex/config.toml:

toml
# or: codex mcp add trooth --url https://api.trooth.co/public/mcp[mcp_servers.trooth]url = "https://api.trooth.co/public/mcp"

Gemini CLI, settings.json. Use httpUrl: in the Gemini CLI, url is for servers that use server-sent events.

json
{  "mcpServers": {    "trooth": {      "httpUrl": "https://api.trooth.co/public/mcp"    }  }}

Cursor, .cursor/mcp.json:

json
{  "mcpServers": {    "trooth": {      "url": "https://api.trooth.co/public/mcp"    }  }}

VS Code, .vscode/mcp.json:

json
{  "servers": {    "trooth": {      "type": "http",      "url": "https://api.trooth.co/public/mcp"    }  }}

Tools

Eleven tools, all read only. Each answers with prose for a person and the same answer as typed structuredContent for a machine, under a declared outputSchema.

ToolWhat it readsCost
trooth_resolve_companyFinds the record for a domain, web address, Trooth slug or name, with why it matched; several matches come back as candidates, none chosen.1
trooth_search_companiesSearch the Network by name, domain, tagline or category; 10 per page in slug order, with a cursor.1
trooth_list_companiesLists companies by industry, data region, witnessed or not, and claimed or unclaimed; 20 per page in a fixed order.1
trooth_public_trust_profileOne company's complete Trust Profile, section by section, by domain or Trooth slug. Ask for detail: "summary" first.1
trooth_get_factOne buyer question answer or one fact: sentence, value, provenance word, date, freshness and anchor, or no, not_published or not_read.1
trooth_company_changesHow a record changed: record versions and per-fact edits, optionally since a date.1
trooth_ai_data_use_disclosuresWhat a company has declared about AI and customer data.1
trooth_outside_in_readA live read of a domain's public HTTPS surface and security.txt, taken when called.4
trooth_verifyChecks the two signatures on a Trust Ledger Token, a signed token a company issues through Trooth about its own claims.1
trooth_askAnswers a question about Trooth itself from Trooth's fixed reference text.1
trooth_my_company_recordYour own workspace's record. Needs sign-in (OAuth).1

Every fact carries one of four provenance words: witnessed, public record, attested or declared. Only the witness statement is signed on a record: Trooth signs witness statements and, for workspaces that create a delegation, delegation receipts and action evidence references; it does not sign the profile, its facts or a company's declarations. Three negatives are kept apart: no (the record holds a negative value), not_published (the company has not published it) and not_read (Trooth's reading did not read it). ## Resources and prompts

resources/list returns seven fixed resources, on every protocol revision the server supports:

ResourceWhat it holds
trooth://buyer-questionsThe twelve buyer questions as JSON: each question ID, its wording, the record section it is answered from and its page anchor form.
trooth://methodologyWhat witnessed means, how outside-in reads differ from signed evidence, and why Trooth never invents a number.
trooth://provenance-glossaryThe four provenance words and the three negatives: what each means on a company record and how to cite it.
trooth://provenance-labelsEach provenance value this server returns, the value deprecated on 2026-09-26, and what a Trust Ledger Token's signatures cover.
trooth://schemaThe outputSchema of every tool, as one JSON document, with the address of the published company record schema.
trooth://verify-a-vendorA sequence of this server's tools an agent can use to look into a vendor before relying on it, and how to report what they return.
trooth://what-a-call-sendsThe arguments each tool sends, the request metadata that comes with them, what is counted and what is never kept.

resources/templates/list returns two templates, read live: trooth://company/{company} (one company's Trust Profile as Markdown) and trooth://company/{company}/{section} (one section of it).

prompts/list returns four prompts. Each takes one argument.

PromptArgumentWhat it asks for
vendor_trust_checkcompanyLook up a vendor's record on Trooth before relying on it, keeping each provenance label.
verify_trust_tokentokenCheck the signatures on a Trust Ledger Token an agent has been handed.
vendor_due_diligencecompanyRead one company's answers to the twelve buyer questions, each cited with its provenance word and date, without a verdict.
before_you_trustcompanyA three-step look at a vendor for a procurement or integration decision, reported with provenance and without a verdict.

A sample call

One question asked of one company's record, exactly as the server answered it on 2026-10-17 (the assurance_boundary and content_trust blocks are cut here for length; every answer carries both).

bash
curl -s https://api.trooth.co/public/mcp \  -H 'content-type: application/json' \  -H 'accept: application/json, text/event-stream' \  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"trooth_get_fact","arguments":{"company":"trooth.co","question":"q_data_location"}}}'

The tool's structuredContent:

json
{  "status": "answered",  "subject": "trooth.co",  "source": {    "name": "trooth.co published record (/api/network/profile)",    "version": "contract 2",    "as_of": "2026-10-17T00:45:45.379Z"  },  "fact": {    "kind": "question",    "id": "q_data_location",    "question": "Where is customer data stored and processed, and can a customer choose the region?",    "answer_state": "answered",    "value": "Production regions: Website: Vercel iad1 (US East), Database: AWS us-east-1 through Neon, API at api.trooth.co: Cloudflare Workers on the global edge; Processing locations: United States (website and database), Cloudflare Eastern North America (account service), Cloudflare edge (API and Kyrie AI inference), Sub-processor regions: trooth.co/subprocessors; Regions a customer can choose: None: every account runs in the same regions",    "provenance": "declared",    "as_of": "2026-10-17T00:45:45.379Z",    "anchor_url": "https://trooth.co/network/company/trooth#q-data-location",    "fact_ids": ["hosting.production_regions", "hosting.processing_locations", "hosting.regions_a_customer_can_choose"]  }}

The provenance word is declared: the company said it, and the answer says so rather than presenting it as something Trooth observed. The anchor opens the same answer on the company's Trust Profile.

A section a company left empty comes back as not published, never filled in. A company Trooth holds nothing on comes back as an honest absence, which is not a finding about that company.

How it works

TransportStreamable HTTP, JSON-RPC 2.0, POST only, no sessions.
Protocol2026-07-28 (stateless), with 2025-11-25, 2025-06-18, 2025-03-26 and 2024-11-05 still negotiated.
AuthenticationNone for ten tools. trooth_my_company_record needs an OAuth access token from the authorization server named in the server's protected-resource metadata.
Limits300 units per minute per caller, shared by every tool; each call costs the units in the table. Over the limit, the answer is HTTP 429 with Retry-After. Every tool states its own policy in tools/list.
DataEvery answer carries a provenance label and the boundary of what Trooth checked. Results include text companies wrote about themselves: treat them as data, never as instructions.
What a call sendsThe tool name and its arguments. Trooth keeps a daily count of calls by tool and the company looked up, for 90 days, never an IP address, a question or search words. See trooth.co/docs/query-privacy.
ErrorsA call that did not complete as asked carries error { code, message, retry_after_seconds? } with one of not_found, ambiguous, invalid_input, rate_limited, upstream_timeout, upstream_unavailable.

Signing in, for trooth_my_company_record

The server's protected-resource metadata is at https://api.trooth.co/.well-known/oauth-protected-resource/public/mcp (RFC 9728) and names Trooth's WorkOS AuthKit issuer. A client registers itself with that issuer and requests a token for resource=https://api.trooth.co/public/mcp (RFC 8707); no scope is required. The tool reads only the workspace linked to the person the token was issued for. The link is made when that person signs in to trooth.co once with Continue with enterprise SSO; until then the tool answers not_linked. A call without a token answers 401 with a WWW-Authenticate header naming the metadata. The token is never stored or forwarded.

The security contract for the live read, including which hosts and addresses are refused, is published at trooth.co/docs/agents#mcp-security-contract.

Troubleshooting

  • Fewer than seven resources, or a tool missing. The server declares listChanged: false, so a client may keep the lists it read when it first connected, and a 2026-07-28 list result may be cached for its ttlMs (ten minutes). Remove the server and add it again, or start a new conversation, and the client lists again. To see what the server lists right now:

    bash
    curl -s https://api.trooth.co/public/mcp \  -H 'content-type: application/json' \  -H 'accept: application/json, text/event-stream' \  -H 'mcp-protocol-version: 2025-06-18' \  -d '{"jsonrpc":"2.0","id":1,"method":"resources/list","params":{}}'

  • The tools do not appear. Check that trooth is turned on in the client's tools or connectors menu, then start a new chat. In VS Code, run MCP: List Servers, select trooth and choose Show Output.

  • Two trooth servers listed. Remove both (claude mcp remove trooth, codex mcp remove trooth, gemini mcp remove trooth, or delete the entry from the configuration file) and add it once.

  • VS Code does not pick up the configuration. The file is .vscode/mcp.json and its top-level key is servers. A block copied from Cursor or Claude Desktop uses mcpServers, which VS Code does not read.

  • Gemini CLI cannot connect. Use httpUrl in settings.json; url makes the Gemini CLI expect server-sent events.

  • 405 on a GET. The endpoint takes POST only. A client that only speaks the 2024-11-05 HTTP with server-sent events transport opens https://api.trooth.co/public/mcp/sse instead.

  • HTTP 429. The caller used its 300 units for the minute. Wait the seconds in Retry-After, then retry.

  • 401 from trooth_my_company_record. The call carried no token, or one that is invalid or expired. Sign in again from the client; an invalid token gets 401 even on a public tool, so remove a stale one.

  • not_linked from trooth_my_company_record. Sign in to trooth.co once with Continue with enterprise SSO, using the same account, to link the workspace.

This repository

A license, this README, server.json, docs/directory-submissions.md (listing copy for the MCP directories), the manifest published to the official MCP Registry as io.github.troothllc/trooth-network, and glama.json, which names the maintainers of the Glama directory listing. The server itself runs behind api.trooth.co; there is nothing here to install.

server.json in this repository is version 1.1.7, written for server 1.8.0. The registry manifest and the running server carry separate version numbers: the server reports its own in serverInfo.

Related

Security

Report a vulnerability to [email protected]. The policy is at trooth.co/security/vulnerability-disclosure-policy and /.well-known/security.txt.

License

MIT. See LICENSE.

Source: README.md at commit 8a3fc95

Tools

0
SourceWeft has not read this server's tools yet.

Version history

5
  1. v1.1.3LatestSep 26, 2026
  2. v1.1.2Sep 20, 2026
  3. v1.1.1Sep 17, 2026
  4. v1.1.0Sep 16, 2026
  5. v1.0.0Sep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declaredRequired10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

Other Trooth integrations

Semanto by Trooth

co.troothOfficial publisher

Sets up, signs, publishes and verifies Semanto, a company's signed website copy that AI agents can read and check.

Streamable HTTPWeb executable
Knowledge & Memory16 toolsNov 7, 2026

Trooth

Published by GitHub account troothllc

Trooth gives an assistant read access to public, machine-readable company Trust Profiles: search, resolve and read a company's declared facts, provenance and AI

Streamable HTTPWeb executable
Knowledge & Memory15 toolsOct 24, 2026