ai.djzs由 djzs.ai 發布官方發布者v1.0.0更新於 Oct 24, 2026
Deterministic pre-execution audit for trading agents. PASS/WAIT/FAIL, reproducible verdict_hash.
在投入資金前審核交易代理的推理，回傳 PASS、WAIT 或 FAIL，並附上被標記的缺陷與可重現的雜湊值。
Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。
把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。
閱讀 https://sourceweft.com/mcp/ai.djzs%2Ftrust-mcp/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。把它新增到你客戶端的 mcpServers 設定中。
{
"mcpServers": {
"djzs-trust": {
"type": "http",
"url": "https://mcp.djzs.ai/mcp"
}
}
}DJZS audits the reasoning behind an autonomous agent's move before capital is committed, and returns one of three verdicts PASS, WAIT, or FAIL with the specific reasoning defects flagged and a reproducible hash of the decision.
The wedge: transaction-security tools answer "is this transaction safe to sign?". DJZS answers a different question "should this position be taken at all?". A perfectly safe transaction can still rest on broken reasoning; DJZS is the layer that catches the bad thesis.
verify_pm_trade is deployed as a Model Context Protocol tool (streamable HTTP) on a
Cloudflare Worker. Add it to an MCP-capable agent in one line:
Then call verify_pm_trade with a free-text prediction-market trade thesis. It extracts the
reasoning, audits it against the calibrated DJZS-M taxonomy, and returns
PASS → PROCEED / FAIL / WAIT → HALT, with the flagged defects and a verdict_hash.
First external audit on record. An outside agent audited a benchmark thesis
(pm-block-008) through the deployed tool and received:
Behavioral parity against the offline batteries (verdict + flags + extracted input) is green. Hash parity is a pending re-mint the calibration key lapsed during deployment so the live hash above stands as the record until it is re-run.
Beyond the MCP transport above, verify_pm_trade is now payable over the HTTP x402
transport, live on Base mainnet:
An unpaid request returns an HTTP 402 challenge (exact scheme, eip155:8453, USDC, 2.00
USDC to the treasury); the client signs an EIP-3009 authorization and retries. This is the
same rail Base MCP, MetaMask Agent Wallet, and x402-axios speak, so any HTTP x402
client can pay the gate directly - no MCP integration required.
Free-refusal is preserved on both transports: an out-of-scope intent is answered 402 and never settled, so a refused audit costs nothing. Verified end to end on Base Sepolia (paid settlement plus an on-chain zero-delta refusal) before the mainnet deploy.
DJZS separates the model-bound step from the trusted step:
Why this shape: the verdict rules are model-independent. The LLM only turns messy text into a structured struct; the audit rules that decide the verdict are frozen code. Swap the model and the extraction quality changes the rules, weights, and hash do not.
Determinism by construction. The same AuditInput always yields the same verdict and the same
hash:
WAIT is never silent. An under-specified thesis — one where a decision-critical fact is
unknown — resolves to WAIT, mapped to HALT for the caller, with unknown_fields returned so
the agent knows exactly what to clarify. Abstention is a first-class outcome, never a guessed
PASS or FAIL.
DJZS-PM-v1.0) the calibrated, live pathWeights sum to 100; FAIL threshold 25. All four codes are implemented and calibrated.
M04 is advisory-grade. On its own it does not block a lone M04 rides a PASS with the flag on the certificate (weight 15 is below the FAIL threshold). It contributes to a block only by stacking with another finding (e.g. M03 + M04 = 40 → FAIL, as in the first audit above).
verify_pm_trade is PM-only: if the intent does not extract as a prediction-market thesis
(including the undetermined case), it returns in_scope: false rather than silently running a
perpetuals audit.
DJZS-LF-v1.1)Weights sum to 200. The taxonomy is frozen at 11 codes; 3 are wired live in the engine today (marked ●). The rest are defined and weighted but not yet firing — coverage is stated honestly rather than implied.
Both weight tables are hash-locked (WEIGHTS_HASH / TAXONOMY_HASH, and the PM equivalents, are
exported constants); changing a weight is a deliberate re-derive, not a hot patch.
The deployed Worker exposes three tools over streamable HTTP at /mcp:
What the tool does not do yet — recorded deliberately, to be re-ruled before the gate is broadly promoted:
verify_pm_trade returns a verdict_hash but does not yet
anchor a certificate. Existing Irys certificates are prior-architecture lineage, not output of
this tool.The response contract today is: verdict, action, risk_score, flags, unknown_fields,
disagreements (the per-field sample-agreement telemetry), verdict_hash, extraction_failsafe,
in_scope, and taxonomy versions.
failCount counts WAIT as FAILquery_agent_trust excludes WAIT verdicts from both sides of the fail rate and reports them as
wait_count. Anyone reading the subgraph directly, rather than through the tool, gets a
different answer. djzs-subgraph/src/trust-score.ts handleScoreUpdated increments
failCount on an else branch (verdict == "PASS" / else), so a WAIT — an abstention, not a
failure — lands in failCount and inflates the rate for any agent that ever received one.
The Worker recomputes from per-audit verdicts, so the tool is right. The indexed counters are
not, and they stay that way until the mapping is corrected and re-indexed. Both numbers are
returned side by side (subgraph_counters, labelled) so the discrepancy is visible rather than
discovered. Tracked as a follow-up; deliberately not folded into the read-layer fix, because a
mapping change needs a subgraph redeploy and a re-index.
Before the MCP gate, DJZS ran as a paid HTTP audit service. Those endpoints remain for
backward compatibility the MCP gate above is the current surface. The tiers are metered in
USDC on Base Mainnet via an x-payment-proof header:
POST /api/audit aliases the Micro tier, and an escrow-settled variant (POST /api/audit/escrow)
takes on-chain escrow in place of a payment header. These tiers run the older detection path, not
the Architecture C engine — treat their output as legacy.
The A2A manifest (agent.json) attests four DJZS contracts on Base Mainnet, each marked
verified. Source for each lives in contracts/:
Addresses are as recorded in agent.json; verify any of them on BaseScan.
A fifth contract, contracts/DJZSProofOfLogicNFT.sol, exists as source only — it is not in the
deployed manifest, and this document makes no claim that certificate NFTs are live or mintable.
Prior ProofOfLogic certificates live on the Irys datachain and are readable via the
query_pol_certificates MCP tool. They are prior-architecture lineage, not output of
verify_pm_trade.
The commit history is the product's own audit trail: each verdict-bearing change ships with a
PENDING note naming what is still unproven, and the next commit that closes it discharges that
note explicitly. Every claim a recall number, a parity result, a live verdict hash — is cited to
a specific run at the moment it is pushed, not asserted after the fact. If you want to know what is
proven versus deferred, git log is the source of truth and this file is downstream of it.
These are configured outside the repository. They are recorded here because nothing in the tree enforces them, and a silent revert would change live behaviour with no diff to point at.
A 403 with server: cloudflare and a text/plain body reading error code: 1010 is always the
edge, never the Worker. The Worker reads user-agent in exactly one place — a telemetry INSERT
— and never blocks on it.
server/engine-v2/ — Architecture C: deterministic-engine.ts (the frozen decider),
extraction-layer.ts (N=3 consensus extraction), audit-input-schema.ts, hash.ts, and the
calibration/ bench + scorer.shared/audit-schema.ts — the DJZS-LF perpetuals taxonomy (source of the table above).shared/pm-taxonomy.ts — the DJZS-M prediction-market taxonomy.djzs-trust-mcp/ — the Cloudflare Worker: the MCP server and the verify_pm_trade tool,
importing the engine and shared taxonomies frozen via a build alias.server/ (older tiers) — the prior HTTP audit path and its ProofOfLogic / settlement plumbing,
retained for backward compatibility. Its legacy detection tier historically used a Venice-hosted
model; the Architecture C path does not depend on it.The deterministic core runs with zero external dependencies. The extraction step is the only model-bound component, isolated to a single swappable function.
來源：README.md，提交 b4ef33c
Query DJZS ProofOfLogic Certificates
Query immutable ProofOfLogic certificates stored on Irys Datachain by DJZS Protocol. USE THIS TOOL when you need to verify audit history for an agent or project before delegating work, check FAIL verdicts, or retrieve certificates by Irys tx ID. DO NOT use for on-chain trust scores — use query_agent_trust for those.
tierlimitto_msfrom_msverdicttargetSystemQuery DJZS Agent Trust Score
Query an agent's DJZS trust score, aggregated on-chain (Base mainnet) from its audit history and indexed via the DJZS subgraph. USE BEFORE delegating work, releasing escrow, or executing agent transactions. Returns scored_audits, pass/fail counts, the raw fail rate, and a Wilson 95% lower bound on it, plus latest verdict/risk and DJZS-S01/DJZS-X01 flag counts. WAIT verdicts are abstentions: they are excluded from BOTH the numerator and the denominator of the fail rate and are reported separately as wait_count. Below 10 scored audits the tool returns INSUFFICIENT_HISTORY and NO rate - a 0-of-0 record is not evidence of reliability and must not compare as better than a 3-of-50. This tool returns evidence, not a decision: it applies no threshold and emits no HALT. Interpreting the bound against your own risk tolerance is the caller's job.
agentAddress必填Verify Prediction-Market Trade Thesis (DJZS pre-execution audit)
Deterministic pre-execution audit of a prediction-market trade thesis, run before capital is committed. USE THIS TOOL before opening, sizing, or increasing any prediction-market position, and whenever a user or an upstream agent asks whether a thesis is sound, carries a falsification condition, or has a sourced probability basis. Audits against the calibrated DJZS-M taxonomy (M01 narrative/resolution gap, M02 falsification absent, M03 probability unsourced, M04 consensus-as-edge advisory) and returns PASS->PROCEED, WAIT->HALT, or FAIL with the flagged defects and a reproducible verdict_hash. DO NOT use to retrieve past verdicts or certificates - use query_pol_certificates for those. DO NOT use for an agent's historical trust score - use query_agent_trust for that. DO NOT use for spot, perpetuals, or equities: out-of-scope submissions are refused WITHOUT CHARGE. Audit before act. Paid tool: 2 USDC per audit via x402 on Base.
intent必填agent_addresstarget_systemtarget_system_subjecttarget_system_signatureVerify Perpetual / Spot Trade Thesis (DJZS pre-execution audit)
Deterministic pre-execution audit of a perpetual or spot TRADE thesis (direction, size, leverage, entry, stop, target, venue, and the REASON), run before capital is committed. USE THIS TOOL before opening, sizing, or increasing any perpetual or spot position. Returns PASS / WAIT / FAIL with a reproducible verdict hash. A position stated with no thesis FAILS (DJZS-S01); an unbounded position FAILS (DJZS-X01); an unresolvable stop or thesis WAITs. Prediction-market bets are refused here (use verify_pm_trade) and are not charged. Price 2.00 USDC per audit on Base.
intent必填agent_addresstarget_systemtarget_system_subjecttarget_system_signature已滿足適用檢查項的 90%
該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。
請在儲存庫或註冊中心條目中宣告授權條款。
claude mcp add --transport http djzs-trust https://mcp.djzs.ai/mcpverdict: FAILflags: DJZS-M03 (PROBABILITY_UNSOURCED), DJZS-M04 (CONSENSUS_NO_EDGE)risk_score: 40disagreements: []verdict_hash: 0x85918814b3dffa31b00d6892c2e00b2001efd35f7e0044b4cd3789fe1df14937POST https://mcp.djzs.ai/x402/verifyfree-text intent │ ▼EXTRACTION (LLM, N=3 consensus) reports observable FACTS, never a verdict · per-field state unanimity across the 3 samples; any disagreement → unknown · quote gates: a claimed "absent" must quote the intent verbatim, or it demotes to unknown · evidence-unanimity: a critical-driving "absent" needs the same quote across all samples │ ▼AuditInput (each fact is tri-state: present / absent / unknown) │ ▼DETERMINISTIC ENGINE (pure code — no model, no network, no clock) rules fire → weighted score → verdict │ ▼PASS · WAIT · FAIL + verdict_hashverdict_hash = sha256(canonicalize({ verdict, risk_score, flags: codes.sorted(), unknown_fields }))