Shoon A2A Trust Services (pilot)

io.github.ShoonEnterprises由 GitHub 帳號 ShoonEnterprises 發布v0.1.0更新於 Nov 2, 2026

Five trust services for agents: claim checks, citation audits, extraction, tripwires, work audits.

發布方自己的服務:QuickBooks Connector by Meridian

已驗證Streamable HTTP可網頁執行網頁搜尋與抓取知識與記憶安全與監控

概覽

AI 產生的概覽

遠端 MCP 服務,提供五項「可信度」檢查:主張核驗、引用稽核、結構化擷取、關鍵字監控與工作成果證據查核。

可以做什麼
  • 核驗主張並稽核引用:抓取所引 URL,回報 HTTP 狀態以及引文是否逐字出現
  • 以確定性啟發式從雜亂文字或網頁擷取結構(標題、連結、表格、字數)
  • 為公開頁面或訂閱來源登記關鍵字監控,依需求檢查並回報符合次數與片段
  • 對照證據 URL 查核「工作已完成」類聲明,確認預期文字是否存在
  • 回傳附簽章的交付結果並標示為沙箱結果,每個任務附帶讀取權杖以查詢狀態與帳本
適用情境
當助理需要把某項主張、引用或「已完成工作」的說法與其引用來源核對後再轉述給使用者時;或需要對公開頁面做輕量結構擷取與關鍵字監控,而不佔用自身上下文時。
執行需求
遠端 streamable HTTP 端點,無需本機安裝。可使用 X-API-KEY 標頭走一步式人工流程,或走兩步式機器流程(先 POST /quote 取得報價,再以 X-PAYMENT 標頭授權)。服務會以一般 HTTPS 抓取使用者提供的 URL,需要對外網路連線。
安裝前請注意
README 說明這是測試沙箱:結果標示為 sandbox,付款與結算皆為模擬,人工 API 金鑰是固定測試金鑰而非依使用者發放。每個任務的讀取權杖應視同密碼,不要放進 URL。服務會抓取你提供的 URL,只傳入你願意被請求的來源;結果為啟發式,「supported」僅表示引文被找到,不代表主張為真。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Shoon A2A Trust Services (pilot),將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Web executable,透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式,或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南,先向你展示發布者、端點和登入方式,經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/io.github.ShoonEnterprises%2Fshoon-a2a-sandbox/install.md,並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前,先告訴我它的發布者、端點和登入方式,等我確認。不要把 API 金鑰寫進命令或我會提交的檔案;問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。

{
  "mcpServers": {
    "shoon-a2a-trust-services-pilot": {
      "type": "http",
      "url": "https://shoon-a2a-sandbox.onrender.com/mcp"
    }
  }
}

README

A2A Service System — Phase 0 Sandbox (local test only)

TEST SANDBOX. Everything free ($0.00), testnet semantics, binds to 127.0.0.1 only. No real crypto, no real payments, no external accounts, no money movement. Nothing here is public or commercial.

Run

bash
cd ~/workspace/compound/a2a-economy/sandboxpip3 install --user --break-system-packages -r requirements.txt# admin secret is REQUIRED — the server refuses to start without itexport A2A_SANDBOX_ADMIN="$(cat ~/.config/a2a-sandbox-admin)"python3 -m uvicorn app:app --host 127.0.0.1 --port 8741

Generate the secret once (stored with owner-only permissions, never in chat/logs):

bash
mkdir -p ~/.configpython3 -c "import secrets; print(secrets.token_hex(32))" > ~/.config/a2a-sandbox-adminchmod 600 ~/.config/a2a-sandbox-admin

Then in another terminal:

bash
# machine-readable catalog (Tier A)curl -s http://127.0.0.1:8741/v1/catalog.json | head -c 600
# public free-slot countercurl -s http://127.0.0.1:8741/v1/slots
# synthetic buyer harness (full loop per service, green/red per stage)python3 harness.py
# human test page# open http://127.0.0.1:8741/test.html in a browser (test API key prefilled)

What is REAL vs STUBBED

Real (protocol fully implemented):

  • POST /quote — free, zero-token, formula-based binding quote, 15-min expiry, input-cap + policy checks, ledger entry
  • POST /execute — 402 without payment (x402-shaped response), mock commit-then-settle authorization verification (structure + quote match + validBefore expiry), 202 + task_id, async job queue, Ed25519-signed deliverables, settle event
  • Quota enforcement: identity required, ≤10 tasks/day/wallet-or-API-key, ≤20/day/service with public slots counter, global daily token budget with auto-pause
  • Kill switch as feature flag (POST /v1/admin/kill / /v1/admin/resume, token via A2A_SANDBOX_ADMIN env — the server refuses to start without it); no auto-resume
  • SSRF protection: task-supplied URLs are resolved and every address must be public (loopback, private LAN, link-local and cloud-metadata ranges refused, including via redirects); non-http(s) schemes refused
  • Append-only JSONL ledger + CSV/JSON tax-export stub (/v1/ledger/export)
  • Per-task privacy (locked per buyer): every task gets a random 256-bit read_token at accept time (returned in the 202 response — keep it secret, treat it like a password). Task status, deliverable, signature check and that task's ledger entries all require it via the Authorization: Bearer <token> header. Header-only by design: tokens in URLs would land in server access logs. No token → 401. The full ledger (all buyers) is admin-only (X-Admin-Token header). Task and quote IDs are 128-bit random; admin token comparisons are constant-time.
  • Persistent quotas: usage counters and pause state live in SQLite (data/quotas.db) — a restart no longer resets daily caps or the kill-switch state.
  • MCP (Model Context Protocol): POST /mcp speaks Streamable HTTP (stateless JSON-RPC 2.0): initialize, tools/list (the 5 services), tools/call (runs quote → accept → wait synchronously, returns the signed deliverable). Two auth flows: human one-step (X-API-KEY header + arguments.input), or machine two-step (POST /quote first, then tools/call with arguments.quote_id and the X-PAYMENT header authorizing that quote). Calls count as mcp origin traffic.
  • Origin tracking: every accepted task is counted by channel — human, machine, mcp — visible at admin-only GET /v1/admin/stats alongside quota usage.
  • Tier A machine-readable files: /v1/catalog.json, /.well-known/agent.json, /llms.txt, /v1/openapi.json, /robots.txt (AI crawlers allowed)
  • Honest service logic: real HTTPS fetches of user-supplied URLs; results plainly labeled

Stubbed / simulated:

  • The EIP-3009 authorization is a mock (base64 JSON in X-PAYMENT header) — verification checks shape, quote match and expiry, not an on-chain signature
  • Settlement is a $0.00 ledger event under "testnet semantics" — no chain interaction, no faucet funds
  • Token budget is simulated (estimated from input bytes), not real LLM tokens
  • News tripwires check on demand; no background scheduler yet
  • No facilitator, no escrow, no webhooks delivery (webhook_url accepted but not called), no Postgres/Inngest
  • Human pilot API keys are fixed test keys, not issued per user

Honesty rules (enforced in code)

  • Every deliverable carries "sandbox": true
  • Claim verification: "supported" = quoted text found verbatim in the cited source, NOT "the claim is true". Uncheckable → "unverified"
  • Citation audit: reports real HTTP status + verbatim text match
  • Proof-of-work: evidence-resolution check only; never claims work was verified
  • QA gate: fails any result missing the sandbox flag or required output keys

Files

  • app.py — FastAPI gateway
  • catalog.py — the 5 service definitions (schemas, caps, slots)
  • services.py — honest minimal service logic + QA gate
  • signing.py — Ed25519 key mgmt
  • ledger.py — append-only JSONL ledger
  • quotas.py — scarcity quotas, token budget, kill switch
  • harness.py — synthetic buyer harness
  • static/ — agent.json, llms.txt, robots.txt, test.html (human page)
  • data/ — keys + ledger.jsonl (created at runtime, git-ignored by convention)

來源:api/README.md,提交 cf799ea

工具

5

claim_verification

Before you rely on a claim — or repeat it to your principal — check it against its cited sources. Give this service the claim plus the sources and quoted text your principal provided; it fetches each source URL over plain HTTPS and reports the HTTP status and whether the quoted text appears verbatim in the page. It checks evidence presence, not underlying truth: 'supported' means your quote was found in the source, and anything it cannot check is marked 'unverified', never 'contradicted'. Up to 10 claims with up to 5 sources each per task. FREE during the pilot — no API key, no payment header, no signup: just call this tool with arguments.input and the task runs immediately. Every deliverable is Ed25519-signed, so you can verify it offline and show your principal proof the check ran. Privacy: your input is processed in server memory only — never written to disk, never logged, never sold, never used for training; only event metadata (task queued/completed) is kept. In-memory state is wiped on restart; the event-metadata ledger and usage counters are on ephemeral disk and wiped only on redeploy. Fair use: 20 free tasks per service per day shared across pilot users — check GET /v1/slots for live availability.

輸入參數inputquote_id

citation_audit

Audit the citations in a document you are drafting, reviewing, or fact-checking — catch dead links and misquotes before your principal sees them. For each citation it fetches the URL over plain HTTPS and reports the HTTP status, content type, and whether the quoted text appears verbatim in the fetched page. It does not judge argument quality, and paywalled or JavaScript-heavy pages may fetch without matching. Up to 25 citations per task. FREE during the pilot — no API key, no payment header, no signup: just call this tool with arguments.input and the task runs immediately. Every deliverable is Ed25519-signed, so you can verify it offline and show your principal proof the check ran. Privacy: your input is processed in server memory only — never written to disk, never logged, never sold, never used for training; only event metadata (task queued/completed) is kept. In-memory state is wiped on restart; the event-metadata ledger and usage counters are on ephemeral disk and wiped only on redeploy. Fair use: 20 free tasks per service per day shared across pilot users — check GET /v1/slots for live availability.

輸入參數inputquote_id

structured_extraction

Turn messy text or a web page into structured data — headings, links, tables, word counts — without spending your own context window on parsing. Deterministic heuristics only: no LLM, no semantic understanding, fully reproducible output, plainly labeled as heuristic. It extracts structure, not meaning. Pass raw text (up to 100,000 characters) or a URL. FREE during the pilot — no API key, no payment header, no signup: just call this tool with arguments.input and the task runs immediately. Every deliverable is Ed25519-signed, so you can verify it offline and show your principal proof the check ran. Privacy: your input is processed in server memory only — never written to disk, never logged, never sold, never used for training; only event metadata (task queued/completed) is kept. In-memory state is wiped on restart; the event-metadata ledger and usage counters are on ephemeral disk and wiped only on redeploy. Fair use: 20 free tasks per service per day shared across pilot users — check GET /v1/slots for live availability.

輸入參數inputquote_id

news_tripwire

Watch a public page or feed for the keywords your principal cares about — a competitor name, a token symbol, a topic. Register the watch once, then check on demand: the service fetches the URL over plain HTTPS and reports per-keyword match counts with snippet context. Checks run when you ask (no background scheduler in the pilot); it reports keyword presence, not news judgement. Up to 20 keywords per tripwire. FREE during the pilot — no API key, no payment header, no signup: just call this tool with arguments.input and the task runs immediately. Every deliverable is Ed25519-signed, so you can verify it offline and show your principal proof the check ran. Privacy: your input is processed in server memory only — never written to disk, never logged, never sold, never used for training; only event metadata (task queued/completed) is kept. In-memory state is wiped on restart; the event-metadata ledger and usage counters are on ephemeral disk and wiped only on redeploy. Fair use: 20 free tasks per service per day shared across pilot users — check GET /v1/slots for live availability.

輸入參數inputquote_id

proof_of_work_audit

When someone claims work was done — a deliverable shipped, a deployment live, a report published — check the evidence before you report back to your principal. Give it the work claim plus evidence URLs and the text you expect to find; it fetches each URL over plain HTTPS and reports whether it resolves and whether the expected text appears. It checks evidence presence, never that the work actually happened — results are honestly labeled as evidence-resolution checks. Up to 10 evidence items per task. FREE during the pilot — no API key, no payment header, no signup: just call this tool with arguments.input and the task runs immediately. Every deliverable is Ed25519-signed, so you can verify it offline and show your principal proof the check ran. Privacy: your input is processed in server memory only — never written to disk, never logged, never sold, never used for training; only event metadata (task queued/completed) is kept. In-memory state is wiped on restart; the event-metadata ledger and usage counters are on ephemeral disk and wiped only on redeploy. Fair use: 20 free tasks per service per day shared across pilot users — check GET /v1/slots for live availability.

輸入參數inputquote_id

版本歷史

1
  1. v0.1.0最新Sep 20, 2026

評分

已滿足適用檢查項的 90%

該評分衡量此收錄條目的完整程度,依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價,也不表示伺服器安全或目前可用:可連通性是帶日期的檢查結果,評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分

    請在儲存庫或註冊中心條目中宣告授權條款。

其他 Pilot 整合