Trooth

For agents and their builders

Call Trooth before you trust a vendor

When an AI agent is about to rely on a vendor, recommend one, integrate with one, or move money toward one, it should check that vendor the way a careful buyer would. Trooth gives your agent one place to do it: a public trust layer it can read in a single call, with honest labels on where every answer came from.

The pattern

Four read-only steps. The first is almost always enough; the rest are there when a decision is worth more scrutiny.

  1. 1

    Read the witnessed standing

    trooth_public_trust_profile

    Look up the vendor by domain. You get its published Trust Profile if it has one (signed evidence, re-checked on a schedule) or its Network standing from a signed scan. If Trooth has nothing, you get an honest not-found, not a guess.

  2. 2

    Take a live outside-in read

    trooth_outside_in_read

    A neutral read of the vendor's public surface right now: HTTPS and TLS reachability, common security headers, and security.txt. These are observations, not witnessed evidence and not a grade, and they are labelled that way.

  3. 3

    Verify any signed token you were handed

    trooth_verify

    If the vendor gave you a Trust Ledger Token, verify it. Trooth re-runs both signatures and tells you whether the token is valid, expired, revoked, or tampered. Trooth's signature attests the signing event and the payload at issuance, never the truthfulness of the claims inside.

  4. 4

    Report with provenance, act on the gap

    Summarize what is witnessed versus what is only observed, and keep each provenance label attached. Treat an honest absence as missing data to gather, not as a pass or a fail.

Connect your agent

Trooth speaks the Model Context Protocol. Point any MCP-capable client at the endpoint below and the four tools appear automatically. No key, no account, read-only, public data only.

Endpoint
POST https://api.trooth.co/public/mcp
Transport
Streamable HTTP, JSON-RPC 2.0
Discovery
/.well-known/mcp.json
Tools
trooth_public_trust_profile, trooth_outside_in_read, trooth_verify, trooth_ask
POST https://api.trooth.co/public/mcp
Content-Type: application/json

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "trooth_public_trust_profile",
    "arguments": { "company": "acme.com" }
  }
}

The server also lists curated prompts your agent can pull directly: vendor_trust_check, verify_trust_token, and before_you_trust. Each one drives the pattern above with the provenance rules built in.

Subscribe to changes

Trust is not a one-time read. Your agent can register a webhook and be told when a vendor's witnessed posture changes, so it never acts on a stale check. No email, no account: post a public https webhook URL and get back a signing secret.

POST https://api.trooth.co/public/trust/acme.com/agent-subscribe
Content-Type: application/json

{ "webhookUrl": "https://your-service.example/hooks/trooth" }

Changes arrive as a signed trust.posture.changed event. Each delivery carries an x-trooth-signature header: the HMAC-SHA256 of the raw body, keyed by your secret. Verify it before you act on the payload. Deliveries carry witnessed changes only.

Read the labels

Every answer carries a provenance label so your agent never mistakes an observation for a proof. A witnessed Trust Profile is signed evidence. A signed scan is a point-in-time Network standing. An outside-in read is a live neutral observation. A Trust Ledger Token is a portable, signed receipt you can re-verify. An honest absence is missing data, not a judgment. Trooth automates the reading and signs the event; Trooth never signs on a company's behalf.

Add Trooth to your assistantDeveloper docs