Otr Protocol

io.github.yb48666-ctrl由 GitHub 账号 yb48666-ctrl 发布v3.1.0更新于 Oct 24, 2026

Merchant trust verification for AI agents. One call = trust score, badge, and purchase safety.

已验证STDIO仅桌面安全与监控商业与电商

概览

AI 生成的概览

本地 MCP 服务器，让 AI 助手在推荐购买前查询商户信任分、徽章和安全状态。

可以做什么
验证商户：一次调用返回 0-100 信任分、徽章、六维评分明细、安全状态和站点类别；非商业站点只返回身份信号，不给分数。搜索注册表：分页返回商户列表及其分数、徽章和建议。
适用场景
适合助手参与购物或代理式商务、需要在推荐商户前做一次确定性的可信度核查时。对不销售商品的非商业站点意义不大，因为这类站点不计分。
运行要求
通过 stdio 在本机运行，通常用 npx 从 npm 包启动。未声明认证、环境变量或请求头。依赖 OTR 评分服务和公开数据源，需要网络访问。
安装前请注意
评分仅供参考；README 说明低徽章结果应提示用户自行核实，安全状态为危险时无论分数高低都不应推荐。该服务器只读取注册表数据，不会下单或修改商户记录。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Otr Protocol，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Desktop only，通过 STDIO。 STDIO 服务会启动本地进程，因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照 仓库 中的启动说明。

README

[OTR Protocol]

OTR Protocol

The merchant trust layer for AI agent commerce
Deterministic, verifiable, open-source merchant trust scoring for the agentic economy
Protocol v4.1

[npm] [MIT License] [GitHub Stars] [Issues]

Specification • Scoring Algorithm • Quick Start • Packages • Contributing

The Problem

AI agents are increasingly making purchase decisions on behalf of consumers. The agentic commerce stack is taking shape -- but there is a critical missing layer:

┌──────────────────────────────────────────────────────────────────┐│                  AI Agent Commerce Protocol Stack                 │├──────────────────────────────────────────────────────────────────┤│                                                                   ││   Visa TAP ·············· Agent Identity Verification             ││   Google UCP ············ Structured Data Exchange                 ││   Stripe ACP ············ Payment Processing                      ││                                                                   ││   ┌───────────────────────────────────────────────────────────┐   ││   │  OTR Protocol ·····  MERCHANT TRUST VERIFICATION  ◀━━━━━ │   ││   │                      "Is this merchant safe to buy from?" │   ││   └───────────────────────────────────────────────────────────┘   ││                                                                   ││   Visa TAP answers "Who is the AI agent?"                         ││   Google UCP answers "What products are available?"               ││   Stripe ACP answers "How do I pay?"                              ││   OTR answers "Should I trust this merchant?"  ◀━━ ONLY OTR      ││                                                                   │└──────────────────────────────────────────────────────────────────┘

Without OTR, AI agents operate blind -- unable to distinguish a legitimate retailer from a sophisticated scam site. This exposes consumers to fraud and erodes trust in the entire agentic commerce ecosystem.

The Solution

OTR (Open Trust Registry) provides deterministic, verifiable merchant trust scores using 6 verification dimensions, a 10-layer anti-fraud pipeline (Layer 0: Google Web Risk one-vote veto + Layers 1-9: core detection engine), and three-layer immutable audit trail. It is fully open-source (MIT), machine-readable, and designed from the ground up for AI agent consumption.

Key Properties

  • Deterministic -- Same inputs always produce identical outputs. Any validator can reproduce any score.
  • Verifiable -- All data sources are publicly accessible. No hidden factors or proprietary signals.
  • Unforgeable -- Verification dimension weighted at 40% in public assessment. SEC filings, Wikidata entries, and 10-year domain age cannot be faked.
  • Tamper-proof -- SHA-256 hash chain + Base L2 blockchain anchoring + IPFS monthly snapshots.
  • Fair -- No pay-for-trust. Scores reflect behavior, not subscription level.
  • Category-aware -- Three site categories (ecommerce / saas / non_commerce) with tailored scoring weights.
  • Safety-first -- Google Web Risk Layer 0 one-vote veto: flagged domains get score=0, status SUSPENDED.

Quick Start

bash
# Verify any merchant instantlynpx @otr-protocol/validator verify nike.com
# Output:# ┌──────────────────────────────────────────────┐# │  nike.com                             GOLD   │# │  Trust Score: 88/100   Category: ecommerce   │# │  OTR-ID: OTR-1C-7F3A2B9E4D1C-K4             │# │                                              │# │  Verification:   85  ██████████████░░        │# │  Security:       80  █████████████░░░        │# │  Governance:     72  ████████████░░░░        │# │  Transparency:   75  ████████████░░░░        │# │  Data Quality:   65  ██████████░░░░░░        │# │  Fulfillment:    --  (COLD mode)             │# └──────────────────────────────────────────────┘

For AI Agents (MCP Server)

The OTR MCP Server uses the standard Model Context Protocol and works with all MCP-compatible clients.

Claude Desktop / Claude Code -- add to claude_desktop_config.json:

json
{  "mcpServers": {    "otr": {      "command": "npx",      "args": ["@otr-protocol/mcp-server"]    }  }}

Cursor / Windsurf / Cline -- same configuration in .cursor/mcp.json or equivalent. Any client implementing the MCP specification works out of the box.

Now any AI agent can verify merchants in natural language:

"Is nike.com trustworthy?" --> OTR returns trust score 88/100, badge GOLD, and a 6-dimension breakdown (Verification, Security, Governance, Transparency, DataQuality, Fulfillment) with evidence sources.

Two MCP Tools — One Call = Complete Answer

ToolDescriptionReturns
verify_merchantComplete merchant profile in one callTrust score (0-100), badge, 6-dimension breakdown, safety status (Google Web Risk), site classification (ecommerce/saas/non_commerce), entity data, policy URLs, data sources
search_registrySearch the OTR merchant registryPaginated merchant list with scores, badges, and recommendations

Design philosophy: AI agents should get everything they need in a single tool call. verify_merchant returns trust assessment + purchase capabilities + links + policy URLs + data freshness — no need to chain multiple calls.

TypeScript SDK

typescript
import { OtrClient } from "@otr-protocol/sdk";
const otr = new OtrClient();const result = await otr.verify("nike.com");
console.log(result.trustScore);   // 88console.log(result.badge);        // "GOLD"console.log(result.dimensions);   // { verification: 85, security: 80, ... }
// Search the registryconst results = await otr.search("electronics", { minScore: 70 });

Core Scoring Engine

typescript
import { calculateTrustScore } from "@otr-protocol/core";
// Deterministic: same inputs always produce identical outputsconst result = calculateTrustScore({  hasSecFiling: true,  hasStockSymbol: true,  stockExchange: "NYSE",  hasWikidataId: true,  trancoRank: 500,  domainAgeYears: 15,  // ... 40+ evidence fields});
console.log(result.trustScore);  // 88console.log(result.badge);       // "GOLD"console.log(result.tier);        // "TIER_4"

Architecture

                         ┌─────────────────────────────────┐                         │       AI Agent / Application      │                         │   "Should I buy from example.com?" │                         └──────────────┬──────────────────┘                                        │                    ┌───────────────────┼───────────────────┐                    │                   │                    │              ┌─────▼─────┐     ┌──────▼──────┐    ┌──────▼──────┐              │ MCP Server │     │  REST API   │    │   SDK       │              │  (stdio)   │     │  /api/otr   │    │  npm pkg    │              └─────┬──────┘     └──────┬──────┘    └──────┬──────┘                    │                   │                    │                    └───────────────────┼───────────────────┘                                        │                         ┌──────────────▼──────────────┐                         │      OTR Scoring Engine       │                         │   @otr-protocol/core          │                         │                               │                         │  ┌─────────────────────────┐  │                         │  │ 6 Dimension Evaluators   │  │                         │  │ Verification | Security  │  │                         │  │ Governance | Transparency│  │                         │  │ DataQuality | Fulfillment│  │                         │  └─────────────────────────┘  │                         │  ┌─────────────────────────┐  │                         │  │ 10-Layer Anti-Fraud      │  │                         │  │ Domain Age | SSL | DNS   │  │                         │  │ Pattern | Tranco | ...   │  │                         │  └─────────────────────────┘  │                         │  ┌─────────────────────────┐  │                         │  │ Brand Fast-Track         │  │                         │  │ SEC + Tranco + Wikidata  │  │                         │  └─────────────────────────┘  │                         └──────────────┬──────────────┘                                        │              ┌─────────────────────────┼─────────────────────────┐              │                         │                          │     ┌────────▼────────┐    ┌──────────▼──────────┐    ┌─────────▼─────────┐     │  Public Data     │    │  Merchant Bridge     │    │  Immutable Audit   │     │  Sources         │    │  (Verified Only)     │    │  Trail             │     │                  │    │                      │    │                    │     │  SEC EDGAR       │    │  Product Catalog     │    │  SHA-256 Hash      │     │  Wikidata        │    │  Order Data (agg)    │    │  Chain             │     │  Tranco List     │    │  Delivery Metrics    │    │  Base L2 Anchoring │     │  DNS Records     │    │  Tracking Numbers    │    │  IPFS Snapshots    │     │  SSL Certs       │    │  (desensitized)      │    │                    │     │  Finnhub.io      │    │                      │    │                    │     │  Google Web Risk │    │                      │    │                    │     │  Website Scan    │    │                      │    │                    │     └─────────────────┘    └──────────────────────┘    └───────────────────┘

How Scoring Works

6 Trust Dimensions

Weights vary by site category:

#DimensionE-Commerce COLDSaaS COLDAUTH ModeWhat It Measures
1Verification0.400.370.10Stock exchange, Wikidata, GLEIF LEI, domain age, Tranco rank, payment processors
2Security0.150.200.10SSL/TLS, DMARC, SPF, DKIM, HSTS, DNSSEC, CSP, CAA, WAF, security.txt (15 signals)
3Governance0.200.230.10Privacy policy, GDPR/CCPA, terms, refund/return, shipping, cookie consent (10 signals)
4Transparency0.100.150.05robots.txt, sitemap, Schema.org, hreflang, AI crawler policy, llms.txt, about page
5Data Quality0.150.050.25E-commerce: 22 product data signals. SaaS: 12 platform signals (API docs, SLA, pricing, security certs)
6Fulfillment----0.40Delivery speed, return window, tracking, shipping policy (COLD mode: not scored)

What Each Dimension Measures

DimensionEvaluates
Verification (V)Is this a real, registered business? SSL certificate type, GLEIF LEI, Wikidata entity, SEC filings, domain age, payment processor detection
Security (S)Is the site technically secure? DMARC, SPF, DKIM, HSTS, CSP, WAF, DNSSEC configuration
Governance (G)Does it follow business rules? Privacy policy, refund policy, shipping policy, cookie consent, regulatory compliance
Transparency (T)Is it machine-readable? robots.txt, Schema.org structured data, llms.txt, protocol endpoint availability
Data Quality (D)Is product/service data complete? Product count, image coverage, price format consistency, category taxonomy depth
Fulfillment (F)Does it deliver on promises? Order completion rate, delivery time, return rate, dispute rate (AUTH mode only — requires merchant data)

Why Weights Differ by Category

  • E-commerce: Verification weighted highest (0.40) because buyers need to trust the store before purchasing. Identity signals (SEC filings, Wikidata, domain age) are the strongest defense against fraudulent shops.
  • SaaS: Security (0.20) and Governance (0.23) weighted higher because SaaS platforms handle user data and need clear policies. Users entrust ongoing access to their information.
  • Non-commerce: Not scored. Sites that do not sell products or services lack applicable commerce dimensions (product data, checkout, fulfillment).

Three Site Categories

CategoryDescriptionScoring
ecommerceOnline stores selling physical/digital productsFull 6-dimension scoring with product D signals
saasSoftware-as-a-Service platformsTailored weights (V=37%, G=23%) with 12 SaaS D signals
non_commerceNon-commercial sites (Wikipedia, government, etc.)Not scored -- returns identity signals only

Non-Commerce Sites

Sites classified as non_commerce (e.g., Wikipedia, government portals, news sites) are not scored:

  • trustScore: null
  • badge: null
  • scanStatus: "non_commerce"
  • Basic verification data (SSL, entity info) is still returned, but no numerical trust score is assigned.

Reason: Non-commerce sites do not sell products or services, so trust scoring dimensions (product data, checkout, fulfillment) do not apply.

OTR-ID

Unique identifier assigned to each evaluated domain.

Format: OTR-1{mode}-{fingerprint}-{checksum}

  • 1 — Protocol version
  • mode — C (COLD: pre-authorization scan) or A (AUTH: merchant authorized)
  • fingerprint — 12 uppercase hex chars, derived from SHA-256 of the normalized domain (first 48 bits)
  • checksum — 2 Base36 chars (Luhn mod-36 validation + deterministic salt)
Example: OTR-1C-7F3A2B9E4D1C-K4

Properties:

  • Deterministic: Same domain always produces the same fingerprint
  • Irreversible: SHA-256 is cryptographically one-way; truncated to 48 bits, the original domain cannot be recovered
  • Collision-resistant: ~281 trillion possible fingerprints (2^48)

Lifecycle:

EventResultStatus
First scanOTR-1C generatedACTIVE
Merchant authorizesUpgraded to OTR-1A (same fingerprint, recalculated checksum)UPGRADED
Domain identity change detectedOTR-ID revoked (set to NULL), domain re-enters cold-startREVOKED
Google Web Risk flags domainScore forced to 0SUSPENDED
Anti-gaming multiplier < 0.10Score forced to 0SUSPENDED

Identity change is detected when weighted signals exceed threshold 3: GLEIF entity mismatch (3), nameserver change (2), content similarity < 30% (2), Wikidata P856 mismatch (2), domain parking > 90 days (2), SSL organization change (1).

Google Web Risk (Layer 0 Safety)

Google Web Risk operates as a Layer 0 one-vote veto, separate from dimension scoring:

  • Flagged domain → trustScore = 0, otrIdStatus = SUSPENDED, safety.googleWebRisk = true
  • Does not participate in dimension weight calculation
  • Overrides all other signals regardless of their values

Two Scoring Modes

COLD Mode: Public Assessment (no merchant cooperation needed)═══════════════════════════════════════════════════════════════  E-Commerce: V (0.40) + S (0.15) + G (0.20) + T (0.10) + D (0.15) = Score  SaaS:       V (0.37) + S (0.20) + G (0.23) + T (0.15) + D (0.05) = Score
  Nike (ecommerce):   V=85×0.40 + S=80×0.15 + G=72×0.20 + ...  = 83 GOLD  Scam site:          V=10×0.40 + S=100×0.15 + G=90×0.20 + ...  = 39 UNRATED                                                                    ↑ can't game Verification

AUTH Mode: Verified Merchant (merchant provides API access)═══════════════════════════════════════════════════════════════  F (0.40) + D (0.25) + V (0.10) + S (0.10) + G (0.10) + T (0.05) = Score
  Good merchant:   F=90×0.40 + D=85×0.25 + ...  = 78 SILVER  Bad merchant:    F=30×0.40 + D=40×0.25 + ...  = 38 UNRATED                                                    ↑ bad fulfillment = low score

Trust Badges

BadgeScoreAI Agent Action
PLATINUM90-100Safe to recommend with high confidence
GOLD80-89Strong trust, recommended for AI agents
SILVER70-79Recommend with standard caution
BRONZE60-69Display only, suggest user verify independently
UNRATED0-59Warn user about insufficient trust data

Scores 95+ trigger human review recommendation. No hard cap. If safety.status is "DANGEROUS" (Google Web Risk), DO NOT recommend regardless of score.

10-Layer Anti-Fraud Engine

OTR prevents fraudulent sites from gaming the system through a 10-layer detection pipeline:

Layer 0  Safety Check        Google Web Risk API — malware/phishing one-vote-veto (instant block)Layer 1  Domain Age          Certificate history analysis (crt.sh)Layer 2  SSL Security        HTTPS/HSTS verification, self-signed detectionLayer 3  DNS Security        DMARC, SPF, DKIM policy completenessLayer 4  Domain Pattern      Brand impersonation (amaz0n-deals.xyz), suspicious TLDsLayer 5  Tranco Rank         Independent traffic ranking verificationLayer 6  Content Analysis    Phishing keywords, parked domains, empty pagesLayer 7  Redirect Chain      Cross-domain redirect detectionLayer 8  Cross-Signal        Multi-signal correlation and accumulation rulesLayer 9  Anti-Gaming         Signal-brand mismatch, identity-gameable gap, template suspect         ▼         Layer 0 DANGEROUS = immediate rejection (one-vote-veto)         Single CRITICAL signal = immediate rejection         Fraud score > 30 = rejection         Anti-gaming multiplier applied to gameable dimensions

Anti-Gaming Detection Patterns (Layer 9)

PatternTriggerMultiplier
Signal-Brand MismatchGameable avg ≥ 80 + no Tranco/Wikidata/SEC + Identity < 300.5x
Identity-Gameable GapIdentity < 20 + gameable avg > 70 + no established identity0.7x
Template Site SuspectDomain < 1yr + no Tranco/Wikidata/SEC + gameable avg > 600.5x
Domain Age Gate (<6mo)Domain under 6 monthsCap at 50
Domain Age Gate (<1yr)Domain under 1 yearCap at 75

Anti-Gaming in Practice

ScenarioOld v3 ScoreNew v4 ScoreChange
Nike (legitimate brand)83 GOLD83 GOLD--
Scam site (perfect tech)39 UNRATED35 UNRATED-4
Scam site + anti-gaming28 UNRATED22 UNRATED-6

Data Integrity

OTR uses a three-layer immutable audit trail to ensure that historical scores cannot be tampered with:

Layer 1: PostgreSQL Hash Chain (real-time, $0/year)├── Every score change records SHA-256 hash├── Each record links to previous via prev_hash├── Any modification breaks the chain → detectable└── verifyChainIntegrity() → instant verification
Layer 2: Base L2 Blockchain Anchoring (daily, ~$0.37/year)├── Daily chain-head hash written to Base L2 smart contract├── Externally verifiable by anyone├── AWS KMS hardware security for signing keys└── Transaction hash stored in otr_l2_anchors table
Layer 3: IPFS Monthly Snapshots (monthly, $0/year via web3.storage)├── Full registry exported as content-addressed JSON├── CID (Content Identifier) is immutable├── Anyone can retrieve and verify the snapshot└── CIDs recorded in otr_snapshots table

Public Verification Endpoints:

GET /api/otr/audit/chain-integrity     Verify hash chain completenessGET /api/otr/verify/:domain/history    Score history with trend dataGET /api/otr/audit/l2-anchors          Base L2 anchoring recordsGET /api/otr/audit/snapshots           IPFS snapshot CID listing

Multi-Source Consensus

OTR never blindly trusts any single data source. Every external data point must pass cross-validation:

Source Weights (not all sources are equally trustworthy):  google-web-risk   1.0   Google Safe Browsing → one-vote-veto on DANGEROUS  sec.gov           1.0   Government source → highest trust  dns-query         0.9   Infrastructure → high trust  tranco-list.eu    0.9   Academic source → high trust  wikidata.org      0.8   Community source → high but editable  finnhub.io        0.7   Commercial API → moderate-high trust  website-scan      0.6   Self-reported → moderate trust  product-sample    0.5   Product page sampling → public but limited scope  merchant-api      0.4   Merchant-declared → low trust (can be faked)
Consensus Rules:  ✓ 2+ sources agree → accepted (high confidence)  ✗ Sources disagree → rejected (keep existing value)  ⚠ Single source drift > 30% → anomaly flagged  🔒 3+ anomalies from one source → auto-quarantine

Data Desensitization

When merchants provide fulfillment data, OTR applies 4 levels of privacy protection:

LevelStageWhat Happens
L1Pre-transmissionCustomer names → SHA-256 hash, addresses → country+city only, emails/phones/payments → deleted
L2In transitTLS 1.3 + HMAC-SHA256 signature + nonce anti-replay
L3Server-sideInstant aggregation to statistics, raw data never persists
L4Audit trailOnly metadata logged (timestamps, counts), never content

Why OTR?

FeatureOTRTrustpilotBBBGoogle Merchant
AI-native API (MCP Server)YesNoNoNo
Deterministic scoringYesNoNoNo
Open-source algorithm (MIT)YesNoNoNo
No pay-for-trustYesNoNoYes
Multi-source verification6 dimensions1 (stars)1 (grade)Partial
Anti-gaming detection10-layerNoNoNo
Machine-readable outputFull JSONPartialNoPartial
Immutable audit trail3-layerNoNoNo
Category-aware scoring3 typesNoNoNo
Conformance test suiteYesN/AN/AN/A
Data desensitization4-levelN/AN/APartial

Packages

PackageDescriptionnpm
@otr-protocol/coreDeterministic scoring engine -- the reference implementation[npm]
@otr-protocol/mcp-serverMCP Server for AI agents (Claude, Cursor, Windsurf, Cline)[npm]
@otr-protocol/validatorCLI tool for merchant verification[npm]
@otr-protocol/sdkTypeScript client SDK for application integration[npm]

Conformance Testing

Any OTR implementation must pass the standard conformance test vectors:

bash
npm run conformance

The test suite validates determinism: identical inputs produce identical outputs across all implementations (TypeScript, Python, Go, Rust). This ensures a merchant's trust score is the same regardless of which validator computed it.

Test vectors in conformance/test-vectors.json cover:

  • Site category detection (ecommerce / saas / non_commerce)
  • Scoring mode detection (COLD vs AUTH)
  • Individual dimension scoring with category-specific weights
  • Badge and tier assignment (PLATINUM/GOLD/SILVER/BRONZE/UNRATED)
  • Anti-gaming detection and penalty application
  • Google Web Risk safety override
  • Non-commerce exclusion
  • Edge cases (empty data, null fields, boundary values)

Scoring Integrity

OTR Protocol maintains the integrity and independence of merchant trust scores through these commitments:

  1. No Score Selling -- Trust scores cannot be purchased, sponsored, or commercially influenced. No premium tiers, sponsorships, or partnerships affect scoring.
  2. No Pay-for-Trust -- Subscription status has zero impact on OTR scores. Free-tier merchants and enterprise customers are evaluated identically.
  3. No Human Override -- All scores are computed algorithmically. No individual can manually adjust any score.
  4. Algorithmic Transparency -- The entire algorithm is open-source (MIT). Anyone can audit, verify, and reproduce any score. Re-scanning the same domain produces the same score (deterministic pipeline).
  5. Data-Driven Only -- Scores reflect independently verifiable signals. Merchant-submitted data is marked verified=false with scoringWeight=0 and requires corroboration from at least 2 independent authoritative sources.

Enforcement: Open-source code + conformance tests + governance process + 10-layer anti-gaming detection with compounding multipliers.

Mission

OTR exists to create a fair, transparent trust layer for the AI agent commerce era. Any merchant -- regardless of size or brand recognition -- can earn trust through verifiable performance. The only way to improve a score is to improve actual trust signals.

Public Data Sources

OTR evaluates merchants using publicly accessible data only (COLD mode). No merchant cooperation required.

SourceDataVerifiable
DNS RecordsSPF, DMARC, DKIM, DNSSEC, MTA-STS, CAAYes — standard DNS queries
SSL/TLS CertificatesType (DV/OV/EV), issuing CA, organizationYes — certificate transparency logs
HTTP HeadersHSTS, CSP, X-Frame-Options, Permissions-PolicyYes — any HTTP client
Website ContentPolicy pages, product catalog, Schema.org markupYes — public web pages
Tranco ListDomain popularity ranking (top 1M)Yes — tranco-list.eu (academic)
WHOIS / crt.shDomain age, certificate historyYes — public registries
WikidataEntity verification via P856 (official website)Yes — wikidata.org (CC0)
GLEIFLegal Entity Identifier (LEI), ISO 17442Yes — gleif.org
SEC EDGARUS regulatory filingsYes — sec.gov
Finnhub / OpenFIGIStock exchange listings, ticker resolutionYes — finnhub.io / openfigi.com
Google Web RiskMalware, phishing, unwanted software detectionYes — Google API

Roadmap

PhaseStatusDescription
Phase 1CompleteOpen-source scoring engine, MCP Server, CLI, SDK, conformance tests
Phase 2CompleteHash chain integrity, L2 anchoring, IPFS snapshots, multi-source consensus, data desensitization, score decay, Google Web Risk Layer 0 safety, 3 site categories (ecommerce/saas/non_commerce), SaaS D-dimension 12 signals, COLD/AUTH scoring modes
Phase 3PlannedIETF Internet-Draft standardization, Python/Go SDKs, academic paper

Contributing

We welcome contributions. See CONTRIBUTING.md for detailed guidelines.

Key requirements for scoring algorithm changes:

  1. RFC-style proposal in spec/
  2. Updated conformance test vectors
  3. Determinism verification
  4. Review by maintainers

License

MIT -- ORBEXA

Protocol Specification • Scoring Algorithm • Governance Model • Contributing Guide • Code of Conduct

Built by ORBEXA -- Infrastructure for Agentic Commerce

来源：README.md，提交 4e48dd1

工具

0
SourceWeft 尚未在沙箱中启动过该软件包，因此其工具未知。

版本历史

1
  1. v3.1.0最新Sep 16, 2026

评分

已满足适用检查项的 50%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通25 分

    请保持端点能够响应 MCP 握手；SourceWeft 每 30 天探测一次。

  • 已声明认证方式10 分

    请在注册中心条目中声明凭据请求头，或保持端点能够响应探测，以便判定其认证方式。

  • 已列出工具15 分

    请让服务器在无凭据时响应 tools/list，或发布可在沙箱中无凭据启动的软件包。

  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分