Otr Protocol

io.github.yb48666-ctrl由 GitHub 帳號 yb48666-ctrl 發布v3.1.0更新於 Oct 24, 2026

Merchant trust verification for AI agents. One call = trust score, badge, and purchase safety.

已驗證STDIO僅桌面安全與監控商業與電商

概覽

AI 產生的概覽

本機 MCP 伺服器，讓 AI 助理在推薦購買前查詢商家信任分數、徽章與安全狀態。

可以做什麼
驗證商家：一次呼叫回傳 0-100 信任分數、徽章、六維評分明細、安全狀態與網站類別；非商業網站只回傳身分訊號，不給分數。搜尋註冊表：分頁回傳商家清單及其分數、徽章與建議。
適用情境
適合助理參與購物或代理式商務、需要在推薦商家前做一次確定性的可信度查核時。對不販售商品的非商業網站意義不大，因為這類網站不計分。
執行需求
透過 stdio 在本機執行，通常以 npx 從 npm 套件啟動。未宣告驗證、環境變數或請求標頭。依賴 OTR 評分服務與公開資料來源，需要網路存取。
安裝前請注意
分數僅供參考；README 說明低徽章結果應提示使用者自行核實，安全狀態為危險時無論分數高低都不應推薦。此伺服器只讀取註冊表資料，不會下單或修改商家紀錄。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Otr Protocol，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Desktop only，透過 STDIO。 STDIO 服務會啟動本機處理程序，因此需要 SourceWeft 桌面主機。

其他 MCP 客戶端

參照 儲存庫 中的啟動說明。

README

[OTR Protocol]

OTR Protocol

The merchant trust layer for AI agent commerce
Deterministic, verifiable, open-source merchant trust scoring for the agentic economy
Protocol v4.1

[npm] [MIT License] [GitHub Stars] [Issues]

Specification • Scoring Algorithm • Quick Start • Packages • Contributing

The Problem

AI agents are increasingly making purchase decisions on behalf of consumers. The agentic commerce stack is taking shape -- but there is a critical missing layer:

┌──────────────────────────────────────────────────────────────────┐│                  AI Agent Commerce Protocol Stack                 │├──────────────────────────────────────────────────────────────────┤│                                                                   ││   Visa TAP ·············· Agent Identity Verification             ││   Google UCP ············ Structured Data Exchange                 ││   Stripe ACP ············ Payment Processing                      ││                                                                   ││   ┌───────────────────────────────────────────────────────────┐   ││   │  OTR Protocol ·····  MERCHANT TRUST VERIFICATION  ◀━━━━━ │   ││   │                      "Is this merchant safe to buy from?" │   ││   └───────────────────────────────────────────────────────────┘   ││                                                                   ││   Visa TAP answers "Who is the AI agent?"                         ││   Google UCP answers "What products are available?"               ││   Stripe ACP answers "How do I pay?"                              ││   OTR answers "Should I trust this merchant?"  ◀━━ ONLY OTR      ││                                                                   │└──────────────────────────────────────────────────────────────────┘

Without OTR, AI agents operate blind -- unable to distinguish a legitimate retailer from a sophisticated scam site. This exposes consumers to fraud and erodes trust in the entire agentic commerce ecosystem.

The Solution

OTR (Open Trust Registry) provides deterministic, verifiable merchant trust scores using 6 verification dimensions, a 10-layer anti-fraud pipeline (Layer 0: Google Web Risk one-vote veto + Layers 1-9: core detection engine), and three-layer immutable audit trail. It is fully open-source (MIT), machine-readable, and designed from the ground up for AI agent consumption.

Key Properties

  • Deterministic -- Same inputs always produce identical outputs. Any validator can reproduce any score.
  • Verifiable -- All data sources are publicly accessible. No hidden factors or proprietary signals.
  • Unforgeable -- Verification dimension weighted at 40% in public assessment. SEC filings, Wikidata entries, and 10-year domain age cannot be faked.
  • Tamper-proof -- SHA-256 hash chain + Base L2 blockchain anchoring + IPFS monthly snapshots.
  • Fair -- No pay-for-trust. Scores reflect behavior, not subscription level.
  • Category-aware -- Three site categories (ecommerce / saas / non_commerce) with tailored scoring weights.
  • Safety-first -- Google Web Risk Layer 0 one-vote veto: flagged domains get score=0, status SUSPENDED.

Quick Start

bash
# Verify any merchant instantlynpx @otr-protocol/validator verify nike.com
# Output:# ┌──────────────────────────────────────────────┐# │  nike.com                             GOLD   │# │  Trust Score: 88/100   Category: ecommerce   │# │  OTR-ID: OTR-1C-7F3A2B9E4D1C-K4             │# │                                              │# │  Verification:   85  ██████████████░░        │# │  Security:       80  █████████████░░░        │# │  Governance:     72  ████████████░░░░        │# │  Transparency:   75  ████████████░░░░        │# │  Data Quality:   65  ██████████░░░░░░        │# │  Fulfillment:    --  (COLD mode)             │# └──────────────────────────────────────────────┘

For AI Agents (MCP Server)

The OTR MCP Server uses the standard Model Context Protocol and works with all MCP-compatible clients.

Claude Desktop / Claude Code -- add to claude_desktop_config.json:

json
{  "mcpServers": {    "otr": {      "command": "npx",      "args": ["@otr-protocol/mcp-server"]    }  }}

Cursor / Windsurf / Cline -- same configuration in .cursor/mcp.json or equivalent. Any client implementing the MCP specification works out of the box.

Now any AI agent can verify merchants in natural language:

"Is nike.com trustworthy?" --> OTR returns trust score 88/100, badge GOLD, and a 6-dimension breakdown (Verification, Security, Governance, Transparency, DataQuality, Fulfillment) with evidence sources.

Two MCP Tools — One Call = Complete Answer

ToolDescriptionReturns
verify_merchantComplete merchant profile in one callTrust score (0-100), badge, 6-dimension breakdown, safety status (Google Web Risk), site classification (ecommerce/saas/non_commerce), entity data, policy URLs, data sources
search_registrySearch the OTR merchant registryPaginated merchant list with scores, badges, and recommendations

Design philosophy: AI agents should get everything they need in a single tool call. verify_merchant returns trust assessment + purchase capabilities + links + policy URLs + data freshness — no need to chain multiple calls.

TypeScript SDK

typescript
import { OtrClient } from "@otr-protocol/sdk";
const otr = new OtrClient();const result = await otr.verify("nike.com");
console.log(result.trustScore);   // 88console.log(result.badge);        // "GOLD"console.log(result.dimensions);   // { verification: 85, security: 80, ... }
// Search the registryconst results = await otr.search("electronics", { minScore: 70 });

Core Scoring Engine

typescript
import { calculateTrustScore } from "@otr-protocol/core";
// Deterministic: same inputs always produce identical outputsconst result = calculateTrustScore({  hasSecFiling: true,  hasStockSymbol: true,  stockExchange: "NYSE",  hasWikidataId: true,  trancoRank: 500,  domainAgeYears: 15,  // ... 40+ evidence fields});
console.log(result.trustScore);  // 88console.log(result.badge);       // "GOLD"console.log(result.tier);        // "TIER_4"

Architecture

                         ┌─────────────────────────────────┐                         │       AI Agent / Application      │                         │   "Should I buy from example.com?" │                         └──────────────┬──────────────────┘                                        │                    ┌───────────────────┼───────────────────┐                    │                   │                    │              ┌─────▼─────┐     ┌──────▼──────┐    ┌──────▼──────┐              │ MCP Server │     │  REST API   │    │   SDK       │              │  (stdio)   │     │  /api/otr   │    │  npm pkg    │              └─────┬──────┘     └──────┬──────┘    └──────┬──────┘                    │                   │                    │                    └───────────────────┼───────────────────┘                                        │                         ┌──────────────▼──────────────┐                         │      OTR Scoring Engine       │                         │   @otr-protocol/core          │                         │                               │                         │  ┌─────────────────────────┐  │                         │  │ 6 Dimension Evaluators   │  │                         │  │ Verification | Security  │  │                         │  │ Governance | Transparency│  │                         │  │ DataQuality | Fulfillment│  │                         │  └─────────────────────────┘  │                         │  ┌─────────────────────────┐  │                         │  │ 10-Layer Anti-Fraud      │  │                         │  │ Domain Age | SSL | DNS   │  │                         │  │ Pattern | Tranco | ...   │  │                         │  └─────────────────────────┘  │                         │  ┌─────────────────────────┐  │                         │  │ Brand Fast-Track         │  │                         │  │ SEC + Tranco + Wikidata  │  │                         │  └─────────────────────────┘  │                         └──────────────┬──────────────┘                                        │              ┌─────────────────────────┼─────────────────────────┐              │                         │                          │     ┌────────▼────────┐    ┌──────────▼──────────┐    ┌─────────▼─────────┐     │  Public Data     │    │  Merchant Bridge     │    │  Immutable Audit   │     │  Sources         │    │  (Verified Only)     │    │  Trail             │     │                  │    │                      │    │                    │     │  SEC EDGAR       │    │  Product Catalog     │    │  SHA-256 Hash      │     │  Wikidata        │    │  Order Data (agg)    │    │  Chain             │     │  Tranco List     │    │  Delivery Metrics    │    │  Base L2 Anchoring │     │  DNS Records     │    │  Tracking Numbers    │    │  IPFS Snapshots    │     │  SSL Certs       │    │  (desensitized)      │    │                    │     │  Finnhub.io      │    │                      │    │                    │     │  Google Web Risk │    │                      │    │                    │     │  Website Scan    │    │                      │    │                    │     └─────────────────┘    └──────────────────────┘    └───────────────────┘

How Scoring Works

6 Trust Dimensions

Weights vary by site category:

#DimensionE-Commerce COLDSaaS COLDAUTH ModeWhat It Measures
1Verification0.400.370.10Stock exchange, Wikidata, GLEIF LEI, domain age, Tranco rank, payment processors
2Security0.150.200.10SSL/TLS, DMARC, SPF, DKIM, HSTS, DNSSEC, CSP, CAA, WAF, security.txt (15 signals)
3Governance0.200.230.10Privacy policy, GDPR/CCPA, terms, refund/return, shipping, cookie consent (10 signals)
4Transparency0.100.150.05robots.txt, sitemap, Schema.org, hreflang, AI crawler policy, llms.txt, about page
5Data Quality0.150.050.25E-commerce: 22 product data signals. SaaS: 12 platform signals (API docs, SLA, pricing, security certs)
6Fulfillment----0.40Delivery speed, return window, tracking, shipping policy (COLD mode: not scored)

What Each Dimension Measures

DimensionEvaluates
Verification (V)Is this a real, registered business? SSL certificate type, GLEIF LEI, Wikidata entity, SEC filings, domain age, payment processor detection
Security (S)Is the site technically secure? DMARC, SPF, DKIM, HSTS, CSP, WAF, DNSSEC configuration
Governance (G)Does it follow business rules? Privacy policy, refund policy, shipping policy, cookie consent, regulatory compliance
Transparency (T)Is it machine-readable? robots.txt, Schema.org structured data, llms.txt, protocol endpoint availability
Data Quality (D)Is product/service data complete? Product count, image coverage, price format consistency, category taxonomy depth
Fulfillment (F)Does it deliver on promises? Order completion rate, delivery time, return rate, dispute rate (AUTH mode only — requires merchant data)

Why Weights Differ by Category

  • E-commerce: Verification weighted highest (0.40) because buyers need to trust the store before purchasing. Identity signals (SEC filings, Wikidata, domain age) are the strongest defense against fraudulent shops.
  • SaaS: Security (0.20) and Governance (0.23) weighted higher because SaaS platforms handle user data and need clear policies. Users entrust ongoing access to their information.
  • Non-commerce: Not scored. Sites that do not sell products or services lack applicable commerce dimensions (product data, checkout, fulfillment).

Three Site Categories

CategoryDescriptionScoring
ecommerceOnline stores selling physical/digital productsFull 6-dimension scoring with product D signals
saasSoftware-as-a-Service platformsTailored weights (V=37%, G=23%) with 12 SaaS D signals
non_commerceNon-commercial sites (Wikipedia, government, etc.)Not scored -- returns identity signals only

Non-Commerce Sites

Sites classified as non_commerce (e.g., Wikipedia, government portals, news sites) are not scored:

  • trustScore: null
  • badge: null
  • scanStatus: "non_commerce"
  • Basic verification data (SSL, entity info) is still returned, but no numerical trust score is assigned.

Reason: Non-commerce sites do not sell products or services, so trust scoring dimensions (product data, checkout, fulfillment) do not apply.

OTR-ID

Unique identifier assigned to each evaluated domain.

Format: OTR-1{mode}-{fingerprint}-{checksum}

  • 1 — Protocol version
  • mode — C (COLD: pre-authorization scan) or A (AUTH: merchant authorized)
  • fingerprint — 12 uppercase hex chars, derived from SHA-256 of the normalized domain (first 48 bits)
  • checksum — 2 Base36 chars (Luhn mod-36 validation + deterministic salt)
Example: OTR-1C-7F3A2B9E4D1C-K4

Properties:

  • Deterministic: Same domain always produces the same fingerprint
  • Irreversible: SHA-256 is cryptographically one-way; truncated to 48 bits, the original domain cannot be recovered
  • Collision-resistant: ~281 trillion possible fingerprints (2^48)

Lifecycle:

EventResultStatus
First scanOTR-1C generatedACTIVE
Merchant authorizesUpgraded to OTR-1A (same fingerprint, recalculated checksum)UPGRADED
Domain identity change detectedOTR-ID revoked (set to NULL), domain re-enters cold-startREVOKED
Google Web Risk flags domainScore forced to 0SUSPENDED
Anti-gaming multiplier < 0.10Score forced to 0SUSPENDED

Identity change is detected when weighted signals exceed threshold 3: GLEIF entity mismatch (3), nameserver change (2), content similarity < 30% (2), Wikidata P856 mismatch (2), domain parking > 90 days (2), SSL organization change (1).

Google Web Risk (Layer 0 Safety)

Google Web Risk operates as a Layer 0 one-vote veto, separate from dimension scoring:

  • Flagged domain → trustScore = 0, otrIdStatus = SUSPENDED, safety.googleWebRisk = true
  • Does not participate in dimension weight calculation
  • Overrides all other signals regardless of their values

Two Scoring Modes

COLD Mode: Public Assessment (no merchant cooperation needed)═══════════════════════════════════════════════════════════════  E-Commerce: V (0.40) + S (0.15) + G (0.20) + T (0.10) + D (0.15) = Score  SaaS:       V (0.37) + S (0.20) + G (0.23) + T (0.15) + D (0.05) = Score
  Nike (ecommerce):   V=85×0.40 + S=80×0.15 + G=72×0.20 + ...  = 83 GOLD  Scam site:          V=10×0.40 + S=100×0.15 + G=90×0.20 + ...  = 39 UNRATED                                                                    ↑ can't game Verification

AUTH Mode: Verified Merchant (merchant provides API access)═══════════════════════════════════════════════════════════════  F (0.40) + D (0.25) + V (0.10) + S (0.10) + G (0.10) + T (0.05) = Score
  Good merchant:   F=90×0.40 + D=85×0.25 + ...  = 78 SILVER  Bad merchant:    F=30×0.40 + D=40×0.25 + ...  = 38 UNRATED                                                    ↑ bad fulfillment = low score

Trust Badges

BadgeScoreAI Agent Action
PLATINUM90-100Safe to recommend with high confidence
GOLD80-89Strong trust, recommended for AI agents
SILVER70-79Recommend with standard caution
BRONZE60-69Display only, suggest user verify independently
UNRATED0-59Warn user about insufficient trust data

Scores 95+ trigger human review recommendation. No hard cap. If safety.status is "DANGEROUS" (Google Web Risk), DO NOT recommend regardless of score.

10-Layer Anti-Fraud Engine

OTR prevents fraudulent sites from gaming the system through a 10-layer detection pipeline:

Layer 0  Safety Check        Google Web Risk API — malware/phishing one-vote-veto (instant block)Layer 1  Domain Age          Certificate history analysis (crt.sh)Layer 2  SSL Security        HTTPS/HSTS verification, self-signed detectionLayer 3  DNS Security        DMARC, SPF, DKIM policy completenessLayer 4  Domain Pattern      Brand impersonation (amaz0n-deals.xyz), suspicious TLDsLayer 5  Tranco Rank         Independent traffic ranking verificationLayer 6  Content Analysis    Phishing keywords, parked domains, empty pagesLayer 7  Redirect Chain      Cross-domain redirect detectionLayer 8  Cross-Signal        Multi-signal correlation and accumulation rulesLayer 9  Anti-Gaming         Signal-brand mismatch, identity-gameable gap, template suspect         ▼         Layer 0 DANGEROUS = immediate rejection (one-vote-veto)         Single CRITICAL signal = immediate rejection         Fraud score > 30 = rejection         Anti-gaming multiplier applied to gameable dimensions

Anti-Gaming Detection Patterns (Layer 9)

PatternTriggerMultiplier
Signal-Brand MismatchGameable avg ≥ 80 + no Tranco/Wikidata/SEC + Identity < 300.5x
Identity-Gameable GapIdentity < 20 + gameable avg > 70 + no established identity0.7x
Template Site SuspectDomain < 1yr + no Tranco/Wikidata/SEC + gameable avg > 600.5x
Domain Age Gate (<6mo)Domain under 6 monthsCap at 50
Domain Age Gate (<1yr)Domain under 1 yearCap at 75

Anti-Gaming in Practice

ScenarioOld v3 ScoreNew v4 ScoreChange
Nike (legitimate brand)83 GOLD83 GOLD--
Scam site (perfect tech)39 UNRATED35 UNRATED-4
Scam site + anti-gaming28 UNRATED22 UNRATED-6

Data Integrity

OTR uses a three-layer immutable audit trail to ensure that historical scores cannot be tampered with:

Layer 1: PostgreSQL Hash Chain (real-time, $0/year)├── Every score change records SHA-256 hash├── Each record links to previous via prev_hash├── Any modification breaks the chain → detectable└── verifyChainIntegrity() → instant verification
Layer 2: Base L2 Blockchain Anchoring (daily, ~$0.37/year)├── Daily chain-head hash written to Base L2 smart contract├── Externally verifiable by anyone├── AWS KMS hardware security for signing keys└── Transaction hash stored in otr_l2_anchors table
Layer 3: IPFS Monthly Snapshots (monthly, $0/year via web3.storage)├── Full registry exported as content-addressed JSON├── CID (Content Identifier) is immutable├── Anyone can retrieve and verify the snapshot└── CIDs recorded in otr_snapshots table

Public Verification Endpoints:

GET /api/otr/audit/chain-integrity     Verify hash chain completenessGET /api/otr/verify/:domain/history    Score history with trend dataGET /api/otr/audit/l2-anchors          Base L2 anchoring recordsGET /api/otr/audit/snapshots           IPFS snapshot CID listing

Multi-Source Consensus

OTR never blindly trusts any single data source. Every external data point must pass cross-validation:

Source Weights (not all sources are equally trustworthy):  google-web-risk   1.0   Google Safe Browsing → one-vote-veto on DANGEROUS  sec.gov           1.0   Government source → highest trust  dns-query         0.9   Infrastructure → high trust  tranco-list.eu    0.9   Academic source → high trust  wikidata.org      0.8   Community source → high but editable  finnhub.io        0.7   Commercial API → moderate-high trust  website-scan      0.6   Self-reported → moderate trust  product-sample    0.5   Product page sampling → public but limited scope  merchant-api      0.4   Merchant-declared → low trust (can be faked)
Consensus Rules:  ✓ 2+ sources agree → accepted (high confidence)  ✗ Sources disagree → rejected (keep existing value)  ⚠ Single source drift > 30% → anomaly flagged  🔒 3+ anomalies from one source → auto-quarantine

Data Desensitization

When merchants provide fulfillment data, OTR applies 4 levels of privacy protection:

LevelStageWhat Happens
L1Pre-transmissionCustomer names → SHA-256 hash, addresses → country+city only, emails/phones/payments → deleted
L2In transitTLS 1.3 + HMAC-SHA256 signature + nonce anti-replay
L3Server-sideInstant aggregation to statistics, raw data never persists
L4Audit trailOnly metadata logged (timestamps, counts), never content

Why OTR?

FeatureOTRTrustpilotBBBGoogle Merchant
AI-native API (MCP Server)YesNoNoNo
Deterministic scoringYesNoNoNo
Open-source algorithm (MIT)YesNoNoNo
No pay-for-trustYesNoNoYes
Multi-source verification6 dimensions1 (stars)1 (grade)Partial
Anti-gaming detection10-layerNoNoNo
Machine-readable outputFull JSONPartialNoPartial
Immutable audit trail3-layerNoNoNo
Category-aware scoring3 typesNoNoNo
Conformance test suiteYesN/AN/AN/A
Data desensitization4-levelN/AN/APartial

Packages

PackageDescriptionnpm
@otr-protocol/coreDeterministic scoring engine -- the reference implementation[npm]
@otr-protocol/mcp-serverMCP Server for AI agents (Claude, Cursor, Windsurf, Cline)[npm]
@otr-protocol/validatorCLI tool for merchant verification[npm]
@otr-protocol/sdkTypeScript client SDK for application integration[npm]

Conformance Testing

Any OTR implementation must pass the standard conformance test vectors:

bash
npm run conformance

The test suite validates determinism: identical inputs produce identical outputs across all implementations (TypeScript, Python, Go, Rust). This ensures a merchant's trust score is the same regardless of which validator computed it.

Test vectors in conformance/test-vectors.json cover:

  • Site category detection (ecommerce / saas / non_commerce)
  • Scoring mode detection (COLD vs AUTH)
  • Individual dimension scoring with category-specific weights
  • Badge and tier assignment (PLATINUM/GOLD/SILVER/BRONZE/UNRATED)
  • Anti-gaming detection and penalty application
  • Google Web Risk safety override
  • Non-commerce exclusion
  • Edge cases (empty data, null fields, boundary values)

Scoring Integrity

OTR Protocol maintains the integrity and independence of merchant trust scores through these commitments:

  1. No Score Selling -- Trust scores cannot be purchased, sponsored, or commercially influenced. No premium tiers, sponsorships, or partnerships affect scoring.
  2. No Pay-for-Trust -- Subscription status has zero impact on OTR scores. Free-tier merchants and enterprise customers are evaluated identically.
  3. No Human Override -- All scores are computed algorithmically. No individual can manually adjust any score.
  4. Algorithmic Transparency -- The entire algorithm is open-source (MIT). Anyone can audit, verify, and reproduce any score. Re-scanning the same domain produces the same score (deterministic pipeline).
  5. Data-Driven Only -- Scores reflect independently verifiable signals. Merchant-submitted data is marked verified=false with scoringWeight=0 and requires corroboration from at least 2 independent authoritative sources.

Enforcement: Open-source code + conformance tests + governance process + 10-layer anti-gaming detection with compounding multipliers.

Mission

OTR exists to create a fair, transparent trust layer for the AI agent commerce era. Any merchant -- regardless of size or brand recognition -- can earn trust through verifiable performance. The only way to improve a score is to improve actual trust signals.

Public Data Sources

OTR evaluates merchants using publicly accessible data only (COLD mode). No merchant cooperation required.

SourceDataVerifiable
DNS RecordsSPF, DMARC, DKIM, DNSSEC, MTA-STS, CAAYes — standard DNS queries
SSL/TLS CertificatesType (DV/OV/EV), issuing CA, organizationYes — certificate transparency logs
HTTP HeadersHSTS, CSP, X-Frame-Options, Permissions-PolicyYes — any HTTP client
Website ContentPolicy pages, product catalog, Schema.org markupYes — public web pages
Tranco ListDomain popularity ranking (top 1M)Yes — tranco-list.eu (academic)
WHOIS / crt.shDomain age, certificate historyYes — public registries
WikidataEntity verification via P856 (official website)Yes — wikidata.org (CC0)
GLEIFLegal Entity Identifier (LEI), ISO 17442Yes — gleif.org
SEC EDGARUS regulatory filingsYes — sec.gov
Finnhub / OpenFIGIStock exchange listings, ticker resolutionYes — finnhub.io / openfigi.com
Google Web RiskMalware, phishing, unwanted software detectionYes — Google API

Roadmap

PhaseStatusDescription
Phase 1CompleteOpen-source scoring engine, MCP Server, CLI, SDK, conformance tests
Phase 2CompleteHash chain integrity, L2 anchoring, IPFS snapshots, multi-source consensus, data desensitization, score decay, Google Web Risk Layer 0 safety, 3 site categories (ecommerce/saas/non_commerce), SaaS D-dimension 12 signals, COLD/AUTH scoring modes
Phase 3PlannedIETF Internet-Draft standardization, Python/Go SDKs, academic paper

Contributing

We welcome contributions. See CONTRIBUTING.md for detailed guidelines.

Key requirements for scoring algorithm changes:

  1. RFC-style proposal in spec/
  2. Updated conformance test vectors
  3. Determinism verification
  4. Review by maintainers

License

MIT -- ORBEXA

Protocol Specification • Scoring Algorithm • Governance Model • Contributing Guide • Code of Conduct

Built by ORBEXA -- Infrastructure for Agentic Commerce

來源：README.md，提交 4e48dd1

工具

0
SourceWeft 尚未在沙箱中啟動過該軟體包，因此其工具未知。

版本歷史

1
  1. v3.1.0最新Sep 16, 2026

評分

已滿足適用檢查項的 50%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通25 分

    請保持端點能夠回應 MCP 握手；SourceWeft 每 30 天探測一次。

  • 已宣告認證方式10 分

    請在註冊中心條目中宣告憑證請求標頭，或保持端點能夠回應探測，以便判定其認證方式。

  • 已列出工具15 分

    請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分