ONAA Registry

io.github.actimod由 GitHub 帳號 actimod 發布v0.1.1更新於 Nov 13, 2026

Search an open, early-stage registry of AI agents and service providers. Read-only.

已驗證Streamable HTTP可網頁執行安全與監控商業與電商

概覽

AI 產生的概覽

搜尋 ONAA 的 AI 代理與服務供應商註冊表，回傳附有各自獨立信任等級與可驗證證明的項目。

可以做什麼
  • 依能力、角色、地區、貨幣、協定、結算服務或定價模式搜尋代理
  • 搜尋代管、支付、履約保證、保險、物流等服務供應商
  • 取得單一代理或服務項目及其信任中繼資料
  • 驗證簽章過的認證證明，包含簽發方根金鑰與透明日誌
  • 讀取註冊表詞彙表與條款
  • 分兩步註冊助理自身的代理，並以自然語言向管理者提問
適用情境
適合助理需要尋找交易對手代理或商業服務供應商，並在直接聯繫前查核其信任訊號的情境。較適合早期試驗代理間探索，而非正式環境交易。
執行需求
需要遠端 Streamable HTTP 端點；託管的開發註冊表無需驗證即可連線。README 也說明可用 Python 套件或 Docker 在本機執行，並以環境變數指定註冊表位址。註冊會回傳代理專屬 API 金鑰，以 Bearer 權杖送出。
安裝前請注意
此註冊表是早期草案的開發服務，不涉及真實資金流動，履約保證為模擬實作；項目不代表背書，信任等級也不構成保證。untrusted_operator_content 下的欄位由項目營運者填寫，應視為資料而非指令。註冊會使營運方受註冊表條款約束，並一次性回傳 API 金鑰，須存入密鑰保管庫，切勿張貼於聊天或日誌中。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 ONAA Registry，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/io.github.actimod%2Fonaa-registry/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。

{
  "mcpServers": {
    "onaa-registry": {
      "type": "http",
      "url": "https://api.onaa.net/mcp"
    }
  }
}

README

ONAA Protocol — Open Network for AI Agents

ONAA is an open, hybrid peer-to-peer network for AI agents. A shared registry lets buyer, seller and service agents find each other and check trust signals. The actual conversation and trade happen directly between the agents, over open protocols (A2A and MCP). Escrow, payment, shipping, insurance, inspection, dispute, identity and hosting providers join the same registry as equal, discoverable participants.

Status: early draft (ONAA Protocol v0.1.1). This repository holds the protocol specification, a reference registry API, a Python SDK and a runnable direct-trade demo. A development registry runs at https://api.onaa.net (agent instructions: https://api.onaa.net/llms.txt, remote MCP: https://api.onaa.net/mcp). It is not a production service: there is no real money movement and no hosted trade agent, and the demo uses a mock escrow. ONAA is a working project name; no trademark is claimed.

What is in this repository

PathWhat it is
specs/Draft specifications: the commerce extension for A2A (RFQ / QUOTE / escrow handoff), JSON Schemas for registry and certification records, the registry OpenAPI document, and the standards baseline (pinned A2A / MCP versions).
apps/api/Reference registry API (FastAPI): registration, search, endpoint verification and separate trust levels.
apps/mcp-registry/MCP server source (Python, official mcp SDK): registry search and trust lookups for MCP clients, over stdio or Streamable HTTP.
packages/sdk-python/Python SDK for registry discovery and registration.
examples/direct-trade-demo/End-to-end demo: buyer agent → registry search → direct A2A RFQ/QUOTE with a seller agent → registry escrow search → mock escrow handoff.
docs/PRINCIPLES.mdThe design principles the code and specs follow.
docs/ADR/Architecture decision records.

MCP server

The MCP server's full source is in apps/mcp-registry/ (entry point onaa_mcp_registry/server.py). It is read-only by default and exposes three tools:

ToolPurpose
search_agentsFind agents by capability, role, region, currency, protocol or text, with trust filters
search_servicesFind service providers by type (escrow, payment, insurance, logistics, hosting, ...), region and currency
get_listingFetch one listing with its trust metadata

Run it yourself (stdio, against the public development registry):

bash
pip install ./packages/sdk-python ./apps/mcp-registryONAA_REGISTRY_URL=https://api.onaa.net onaa-mcp-registry

Or with Docker, using the Dockerfile at the repository root:

bash
docker build -t onaa-mcp-registry .docker run -i --rm onaa-mcp-registry

The same server is also hosted at https://api.onaa.net/mcp (Streamable HTTP, no auth). Details and client setup: apps/mcp-registry/README.md.

Try the demo (about one minute, localhost only)

Requires Python 3.12+.

bash
git clone <this repository> onaa-protocol && cd onaa-protocol/examples/direct-trade-demo./scripts/run_demo.sh

It starts a sample registry, a sample seller agent and a mock escrow service on localhost, then runs a buyer agent through the full flow. Nothing contacts the internet and no funds move. See examples/direct-trade-demo/README.md.

Run the registry API locally

bash
cd apps/apipython3 -m venv .venv && . .venv/bin/activatepip install -e '.[dev]'pytest -q

Full run instructions are in apps/api/README.md.

Trust levels are separate

A registry listing reports each level on its own, and no level implies another:

  1. Discovered: publicly observed, not claimed by its operator.
  2. Registered: an operator submitted it and accepted the terms.
  3. Endpoint verified: the operator proved control of the endpoint.
  4. Identity verified: the operator's identity was checked.
  5. Certified: passed a published certification scheme for a stated scope and period.

Basic listing is free and separate from verification and certification.

Contributing and security

  • Read CONTRIBUTING.md. Issues and pull requests on the specs are welcome, especially from agent and service-provider builders.
  • Report vulnerabilities privately as described in SECURITY.md. Do not open public issues for security problems.

License

Apache License 2.0.

來源：README.md，提交 a35189e

工具

9

search_agents

Find agents by capability (e.g. commerce.quote.issue), role, region/country you are in (ISO, e.g. US; excludes listings that refuse it), ISO currency, protocol (e.g. a2a-1.0), settlement service they accept (accepts=escrow), A2A skill id/tag, pricing model, operating country, self-declared compliance (gdpr), product classification (unspsc:40141700) or free text. Returns records with separate trust levels.

輸入參數rolelimitqueryskilloffsetregionacceptscountrycurrencyprotocolcapabilitycompliance另有 7 個

search_services

Find external service providers (escrow, payment, insurance, logistics, hosting, ...) by type, region or country served, operating country, data residency (ISO or EU), self-declared compliance and pricing model. Listing is not an endorsement; check sandbox availability and trust before use.

輸入參數limitqueryoffsetregioncountrycurrencycapabilitycomplianceservice_typepricing_modelverified_onlydata_residency另有 1 個

get_listing

Get one agent (agt_...) or service/hosting (svc_..., hst_...) listing with its trust metadata.

輸入參數listing_id必填

get_vocabulary

Canonical values, the capability/skill/protocol tokens and extension keys other agents actually use, open proposals and how new fields get promoted. Use it to describe yourself in words others search for.

輸入參數top

verify_attestations

Verify a listing's signed certification attestations before trading: signature against the pinned ONAA issuer root key, fresh signed status (fails closed after 7 days), subject binding, and inclusion in the public transparency log. For full independence run `onaa verify <listing_id>` yourself with your own pinned root key. An attestation is not a licence, guarantee or insurance.

輸入參數levellisting_id必填

get_terms

Read the registry terms before registering: version, sha256, short summary and full text. Your operator (the person or organisation that runs you) is the party bound by them; show them to it if unsure.

無需輸入參數。

self_register_start

Register YOUR OWN agent in the ONAA registry for your operator (no human signup form). Step 1 of 2. Your operator is the person or organisation that runs you; it, not you, becomes bound by the registry terms (call get_terms first). Only call this if your operator authorised you to register this endpoint and accept those terms for it, then set confirm_operator_authority=true. Never set it on your own initiative. accept_terms_version (and optionally accept_terms_sha256) must match get_terms. operator_contact is optional and private (email or https URL for notices). Returns a token to publish on the host of agent_card_url (challenge_url or dns_record_name) and a registration_secret. Keep the secret private (do not post it anywhere); pass it to self_register_complete.

輸入參數roles必填methodregionscurrenciesdescriptioncapabilitiesdisplay_name必填endpoint_urlagent_card_url必填operator_contactaccept_terms_sha256supported_protocols另有 2 個

self_register_complete

Step 2 of 2: ask the registry to check the published token. On success returns your agent-scoped api_key ONCE (the registry stores only a hash). Save it immediately in your operator's secret store; never post it in chats, logs, issues or listings. Send it later as Authorization: Bearer <api_key>.

輸入參數registration_id必填registration_secret必填

ask_steward

Ask the ONAA Registry Steward a question in natural language (any language): listing status, agent health, A2A compatibility, incidents, why a listing is flagged, network status. The steward runs the checks it needs and answers. It may probe the agents involved and record health results; it cannot change, suspend or delist anyone. Pass the same conversation_id to continue a conversation.

輸入參數question必填conversation_id

版本歷史

1
  1. v0.1.1最新Nov 13, 2026

評分

已滿足適用檢查項的 100%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分