GAIP Trust & Assurance Agent

io.github.tjcgraham-rgb由 GitHub 帳號 tjcgraham-rgb 發布v1.5.0更新於 Oct 31, 2026

Now part of GAIP Witness: verifies GAIP receipts; evidence packs and incident bundles.

已驗證Streamable HTTP可網頁執行安全與監控AI 與機器學習

概覽

AI 產生的概覽

GAIP 信任與保證代理：免費、唯讀的遠端 MCP 伺服器，回傳關於 AI 代理、MCP 伺服器與供應商的簽章收據與證據。

可以做什麼
  • 在委派前檢視對方代理的證據，包含涵蓋範圍、衝突與缺口
  • 為某個主體（代理或供應商）彙整證據包，含合規、監控、見證、修復與事件紀錄及 Merkle 證明
  • 驗證 GAIP 收據的完整性，並匯出為 x402、erc8004 或類 W3C-VC 的 JSON-LD
  • 依收據 ID 與觀察紀錄產生具來源歸屬的事件時間軸
  • 檢查 x402 SAR 形式收據的缺漏欄位、ID 是否相符及簽章是否有效
適用情境
適用於助理需要判斷是否委派給另一個代理，或保險方、稽核方、買方、事件應變人員需要關於某代理或供應商、附日期且可驗證的證據時。它提供的是觀察紀錄，而非信任評分、認證或責任認定。
執行需求
遠端 streamable HTTP 端點 www.gaipagents.com/mcp；無需登入、API 金鑰或環境變數。輸入須為公開且非個人的識別碼或網址。
安裝前請注意
回答是特定時點的觀察紀錄，不構成認證、背書、排名，也不是法律、財務或保險建議。收據驗證只證明完整性，不證明所述內容為真。輸入會傳送給第三方服務，請勿提交個人或機密資料。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 GAIP Trust & Assurance Agent，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/io.github.tjcgraham-rgb%2Fgaip-trust-assurance/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。

{
  "mcpServers": {
    "gaip-trust-assurance-agent": {
      "type": "http",
      "url": "https://www.gaipagents.com/mcp/agents/trust-assurance"
    }
  }
}

README

GAIP

[GAIP logo]

GAIP, the Governed Agentic Intelligence Platform, keeps an independent, dated record of what AI agents, MCP servers and online shops publish, and answers questions about that record with signed receipts. Free, read-only, no key; facts at a stated time, never an assessment.

First call: gaip_check with a url on https://www.gaipagents.com/mcp. This one runs as-is; then use the URL of the agent, MCP server or API you care about:

bash
curl -s https://www.gaipagents.com/mcp \  -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' \  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"gaip_check","arguments":{"url":"https://mcp.deepwiki.com/mcp"}}}'

Without MCP: GET https://www.gaipagents.com/v1/free/conformance/check?url=<url>.

The map: every question GAIP answers, grouped by who asks, with its tool and HTTP route: https://www.gaipagents.com/v1/free/map. Every completed answer carries a continuity handle; send it back and the answer is bound to your own history with GAIP.

One line to connect

WhereOne line
Any MCP clienthttps://www.gaipagents.com/mcp (streamable HTTP, no sign-in)
Claude Codeclaude mcp add --transport http gaip https://www.gaipagents.com/mcp, or the plugin (MCP server and skill): /plugin install gaip --marketplace tjcgraham-rgb/gaip-agents
Claude Desktop / claude.aiCustomize > Connectors > Add custom connector, URL https://www.gaipagents.com/mcp, no sign-in
Agent Skills (Claude Code, Cursor, Codex and others)npx skills add tjcgraham-rgb/gaip-agents (installs skills/gaip/SKILL.md)
Cursor, VS Codethe buttons below, or { "mcpServers": { "gaip": { "url": "https://www.gaipagents.com/mcp" } } }
Gemini CLIgemini extensions install https://github.com/tjcgraham-rgb/gaip-agents
OpenAI Agents SDKHostedMCPTool(tool_config={"type": "mcp", "server_label": "gaip", "server_url": "https://www.gaipagents.com/mcp", "require_approval": "never"})
Vercel AI SDKawait createMCPClient({ transport: { type: 'http', url: 'https://www.gaipagents.com/mcp' } }) (from @ai-sdk/mcp)
LangChainpip install langchain-gaip, then from langchain_gaip import get_tools
CrewAIAgent(..., mcps=["https://www.gaipagents.com/mcp"])
A2A (1.0 and 0.3.0)agent card https://www.gaipagents.com/.well-known/agent-card.json; plain text works
x402nothing to set up: GAIP is free and never answers with HTTP 402 (https://www.gaipagents.com/.well-known/x402)
Windsurf~/.codeium/windsurf/mcp_config.json: { "mcpServers": { "gaip": { "serverUrl": "https://www.gaipagents.com/mcp" } } }
Cline{ "mcpServers": { "gaip": { "type": "streamableHttp", "url": "https://www.gaipagents.com/mcp" } } } (see llms-install.md)
Everything else, with copy-paste codehttps://www.gaipagents.com/docs/quickstart

[Add to Cursor] [Install in VS Code]

In CI: two GitHub Actions

GAIP Watch fails your build when an MCP server or agent your agent depends on changed its tools, schemas, sign-in or prices, with dated receipts (watch/):

yaml
- uses: tjcgraham-rgb/gaip-agents/watch@main  with:    urls: https://mcp.example.com/mcp

GAIP Agents check runs gaip_check on your own agent card, MCP server or OpenAPI document on every push:

yaml
- uses: tjcgraham-rgb/gaip-agents@v1  with:    agent-url: https://your-agent.example/.well-known/agent-card.json    fail-on-error: "true"

Outputs: verdict (READY, FIXES_NEEDED, UNREACHABLE or NOT_CHECKED), receipt-id, error-count, warning-count. Providers can show their own dated record with the badge https://www.gaipagents.com/v1/free/watch/badge.svg?url=<your endpoint>.

In this repository

PathWhat it is
registry/The Official MCP Registry records: gaip-broker.json (GAIP itself) and one record per specialist agent
listing-kit.jsonThe sentence, the first call, the map's rows, endpoints and example calls for directories (also served at /v1/free/discovery/listing-kit)
skills/gaip/SKILL.mdGAIP as an Agent Skill (agentskills.io format; also served at /.well-known/agent-skills/gaip/SKILL.md)
.claude-plugin/Claude Code plugin and marketplace manifests: the skill plus the remote MCP server
.cursor-plugin/plugin.json, mcp.jsonCursor plugin manifest and its MCP server
gemini-extension.json, GEMINI.mdGemini CLI extension: installs GAIP's MCP server and tells the model when to use each tool
packages/gaip-check/Python client: check_agent("https://other-agent.example")
action.yml, packages/gaip-check-action/The check Action (uses: tjcgraham-rgb/gaip-agents@v1)
watch/The GAIP Watch Action
packages/aipref-signals/Dependency-free parser and test vectors for AI-preference signals (IETF AI Preferences Content-Usage, RSL licence links, W3C TDMRep, Content Signals)
assets/GAIP logo (SVG, and a 400×400 PNG) and the specialist icons (SVG)
llms-install.mdInstall steps for AI assistants that set up MCP servers themselves (Cline)

The registry records, listing kit, packages, Watch Action, skill and Gemini extension are copies of what GAIP's service generates; a check in the service's repository warns when a copy here falls out of step. The service itself runs at www.gaipagents.com.

What an answer means

Every answer states what was observed and when. It is not a certification, endorsement, ranking or universal score, and not legal, financial or insurance advice. Receipts are signed with GAIP's Ed25519 key, published at https://www.gaipagents.com/.well-known/gaip-receipt-keys.json.

Licence

MIT (see LICENSE) for everything in this repository.

來源：README.md，提交 0bfeca4

工具

6

inspect_counterparty_evidence

What evidence exists about this agent?

Use this when asked what evidence exists about an agent before delegating to it. Pass its `counterparty_id` and any `observations`. Returns task-specific evidence coverage, conflicts, gaps and GAIP's own earlier checks of it, with a receipt. Never a trust score or recommendation. Free, read-only, no account; inputs must be public and non-personal.

輸入參數syntheticepisode_idtask_classmax_age_daysobservationscounterparty_idcontinuity_handledata_classificationindependent_operator_id

gaip_receipt_export

Export a GAIP receipt

Use this when you need a GAIP receipt in another format. Pass `receipt_id` and `format`: x402 (attestation style), erc8004 (validation-response shape) or vc (W3C-VC-like JSON-LD). Ed25519-signed when the runtime key is available; hash chain and Merkle proof; no on-chain write. Free, read-only, no account; inputs must be public and non-personal.

輸入參數format必填receipt_id必填

verify_gaip_receipt

Verify a GAIP receipt

Use this when you hold a GAIP receipt_id and want to confirm it ("is this receipt genuine?"). Returns the retained record, hash chain and Merkle inclusion proof. Integrity only: it does not make the underlying claim true. Free, read-only, no account; inputs must be public and non-personal.

輸入參數syntheticepisode_idreceipt_id必填continuity_handledata_classificationindependent_operator_id

gaip_evidence_pack

Build an evidence pack

Use this when an insurer, auditor or buyer asks what evidence exists about an agent or supplier. Pass its `subject` (public id or https URL). Returns conformance, watch, witness, repair and incident records with Merkle proofs, plus gaps. A compilation, not certification or advice. Free, read-only, no account; inputs must be public and non-personal.

輸入參數scopesubject必填requester

gaip_incident_bundle

Build an incident evidence bundle

Use this when something went wrong with an agent and you need the facts in order. Pass the `receipt_ids` you hold and attributed `observations`. Returns a verified, source-attributed timeline with an EU AI Act Art. 73 reference aid. No fault, cause or liability finding. Free, read-only, no account; inputs must be public and non-personal.

輸入參數titlereceipt_idsobservationsai_system_refdata_classification

gaip_check_sar_receipt

Check an x402 SAR receipt

Use this when handed an x402 SAR-shaped receipt (draft proposal shape; may change). Pass `sar_receipt`, optionally the issuer's `public_key`. Returns missing fields, whether receipt_id matches the core and whether the signature checks out against that key. Free, read-only, no account; inputs must be public and non-personal.

輸入參數public_keysar_receipt必填

版本歷史

6
  1. v1.5.0最新Oct 10, 2026
  2. v1.4.0Oct 2, 2026
  3. v1.2.0Sep 30, 2026
  4. v1.1.1Sep 29, 2026
  5. v1.1.0Sep 28, 2026
  6. v1.0.0Sep 27, 2026

評分

已滿足適用檢查項的 100%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分