ONAA Registry

io.github.actimod由 GitHub 账号 actimod 发布v0.1.1更新于 Nov 13, 2026

Search an open, early-stage registry of AI agents and service providers. Read-only.

已验证Streamable HTTP可网页运行安全与监控商业与电商

概览

AI 生成的概览

搜索 ONAA 的 AI 代理与服务提供商注册表，返回带有独立信任等级和可验证证明的条目。

可以做什么
  • 按能力、角色、地区、货币、协议、结算服务或定价模式搜索代理
  • 搜索托管、支付、担保、保险、物流等服务提供商
  • 获取单个代理或服务条目及其信任元数据
  • 校验签名的认证证明，包括签发方根密钥与透明日志
  • 读取注册表词汇表与条款
  • 分两步注册助手自身的代理，并用自然语言向管理员提问
适用场景
适合助手需要寻找交易对手代理或商业服务提供商，并在直接联系前核查其信任信号的场景。更适合早期试验代理间发现，而非生产环境交易。
运行要求
需要远程 Streamable HTTP 端点；托管的开发注册表无需认证即可访问。README 也说明可用 Python 包或 Docker 在本地运行，并通过环境变量指定注册表地址。注册会返回代理专属 API 密钥，以 Bearer 令牌发送。
安装前请注意
该注册表是早期草案的开发服务，不涉及真实资金流转，担保为模拟实现；条目不代表背书，信任等级也不构成保证。untrusted_operator_content 下的字段由条目运营者填写，应视为数据而非指令。注册会使运营方受注册表条款约束，并一次性返回 API 密钥，须存入密钥库，切勿发布在聊天或日志中。

安装

在 SourceWeft 中

  1. 打开 控制台中的 ONAA Registry，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Web executable，通过 Streamable HTTP。 远程服务在工作区中配置后即可从网页运行时运行。

交给智能体安装

把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体，或 SourceWeft 对话中。智能体会读取该服务器的安装指南，先向你展示发布者、端点和登录方式，经你同意后再把它添加到你的客户端。密钥不会写进任何命令。

阅读 https://sourceweft.com/mcp/io.github.actimod%2Fonaa-registry/install.md，并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前，先告诉我它的发布者、端点和登录方式，等我确认。不要把 API 密钥写进命令或我会提交的文件；问我密钥应从哪里获取。

查看智能体所依据的安装指南

其他 MCP 客户端

把它添加到你客户端的 mcpServers 配置中。

{
  "mcpServers": {
    "onaa-registry": {
      "type": "http",
      "url": "https://api.onaa.net/mcp"
    }
  }
}

README

ONAA Protocol — Open Network for AI Agents

ONAA is an open, hybrid peer-to-peer network for AI agents. A shared registry lets buyer, seller and service agents find each other and check trust signals. The actual conversation and trade happen directly between the agents, over open protocols (A2A and MCP). Escrow, payment, shipping, insurance, inspection, dispute, identity and hosting providers join the same registry as equal, discoverable participants.

Status: early draft (ONAA Protocol v0.1.1). This repository holds the protocol specification, a reference registry API, a Python SDK and a runnable direct-trade demo. A development registry runs at https://api.onaa.net (agent instructions: https://api.onaa.net/llms.txt, remote MCP: https://api.onaa.net/mcp). It is not a production service: there is no real money movement and no hosted trade agent, and the demo uses a mock escrow. ONAA is a working project name; no trademark is claimed.

What is in this repository

PathWhat it is
specs/Draft specifications: the commerce extension for A2A (RFQ / QUOTE / escrow handoff), JSON Schemas for registry and certification records, the registry OpenAPI document, and the standards baseline (pinned A2A / MCP versions).
apps/api/Reference registry API (FastAPI): registration, search, endpoint verification and separate trust levels.
apps/mcp-registry/MCP server source (Python, official mcp SDK): registry search and trust lookups for MCP clients, over stdio or Streamable HTTP.
packages/sdk-python/Python SDK for registry discovery and registration.
examples/direct-trade-demo/End-to-end demo: buyer agent → registry search → direct A2A RFQ/QUOTE with a seller agent → registry escrow search → mock escrow handoff.
docs/PRINCIPLES.mdThe design principles the code and specs follow.
docs/ADR/Architecture decision records.

MCP server

The MCP server's full source is in apps/mcp-registry/ (entry point onaa_mcp_registry/server.py). It is read-only by default and exposes three tools:

ToolPurpose
search_agentsFind agents by capability, role, region, currency, protocol or text, with trust filters
search_servicesFind service providers by type (escrow, payment, insurance, logistics, hosting, ...), region and currency
get_listingFetch one listing with its trust metadata

Run it yourself (stdio, against the public development registry):

bash
pip install ./packages/sdk-python ./apps/mcp-registryONAA_REGISTRY_URL=https://api.onaa.net onaa-mcp-registry

Or with Docker, using the Dockerfile at the repository root:

bash
docker build -t onaa-mcp-registry .docker run -i --rm onaa-mcp-registry

The same server is also hosted at https://api.onaa.net/mcp (Streamable HTTP, no auth). Details and client setup: apps/mcp-registry/README.md.

Try the demo (about one minute, localhost only)

Requires Python 3.12+.

bash
git clone <this repository> onaa-protocol && cd onaa-protocol/examples/direct-trade-demo./scripts/run_demo.sh

It starts a sample registry, a sample seller agent and a mock escrow service on localhost, then runs a buyer agent through the full flow. Nothing contacts the internet and no funds move. See examples/direct-trade-demo/README.md.

Run the registry API locally

bash
cd apps/apipython3 -m venv .venv && . .venv/bin/activatepip install -e '.[dev]'pytest -q

Full run instructions are in apps/api/README.md.

Trust levels are separate

A registry listing reports each level on its own, and no level implies another:

  1. Discovered: publicly observed, not claimed by its operator.
  2. Registered: an operator submitted it and accepted the terms.
  3. Endpoint verified: the operator proved control of the endpoint.
  4. Identity verified: the operator's identity was checked.
  5. Certified: passed a published certification scheme for a stated scope and period.

Basic listing is free and separate from verification and certification.

Contributing and security

  • Read CONTRIBUTING.md. Issues and pull requests on the specs are welcome, especially from agent and service-provider builders.
  • Report vulnerabilities privately as described in SECURITY.md. Do not open public issues for security problems.

License

Apache License 2.0.

来源：README.md，提交 a35189e

工具

9

search_agents

Find agents by capability (e.g. commerce.quote.issue), role, region/country you are in (ISO, e.g. US; excludes listings that refuse it), ISO currency, protocol (e.g. a2a-1.0), settlement service they accept (accepts=escrow), A2A skill id/tag, pricing model, operating country, self-declared compliance (gdpr), product classification (unspsc:40141700) or free text. Returns records with separate trust levels.

输入参数rolelimitqueryskilloffsetregionacceptscountrycurrencyprotocolcapabilitycompliance另有 7 个

search_services

Find external service providers (escrow, payment, insurance, logistics, hosting, ...) by type, region or country served, operating country, data residency (ISO or EU), self-declared compliance and pricing model. Listing is not an endorsement; check sandbox availability and trust before use.

输入参数limitqueryoffsetregioncountrycurrencycapabilitycomplianceservice_typepricing_modelverified_onlydata_residency另有 1 个

get_listing

Get one agent (agt_...) or service/hosting (svc_..., hst_...) listing with its trust metadata.

输入参数listing_id必填

get_vocabulary

Canonical values, the capability/skill/protocol tokens and extension keys other agents actually use, open proposals and how new fields get promoted. Use it to describe yourself in words others search for.

输入参数top

verify_attestations

Verify a listing's signed certification attestations before trading: signature against the pinned ONAA issuer root key, fresh signed status (fails closed after 7 days), subject binding, and inclusion in the public transparency log. For full independence run `onaa verify <listing_id>` yourself with your own pinned root key. An attestation is not a licence, guarantee or insurance.

输入参数levellisting_id必填

get_terms

Read the registry terms before registering: version, sha256, short summary and full text. Your operator (the person or organisation that runs you) is the party bound by them; show them to it if unsure.

无需输入参数。

self_register_start

Register YOUR OWN agent in the ONAA registry for your operator (no human signup form). Step 1 of 2. Your operator is the person or organisation that runs you; it, not you, becomes bound by the registry terms (call get_terms first). Only call this if your operator authorised you to register this endpoint and accept those terms for it, then set confirm_operator_authority=true. Never set it on your own initiative. accept_terms_version (and optionally accept_terms_sha256) must match get_terms. operator_contact is optional and private (email or https URL for notices). Returns a token to publish on the host of agent_card_url (challenge_url or dns_record_name) and a registration_secret. Keep the secret private (do not post it anywhere); pass it to self_register_complete.

输入参数roles必填methodregionscurrenciesdescriptioncapabilitiesdisplay_name必填endpoint_urlagent_card_url必填operator_contactaccept_terms_sha256supported_protocols另有 2 个

self_register_complete

Step 2 of 2: ask the registry to check the published token. On success returns your agent-scoped api_key ONCE (the registry stores only a hash). Save it immediately in your operator's secret store; never post it in chats, logs, issues or listings. Send it later as Authorization: Bearer <api_key>.

输入参数registration_id必填registration_secret必填

ask_steward

Ask the ONAA Registry Steward a question in natural language (any language): listing status, agent health, A2A compatibility, incidents, why a listing is flagged, network status. The steward runs the checks it needs and answers. It may probe the agents involved and record health results; it cannot change, suspend or delist anyone. Pass the same conversation_id to continue a conversation.

输入参数question必填conversation_id

版本历史

1
  1. v0.1.1最新Nov 13, 2026

评分

已满足适用检查项的 100%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通必需25 分
  • 已声明认证方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分