mitracore — trust layer for agent work

lat.rtaPublished by rta.latOfficial publisherv0.1.0Updated Oct 26, 2026

Verify the artifact, meter the cost, enforce the mandate — one call.

VerifiedStreamable HTTPWeb executableSecurity & MonitoringData & AnalyticsAI & ML

Overview

AI-generated overview

Remote MCP server that verifies agent artifacts, meters actual resource cost, and reports mandate status for agent work.

What you can do
  • Verify an agent artifact across schema, emptiness, provenance and authority layers, returning a signed verdict.
  • Lint a SKILL.md privately for structure, triggers, secrets, prompt injection and broken links, with a score and hash.
  • Price a call from actual consumption (tokens, CPU, bytes, writes, external calls) with a breakdown.
  • Produce a combined trust report covering verification, cost and mandate availability.
  • Check the live status of the underlying service layers.
When to use it
Useful when you need an independent check that an agent's output is well-formed, non-empty, traceable and authorized, or when you want cost figures based on measured usage rather than a price table.
Requirements
A remote MCP endpoint; the README shows connecting via npx mcp-remote to the hosted URL, or running a local Python server over stdio or HTTP. No account or API key is declared for the free tier.
Before you install
Verification beyond 20 per day is paid (per-verification crypto payment or prepaid plans, plus a monthly per-environment fee), so usage can cost money. Artifacts and skill files are sent to a third-party service for checking; avoid submitting secrets or sensitive content.

Installation

In SourceWeft

  1. Open mitracore — trust layer for agent work in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/lat.rta%2Fmitracore/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "mitracore-trust-layer-for-agent-work": {
      "type": "http",
      "url": "https://rta.lat/mitracore/mcp"
    }
  }
}

README

mitracore

Trust layer for agent work: verify the artifact, meter what it cost, enforce the mandate.

Three risks, one call:

  1. verify - four layers over an agent artifact: schema conformance, emptiness (uniform lists, stub values, truncations), generation provenance, authority (was the action permitted). Ed25519-signed receipt, verifiable offline, no trust in this service required.
  2. quote - price what the call actually consumed (tokens, CPU seconds, bytes out, storage writes, external calls) from a published rate card, with the breakdown attached.
  3. mandates - limits, allowlist and kill switch for what an agent may do.

Use it

MCP (recommended):

bash
npx -y mcp-remote https://rta.lat/mitracore/mcp   # hostedpython3 mcp_server.py                              # stdiopython3 mcp_server.py --http 8192                  # streamable http

Public endpoints: POST https://rta.lat/mitracore/mcp (JSON-RPC 2.0), plus /v1/verify, /v1/quote, /v1/trust-report, /v1/skills/lint, /health.

Tools

verify_work(artifact, schema?) | check_skill(path) | quote_cost(tokens, cpu_seconds, bytes_out, storage_writes, external_calls) | trust_report(artifact, schema?) | suite_status()

Pricing

  • 20 verifications per day - free, no card, no account
  • 0.005 USDC per verification (x402), or 9 USDC for 30 days prepaid
  • 49 USD per environment per month (prepaid, no auto-renewal)

Locales

en, hi - Hindi is a first-class interface, not a translation afterthought. India (Bharata) is included in pricing, docs and launch from day one; legal claims about India are taken only from official repositories, anything unverified is reported as pending.

Trust

Receipts are Ed25519-signed and the key fingerprint is published: any buyer can verify a completion locally, offline, without an account.

License: MIT

Source: README.md at commit bdb1f07

Tools

5

verify_work

Проверить артефакт агента (4 слоя: схема, пустота, provenance, полномочия). Возвращает вердикт attest.

Parametersschemaartifactrequired

check_skill

Приватно проверить SKILL.md: структура, триггеры, секреты, prompt-injection, битые ссылки. Возвращает вердикт, балл и sha256 (готово к подписи).

Parameterspathrequired

quote_cost

Посчитать цену по фактическому расходу (токены, CPU, байты, записи, внешние вызовы) — вместо прайсовой таблицы.

Parameterstokensbytes_outcpu_secondsexternal_callsstorage_writes

trust_report

Сводный вердикт по артефакту агента: проверка работы (attest) + цена по факту (agentpay) + доступность мандатов (drift).

Parametersschemaartifactrequired

suite_status

Живое состояние слоёв Suite: attest, agentpay, drift, skilllint.

Takes no parameters.

Version history

1
  1. v0.1.0LatestOct 21, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts