VouchSpec Agent Skill Evidence

io.github.mordiaky由 GitHub 帳號 mordiaky 發布v0.3.0更新於 Nov 2, 2026

Read-only discovery for exact-commit Agent Skill validation, x402 payment, and signed receipts.

已驗證Streamable HTTP可網頁執行開發者工具安全與監控

概覽

AI 產生的概覽

遠端唯讀 MCP 端點，回傳 VouchSpec 關於精確提交版本 Agent Skill 證據、簽章回執與 x402 定價的公開契約。

可以做什麼
  • 提供唯一的匿名工具 get_vouchspec_discovery，回傳公開路由、價格、x402 付款、回執、快取與失效說明。
  • 說明如何存取託管驗證 API 與已簽章的公開目錄索引。
  • 指向回執查詢與生命週期狀態路由，用來核對既有證據。
  • 解釋 x402 付款流程與價格卡，但不提交任何內容。
  • 另有本機安裝版本，提供回執搜尋、回執與狀態查詢、驗證素材及價格報價。
適用情境
適合在助理需要了解如何查核或申請某個 Agent Skill 特定版本證據，或需要該服務的機器可讀契約與價格時使用。一般寫程式或瀏覽工作不需要安裝。
執行需求
託管端點無需安裝：它是遠端 Streamable HTTP 位址，未宣告驗證、環境變數或標頭。可選的本機目錄伺服器需要 Python、複製的儲存庫、目錄根路徑，以及獨立取得的根金鑰檔案。
安裝前請注意
託管工具為唯讀，不能提交成品、抓取儲存庫、完成付款或讀取私有資料。付費的新鮮驗證在另一條 REST 路由進行，價格為 Base 上的 0.25 USDC，需由具備明確支出授權的代理錢包簽章；沙盒使用 Base Sepolia 上的 1.00 測試 USDC。證據並非安全認證，且專案名稱尚未經過正式商標檢索。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 VouchSpec Agent Skill Evidence，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/io.github.mordiaky%2Fvouchspec/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。

{
  "mcpServers": {
    "vouchspec-agent-skill-evidence": {
      "type": "http",
      "url": "https://vouchspec.plyrium.com/api/vouchspec/v1/mcp"
    }
  }
}

README

VouchSpec

VouchSpec is the provisional public-beta name for an independent evidence index for exact Agent Skill versions. The name passed a $0 obvious-conflict screen; it has not received formal legal or trademark clearance.

The current Stage A catalog contains 25 deliberately selected public Agent Skills across 12 GitHub repository owners. Every entry is pinned to a full Git commit and exact directory digest, statically inspected without executing artifact code, wrapped in a DSSE v1.0.2 envelope, and signed with Ed25519. A separate root key signs the machine-readable lifecycle feed.

This is evidence, not a safety certification. Six of the 25 real-world skills fail at least one current structural rule; they remain indexed with the failure evidence and are not labeled STRUCTURE_VALIDATED.

Public Stage A distribution

The static distribution returns the exact checked-in signed bytes with CORS enabled and rejects writes. Download the signed index, filter it locally, then retrieve a receipt by ID from catalog/public/receipts/. For immutable retrieval, replace main with catalog snapshot 4404b7a9a2d3dc45b621ea694d2ca7ad666b9898. The out-of-band Gist is separate from the repository but shares its GitHub account, so an account-level compromise still requires a new trusted channel.

Product stages

  • Stage A — public artifact index (live): selected public artifacts only; signed receipts and read-only REST/MCP retrieval; no uploads, private repositories, or customer-confidential content.
  • Stage B — public repository validation (live mainnet plus public testnet sandbox): allowlisted public host, full commit, explicit subdirectory, bounded immutable retrieval, isolated no-egress worker, separate no-egress signing, durable tenant/order/payment state, an authenticated managed API, and exact x402 settlement. Commercial orders are live at 0.25 USDC on Base; the separate 1.00 test-USDC Base Sepolia sandbox remains available for integration testing.
  • Stage C — private/arbitrary inputs (deferred): private storage, authentication, tenant isolation, deletion policy, and expanded legal/incident controls only after demand and revenue justify them.

Stage C is not a prerequisite for Stage A or B. No arbitrary upload route exists in the Stage A server or MCP tools.

Publisher CI — complete self-service example

The public publisher-CI demo shows the complete trusted-workflow path: immutable action pins, exact-commit inspection, two GitHub artifact attestations, downloadable evidence, and independent gh attestation verify commands. The latest verified matrix run passes both a structural-pass case and an intentional structural-failure case. Its four downloaded evidence files independently verified with gh attestation verify. The demo is operator-controlled and is not counted as external adoption.

Use the action at its immutable evidence-preserving snapshot:

yaml
- id: vouchspec  uses: mordiaky/vouchspec/distribution/github-action@ed812a14cbc62333d59bac319f79d897f14d1b64  with:    skill-path: path/to/skill

The action emits a receipt draft and publisher/workflow binding for both structural passes and explicit structural failures. See the full pinned workflow, permissions, verification, and troubleshooting guide.

Evidence labels

Receipts use explicit labels, never a generic VERIFIED badge:

  • DIGEST_PINNED
  • STRUCTURE_VALIDATED (only when the structural profile passes)
  • STATIC_INSPECTION_COMPLETED
  • INDEPENDENT_STATIC_SCAN (only for the curated operator-run profile)

PUBLISHER_CI_ATTESTED, SANDBOX_BEHAVIOR_OBSERVED, and TASK_EVALUATED are reserved for separate evidence that has actually been produced. Static inspection never implies them.

Verify a public receipt independently

The verifier authenticates the exact decoded receipt bytes before parsing JSON, validates the receipt schema and inner consistency digest, then optionally applies the root-signed lifecycle feed.

powershell
vouchspec verify catalog\public\receipts\RECEIPT_ID.dsse.json `  --key catalog\public\keys\issuer.jwk.json `  --lifecycle catalog\public\lifecycle.dsse.json `  --root-key catalog\public\keys\root.jwk.json

Lifecycle results are CURRENT, SUPERSEDED, EXPIRED, REVOKED_EVALUATOR_DEFECT, REVOKED_KEY_COMPROMISE, or the conservative SIGNATURE_VALID_LIFECYCLE_UNKNOWN. The signing key ID is only a lookup hint; the public JWK must be obtained or pinned through an independently trusted path.

Read-only catalog API

powershell
vouchspec serve-catalog --catalog-root catalog\public --port 8788 `  --trusted-root-key C:\independently-provisioned\root.jwk.json

Available GET routes:

  • /health
  • /v1/index (issuer-signed DSSE index envelope)
  • /v1/quote?operation=... (price/availability response; paid orders remain disabled)
  • /v1/receipts?q=...&repository_owner=...&limit=...
  • /v1/receipts/{receipt_id}
  • /v1/receipts/{receipt_id}/status
  • /v1/lifecycle
  • /v1/keys/root
  • /v1/keys/issuer

All POST requests receive 405 read_only. The built-in server is connection-bounded, deadline-enforced, and loopback-only; a public deployment must place it behind a managed TLS proxy with platform ingress limits. Each process serves one fully verified immutable catalog snapshot; deploy a new lifecycle/index generation by restarting the process. The highest observed root-feed sequence and its payload digest are persisted with a cross-process lock.

The local catalog price-card route reports the commercial price hypothesis without accepting an order. For a strict request-specific local preview:

powershell
vouchspec quote-fresh-validation docs\examples\fresh-validation-request.json

The preview validates the same request shape used by the managed API. The public sandbox price is deliberately faucet-sized at 1.00 test USDC. Full agent-market research rejected the earlier $49 idea; the commercial mainnet launch cohort is an unvalidated 0.25 USDC per fresh validation, with the predeclared evidence gates in PRICING.md.

Agent-only x402 mainnet

The commercial service at https://vouchspec.plyrium.com is machine-only and has no card form, hosted checkout, account portal, or human approval step. An agent sends the strict immutable public-GitHub request to POST /api/vouchspec/v1/validate, receives an x402 v2 challenge for exactly 0.25 USDC on Base, signs it, and retries with PAYMENT-SIGNATURE. Successful settlement returns one-time delivery credentials; the scheduled isolated worker then produces the signed, content-addressed receipt. Discovery and health are public, and the Streamable HTTP MCP endpoint exposes read-only contract discovery. The same purchase contract is published as OpenAPI, llms.txt, A2A, x402, and a draft/proposal ARD catalog so agents can enter through the protocol they already index. Remedy execution remains disabled and is not a prerequisite for accepting or fulfilling ordinary paid validations.

Agent-only x402 sandbox

The public service at https://vouchspec-sandbox.plyrium.com has no card form, hosted checkout, or human approval step. An agent:

  1. accepts terms version vouchspec-stage-b-2026-07-14 at POST /api/vouchspec/v1/tenants and stores the one-time tenant bearer key;
  2. sends the strict fresh-validation request to POST /api/vouchspec/v1/quotes with Authorization and a unique Idempotency-Key;
  3. creates an order at POST /api/vouchspec/v1/orders and stores the returned delivery token;
  4. calls the order's purchase_path, reads the x402 v2 PAYMENT-REQUIRED challenge, signs the exact 1.00 test-USDC payment on Base Sepolia, and retries with PAYMENT-SIGNATURE;
  5. polls the authenticated order, retrieves the exact DSSE result, and verifies it with the public issuer JWK.

Successful envelopes are also published at a content-addressed unauthenticated URL. Agents may cache and share those immutable bytes. Invalidation is intentionally separate: check the corresponding no-store /status URL each time the receipt is used for a new decision. The machine-readable discovery document contains all route templates, headers, network, price, trust, caching, and product-boundary fields.

The hosted proof is owner-controlled and testnet-only, so it demonstrates mechanics but counts as no customer, request, buyer, or revenue. See the Stage B operating boundary, payment flow, managed deployment boundary, and refund policy, and mainnet remedy operations.

Local commerce harness

The repository still includes a loopback harness for regression and security testing. It stores keyed credential digests, never plaintext tokens, and binds each quote and order to one opaque tenant. Generate two distinct 32-byte secrets with an approved secret manager, expose their hex values only to the process, then provision one local sandbox credential:

powershell
$env:VOUCHSPEC_AUTH_PEPPER_HEX = '<64 hex characters>'$env:VOUCHSPEC_DELIVERY_SECRET_HEX = '<different 64 hex characters>'vouchspec provision-commerce-tenant --database C:\vouchspec\sandbox-commerce.dbvouchspec serve-commerce-sandbox --database C:\vouchspec\sandbox-commerce.db --port 8789

The local API binds to 127.0.0.1, has no CORS allowance, and exposes authenticated quote, order, status, signed-result, capability-rotation, and capability-revocation routes. Its fake payment rail never settles and every resulting order remains counts_for_goal: false.

An explicitly nonsettling Stripe-test adapter remains available for regression coverage only. It is not the VouchSpec launch rail and is not exposed by the managed agent service:

powershell
vouchspec serve-commerce-stripe-test `  --database C:\vouchspec\stripe-test-commerce.db --port 8789

Do not expose that built-in listener directly. Mainnet activation uses x402, separate live state and secrets, and the live gates in the deployment boundary.

Read-only catalog MCP

Remote agents can discover the commercial managed contract through the stateless Streamable HTTP endpoint at https://vouchspec.plyrium.com/api/vouchspec/v1/mcp. It exposes only get_vouchspec_discovery: an anonymous, read-only tool that returns public route, price, x402, receipt, cache, and invalidation instructions. It cannot submit artifacts, fetch repositories, settle payments, or read private data. Paid validation remains on the managed x402 REST route.

Agents that support the open Agent Skills format can add the repository's exact verify-before-install workflow directly:

powershell
npx skills add mordiaky/vouchspec --skill vouchspec-verify-before-install

The skill is also published through the well-known machine endpoint above. It discovers the live contract before acting, checks existing signed evidence first, and purchases a fresh 0.25 USDC validation only when the calling agent already has an x402 wallet and explicit spending authority. If either is absent it returns payment_required; there is no human checkout or human handoff.

The checked-in server.json describes this remote endpoint for the official MCP Registry under the active name io.github.mordiaky/vouchspec. Publication uses GitHub OIDC from a main-only manual workflow, so it needs no portal login, phone code, or dedicated Registry secret.

For agents that prefer a locally pinned catalog, the stdio server remains available:

Public install:

powershell
git clone https://github.com/mordiaky/vouchspec.gitcd vouchspecpython -m venv .venv.venv\Scripts\python -m pip install ..venv\Scripts\vouchspec mcp-catalog --catalog-root catalog\public `  --trusted-root-key C:\independently-provisioned\root.jwk.json
powershell
vouchspec mcp-catalog --catalog-root catalog\public `  --trusted-root-key C:\independently-provisioned\root.jwk.json

Tools are search_receipts, get_receipt, get_receipt_status, get_verification_material, and get_price_quote. They accept identifiers, search text, and named price-card operations only, not artifact content. This local read-only MCP does not place paid orders; agents use the managed x402 API for fresh validation.

Local inspector and builder

Development install:

powershell
python -m venv .venv.venv\Scripts\python -m pip install -e ".[dev]"

The compatibility command and Python package name capabilityproof remain available alongside the public vouchspec command.

powershell
vouchspec inspect C:\path\to\skill --output receipt.jsonvouchspec inspect-git C:\checkout\skills\example `  --repository-root C:\checkout --output receipt.json

Local inspection never installs, imports, renders, or executes artifact content. The checked-in catalog builder accepts only the curated manifest and public HTTPS GitHub repositories at full 40-character commits. Collection is keyless, issuer signing is a separate no-network phase, and recovery-root lifecycle signing is a separate offline phase. Encrypted private keys stay outside this repository; only RFC 8037 public JWKs are published.

See methodology, the receipt schema, and the threat model.

來源：README.md，提交 e0879b0

工具

0
SourceWeft 尚未讀取此伺服器的工具。

版本歷史

1
  1. v0.3.0最新Sep 16, 2026

評分

已滿足適用檢查項的 75%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具必需15 分

    請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分

    請在儲存庫或註冊中心條目中宣告授權條款。