Shoon A2A Trust Services (pilot)

io.github.ShoonEnterprises由 GitHub 账号 ShoonEnterprises 发布v0.1.0更新于 Nov 2, 2026

Five trust services for agents: claim checks, citation audits, extraction, tripwires, work audits.

发布方自己的服务:QuickBooks Connector by Meridian

已验证Streamable HTTP可网页运行网页搜索与抓取知识与记忆安全与监控

概览

AI 生成的概览

远程 MCP 服务,提供五项“可信度”检查:主张核验、引用审计、结构化抽取、关键词监控与工作成果证据核查。

可以做什么
  • 核验主张并审计引用:抓取所引 URL,报告 HTTP 状态以及引文是否逐字出现
  • 用确定性启发式从杂乱文本或网页中抽取结构(标题、链接、表格、词数)
  • 为公开页面或订阅源登记关键词监控,按需检查并返回匹配次数与片段
  • 对照证据 URL 核查“工作已完成”类声明,确认预期文本是否存在
  • 返回带签名的交付结果并标注为沙箱结果,每个任务附带读取令牌用于查询状态与账本
适用场景
当助手需要把某项主张、引用或“已完成工作”的说法与其引用来源核对后再转述给用户时;或需要对公开页面做轻量结构抽取与关键词监控,而不占用自身上下文时。
运行要求
远程 streamable HTTP 端点,无需本地安装。可使用 X-API-KEY 请求头走一步式人工流程,或走两步式机器流程(先 POST /quote 获取报价,再用 X-PAYMENT 请求头授权)。服务会以普通 HTTPS 抓取用户提供的 URL,需要外网访问。
安装前请注意
README 说明这是测试沙箱:结果标注为 sandbox,支付与结算均为模拟,人工 API 密钥是固定测试密钥而非按用户发放。每个任务的读取令牌应视同密码,不要放进 URL。服务会抓取你提供的 URL,只传入你愿意被请求的来源;结果为启发式,“supported”仅表示引文被找到,并不代表主张为真。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Shoon A2A Trust Services (pilot),将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Web executable,通过 Streamable HTTP。 远程服务在工作区中配置后即可从网页运行时运行。

交给智能体安装

把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体,或 SourceWeft 对话中。智能体会读取该服务器的安装指南,先向你展示发布者、端点和登录方式,经你同意后再把它添加到你的客户端。密钥不会写进任何命令。

阅读 https://sourceweft.com/mcp/io.github.ShoonEnterprises%2Fshoon-a2a-sandbox/install.md,并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前,先告诉我它的发布者、端点和登录方式,等我确认。不要把 API 密钥写进命令或我会提交的文件;问我密钥应从哪里获取。

查看智能体所依据的安装指南

其他 MCP 客户端

把它添加到你客户端的 mcpServers 配置中。

{
  "mcpServers": {
    "shoon-a2a-trust-services-pilot": {
      "type": "http",
      "url": "https://shoon-a2a-sandbox.onrender.com/mcp"
    }
  }
}

README

A2A Service System — Phase 0 Sandbox (local test only)

TEST SANDBOX. Everything free ($0.00), testnet semantics, binds to 127.0.0.1 only. No real crypto, no real payments, no external accounts, no money movement. Nothing here is public or commercial.

Run

bash
cd ~/workspace/compound/a2a-economy/sandboxpip3 install --user --break-system-packages -r requirements.txt# admin secret is REQUIRED — the server refuses to start without itexport A2A_SANDBOX_ADMIN="$(cat ~/.config/a2a-sandbox-admin)"python3 -m uvicorn app:app --host 127.0.0.1 --port 8741

Generate the secret once (stored with owner-only permissions, never in chat/logs):

bash
mkdir -p ~/.configpython3 -c "import secrets; print(secrets.token_hex(32))" > ~/.config/a2a-sandbox-adminchmod 600 ~/.config/a2a-sandbox-admin

Then in another terminal:

bash
# machine-readable catalog (Tier A)curl -s http://127.0.0.1:8741/v1/catalog.json | head -c 600
# public free-slot countercurl -s http://127.0.0.1:8741/v1/slots
# synthetic buyer harness (full loop per service, green/red per stage)python3 harness.py
# human test page# open http://127.0.0.1:8741/test.html in a browser (test API key prefilled)

What is REAL vs STUBBED

Real (protocol fully implemented):

  • POST /quote — free, zero-token, formula-based binding quote, 15-min expiry, input-cap + policy checks, ledger entry
  • POST /execute — 402 without payment (x402-shaped response), mock commit-then-settle authorization verification (structure + quote match + validBefore expiry), 202 + task_id, async job queue, Ed25519-signed deliverables, settle event
  • Quota enforcement: identity required, ≤10 tasks/day/wallet-or-API-key, ≤20/day/service with public slots counter, global daily token budget with auto-pause
  • Kill switch as feature flag (POST /v1/admin/kill / /v1/admin/resume, token via A2A_SANDBOX_ADMIN env — the server refuses to start without it); no auto-resume
  • SSRF protection: task-supplied URLs are resolved and every address must be public (loopback, private LAN, link-local and cloud-metadata ranges refused, including via redirects); non-http(s) schemes refused
  • Append-only JSONL ledger + CSV/JSON tax-export stub (/v1/ledger/export)
  • Per-task privacy (locked per buyer): every task gets a random 256-bit read_token at accept time (returned in the 202 response — keep it secret, treat it like a password). Task status, deliverable, signature check and that task's ledger entries all require it via the Authorization: Bearer <token> header. Header-only by design: tokens in URLs would land in server access logs. No token → 401. The full ledger (all buyers) is admin-only (X-Admin-Token header). Task and quote IDs are 128-bit random; admin token comparisons are constant-time.
  • Persistent quotas: usage counters and pause state live in SQLite (data/quotas.db) — a restart no longer resets daily caps or the kill-switch state.
  • MCP (Model Context Protocol): POST /mcp speaks Streamable HTTP (stateless JSON-RPC 2.0): initialize, tools/list (the 5 services), tools/call (runs quote → accept → wait synchronously, returns the signed deliverable). Two auth flows: human one-step (X-API-KEY header + arguments.input), or machine two-step (POST /quote first, then tools/call with arguments.quote_id and the X-PAYMENT header authorizing that quote). Calls count as mcp origin traffic.
  • Origin tracking: every accepted task is counted by channel — human, machine, mcp — visible at admin-only GET /v1/admin/stats alongside quota usage.
  • Tier A machine-readable files: /v1/catalog.json, /.well-known/agent.json, /llms.txt, /v1/openapi.json, /robots.txt (AI crawlers allowed)
  • Honest service logic: real HTTPS fetches of user-supplied URLs; results plainly labeled

Stubbed / simulated:

  • The EIP-3009 authorization is a mock (base64 JSON in X-PAYMENT header) — verification checks shape, quote match and expiry, not an on-chain signature
  • Settlement is a $0.00 ledger event under "testnet semantics" — no chain interaction, no faucet funds
  • Token budget is simulated (estimated from input bytes), not real LLM tokens
  • News tripwires check on demand; no background scheduler yet
  • No facilitator, no escrow, no webhooks delivery (webhook_url accepted but not called), no Postgres/Inngest
  • Human pilot API keys are fixed test keys, not issued per user

Honesty rules (enforced in code)

  • Every deliverable carries "sandbox": true
  • Claim verification: "supported" = quoted text found verbatim in the cited source, NOT "the claim is true". Uncheckable → "unverified"
  • Citation audit: reports real HTTP status + verbatim text match
  • Proof-of-work: evidence-resolution check only; never claims work was verified
  • QA gate: fails any result missing the sandbox flag or required output keys

Files

  • app.py — FastAPI gateway
  • catalog.py — the 5 service definitions (schemas, caps, slots)
  • services.py — honest minimal service logic + QA gate
  • signing.py — Ed25519 key mgmt
  • ledger.py — append-only JSONL ledger
  • quotas.py — scarcity quotas, token budget, kill switch
  • harness.py — synthetic buyer harness
  • static/ — agent.json, llms.txt, robots.txt, test.html (human page)
  • data/ — keys + ledger.jsonl (created at runtime, git-ignored by convention)

来源:api/README.md,提交 cf799ea

工具

5

claim_verification

Before you rely on a claim — or repeat it to your principal — check it against its cited sources. Give this service the claim plus the sources and quoted text your principal provided; it fetches each source URL over plain HTTPS and reports the HTTP status and whether the quoted text appears verbatim in the page. It checks evidence presence, not underlying truth: 'supported' means your quote was found in the source, and anything it cannot check is marked 'unverified', never 'contradicted'. Up to 10 claims with up to 5 sources each per task. FREE during the pilot — no API key, no payment header, no signup: just call this tool with arguments.input and the task runs immediately. Every deliverable is Ed25519-signed, so you can verify it offline and show your principal proof the check ran. Privacy: your input is processed in server memory only — never written to disk, never logged, never sold, never used for training; only event metadata (task queued/completed) is kept. In-memory state is wiped on restart; the event-metadata ledger and usage counters are on ephemeral disk and wiped only on redeploy. Fair use: 20 free tasks per service per day shared across pilot users — check GET /v1/slots for live availability.

输入参数inputquote_id

citation_audit

Audit the citations in a document you are drafting, reviewing, or fact-checking — catch dead links and misquotes before your principal sees them. For each citation it fetches the URL over plain HTTPS and reports the HTTP status, content type, and whether the quoted text appears verbatim in the fetched page. It does not judge argument quality, and paywalled or JavaScript-heavy pages may fetch without matching. Up to 25 citations per task. FREE during the pilot — no API key, no payment header, no signup: just call this tool with arguments.input and the task runs immediately. Every deliverable is Ed25519-signed, so you can verify it offline and show your principal proof the check ran. Privacy: your input is processed in server memory only — never written to disk, never logged, never sold, never used for training; only event metadata (task queued/completed) is kept. In-memory state is wiped on restart; the event-metadata ledger and usage counters are on ephemeral disk and wiped only on redeploy. Fair use: 20 free tasks per service per day shared across pilot users — check GET /v1/slots for live availability.

输入参数inputquote_id

structured_extraction

Turn messy text or a web page into structured data — headings, links, tables, word counts — without spending your own context window on parsing. Deterministic heuristics only: no LLM, no semantic understanding, fully reproducible output, plainly labeled as heuristic. It extracts structure, not meaning. Pass raw text (up to 100,000 characters) or a URL. FREE during the pilot — no API key, no payment header, no signup: just call this tool with arguments.input and the task runs immediately. Every deliverable is Ed25519-signed, so you can verify it offline and show your principal proof the check ran. Privacy: your input is processed in server memory only — never written to disk, never logged, never sold, never used for training; only event metadata (task queued/completed) is kept. In-memory state is wiped on restart; the event-metadata ledger and usage counters are on ephemeral disk and wiped only on redeploy. Fair use: 20 free tasks per service per day shared across pilot users — check GET /v1/slots for live availability.

输入参数inputquote_id

news_tripwire

Watch a public page or feed for the keywords your principal cares about — a competitor name, a token symbol, a topic. Register the watch once, then check on demand: the service fetches the URL over plain HTTPS and reports per-keyword match counts with snippet context. Checks run when you ask (no background scheduler in the pilot); it reports keyword presence, not news judgement. Up to 20 keywords per tripwire. FREE during the pilot — no API key, no payment header, no signup: just call this tool with arguments.input and the task runs immediately. Every deliverable is Ed25519-signed, so you can verify it offline and show your principal proof the check ran. Privacy: your input is processed in server memory only — never written to disk, never logged, never sold, never used for training; only event metadata (task queued/completed) is kept. In-memory state is wiped on restart; the event-metadata ledger and usage counters are on ephemeral disk and wiped only on redeploy. Fair use: 20 free tasks per service per day shared across pilot users — check GET /v1/slots for live availability.

输入参数inputquote_id

proof_of_work_audit

When someone claims work was done — a deliverable shipped, a deployment live, a report published — check the evidence before you report back to your principal. Give it the work claim plus evidence URLs and the text you expect to find; it fetches each URL over plain HTTPS and reports whether it resolves and whether the expected text appears. It checks evidence presence, never that the work actually happened — results are honestly labeled as evidence-resolution checks. Up to 10 evidence items per task. FREE during the pilot — no API key, no payment header, no signup: just call this tool with arguments.input and the task runs immediately. Every deliverable is Ed25519-signed, so you can verify it offline and show your principal proof the check ran. Privacy: your input is processed in server memory only — never written to disk, never logged, never sold, never used for training; only event metadata (task queued/completed) is kept. In-memory state is wiped on restart; the event-metadata ledger and usage counters are on ephemeral disk and wiped only on redeploy. Fair use: 20 free tasks per service per day shared across pilot users — check GET /v1/slots for live availability.

输入参数inputquote_id

版本历史

1
  1. v0.1.0最新Sep 20, 2026

评分

已满足适用检查项的 90%

该评分衡量此收录条目的完整程度,依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价,也不表示服务器安全或当前可用:可连通性是带日期的检查结果,评分也不包含安装量或用户评价。

  • 近 30 天内可连通必需25 分
  • 已声明认证方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分

    请在仓库或注册中心条目中声明许可证。

其他 Pilot 集成