com.babyblueviper/invinoveritas

Measured conclusion: Deep-tested. L2 outcome: tools_ok.

Second opinion before an irreversible agent action; signed proofs, free verify, public ledger.

Add to your agent

Copy this into your MCP client config:

{
  "mcpServers": {
    "invinoveritas": {
      "url": "https://api.babyblueviper.com/mcp/verify",
      "transport": "streamable-http"
    }
  }
}

Measured tools (10)

• review read-only

  Independent verdict on a proposed action before it is taken: a code diff, shell command, deployment plan, configuration change, another agent's output, or a proposed transaction. Returns approve / approve_with_concerns / reject with a confidence score, issues ranked by severity, suggested fixes and alternatives. With sign=true the verdict is returned as a signed proof that anyone can check later with verify_proof. The verdict is a reasoned second opinion, not a guarantee of outcome. Docs: https://api.babyblueviper.com/docs

  Parameters:

  • artifact (required) — string — The artifact to review: unified diff / patch, shell command, plan, config, analysis, agent output, or raw text
  • sign — boolean — Return the verdict as a portable signed proof (binds verdict, artifact hash and invinoveritas's public key, plus a content-addressed decision_ref). Anyone can check it later with verify_proof.
  • facts — object — Optional, with policy: the structured request fields the deterministic rules read (e.g. recipient, amount_atomic, chain, token).
  • policy — object — Optional (2026-10-13): policy-governed review. {schema: 'invinoveritas.review_policy.v1', deterministic: [{id, field, op (eq|ne|in|not_in|lte|lt|gte|gt), value}], substantive: [{id, requirement, accept_states (subset of [VERIFIED, DECLARED_ONLY], default [VERIFIED]), min_provenance (requester_supplied|independent)}]}. Deterministic rules are checked in code against `facts` first; any FAIL or MISSING rejects with no model call. Only substantive conditions go to the model, which returns VERIFIED / DECLARED_ONLY / CONTRADICTED / INSUFFICIENT per condition; a fixed rule from the policy decides. The result's policy_evaluation (also inside the signed proof) states its claim: 'factual' only if every condition was VERIFIED by evidence, else 'declarative'. Pair with verdict_relay to release a VerdictGatedEscrow payment on Base.
  • context — string — What you are trying to accomplish, why now, success criteria
  • concerns — string — Specific things to check (e.g. 'production safety', 'edge cases in trading logic', 'regulatory risk')
  • evidence — array — Optional, with policy: [{id, provenance (requester_supplied|independent), kind, content}] for the substantive conditions.
  • artifact_type — string — Type of artifact. 'code_diff' or 'patch' triggers deep code review. 'plan' for architecture/strategy. 'trade' triggers the capital-scale-aware risk-manager review of a proposed entry/exit. 'onchain_action' triggers the on-chain risk review of a proposed transfer/swap/approval/contract call (e.g. a Base MCP action) BEFORE you sign it — catches scam/honeypot tokens, unlimited-allowance drainers, address poisoning, slippage/MEV. 'sanctions_screening' for a compliance/AML result BEFORE acting on it — checks a categorical verdict (e.g. CLEAN) carries its own scope, not an unscoped claim. Tailors focus and suggestions. IMPORTANT for trade/onchain_action/sanctions_screening: a REJECT can happen purely from low confidence on an action you can't undo, even if content-wise the review leaned approve — see the response's reversibility_gate field. When present, epistemic_basis tells you WHY it's a reject: 'evidence_against' means a deterministic engine found a real positive finding (a known-bad address, an on-chain/sanctions hit); 'insufficient_evidence' means no finding either way, just confidence below the reversibility floor — different situations, do not treat them identically if your own logic branches on the reason.
  • verdict_relay — object — Optional (verdict-relay/v2): also return a BIP-340 signature an ERC-8414 InvinoveritasVerdictAuthoritySigned contract verifies on-chain (garyyang-finchip/task-token-standard#2). {chain_id, authority, task_contract, token_id, submission_id, task_version, result_hash, task_document}. Requires sign=true. result_hash must be sha256 of the exact artifact; task_document is the plaintext task document (sha256 = the kernel's tdHash) and is put into the review context. approved/decision_ref come from our own verdict (approve->true, reject->false; concerns/defer unsigned). Checked before any charge. Result field verdict_relay.
  • action_binding — object — Optional: the exact real-world action this verdict authorizes — tool identity, materialized (not templated) arguments, and the id of the agent that will execute it, e.g. {'tool': 'place_order', 'agent_id': 'your-stable-agent-id', 'args': {...}}. v14+: `tool` and `args` are bound as SEPARATE preimage fields (action_binding_tool_hash = sha256(tool), action_binding_args_hash = sha256(RFC-8785-JCS(args))) so a verifier can assert 'same tool, different arguments' as a checkable statement; `agent_id` is bound as a plain string (action_binding_agent_id, not hashed). All bound DIRECTLY into decision_ref — so the verdict commits to the exact action, not just the free-text `artifact` argument or the verdict conclusion. Recomputing decision_ref without byte-identical tool/args/agent_id values produces a different hash: an approval cannot be replayed against a different tool, different materialized arguments, or a different agent. Every sub-key is optional. Max ~8KB JSON-encoded. NOT independently verified by us — we hash exactly what you send. HONEST LIMIT: nothing stops a caller from submitting an under-specified action_binding (e.g. tool+side but not size) and getting an approval reusable across the omitted dimension — that's about who controls what goes into the fingerprint, not how it's hashed.
  • related_claims — object — Optional (policy v20): a structured claim about related_proof_event -- a non-empty subset of {artifact_hash, verdict, verified_at, policy_version, decision_ref}. Compared by exact equality against the referenced proof (which we re-verify); the claims hash, comparison version and result (matched|mismatched|missing_proof|unverifiable_proof; not_supplied if omitted) are bound into decision_ref. Faithful restatement only: not relevance, authorization or truth.
  • disclosed_summary — string — Only used when confidentiality_tier='partial_disclosure'. A real, human-readable description of the reviewed artifact/decision you're choosing to make public — bound raw into decision_ref. Ignored for other tier values.
  • external_evidence — array — Optional (v17, 2026-09-10): third-party evidence this judgment relied on — e.g. a tool-reliability registry's own historical PASS/FAIL record, worked out live with arian-gogani/nobulex-registry#1. Array of {'source': str, 'record': str (the issuer's OWN exact saved bytes, verbatim — never re-parsed/re-emitted as JSON on our side), 'record_sha256': str (issuer-computed, not independently verified by us), 'evidence_type': str, 'observed_at': ISO 8601, 'validity_until': ISO 8601 | null}. All entries hashed together (RFC-8785-JCS) into external_evidence_hash, bound into decision_ref — so 'this exact evidence was what the verdict considered' is checkable, not just claimed in reasoning text. Does NOT authenticate the issuer, verify record_sha256, or establish freshness — that's the caller's own responsibility before relying on the cited evidence.
  • intended_audience — string — Optional: declare who/what this verdict is intended for (your own DID, endpoint URL, or gateway identifier). Bound into decision_ref so it can't be silently stripped or altered once issued. NOT independently verified — a reader compares this against their own identity and treats a mismatch as a signal the proof may be presented outside its intended context, a real context-binding replay-protection gap that earlier policy versions had no way to represent at all.
  • intended_verifier — string — Optional: a CAIP-10 string naming the specific on-chain verifier/gate this verdict is meant to be checked against, e.g. 'eip155:8453:0x8004A169FB4a3325136EB29fA0ceB6D2e539a432'. Bound into decision_ref (itself inside the schnorr-signed content) so it achieves real crypto-level domain separation — the raw signed bytes otherwise bind only to our pubkey + content, nothing to a specific chain/contract, so a proof is technically replayable against any gate willing to accept it. NOT independently verified — a gate compares this against its own chain_id/address.
  • severity_threshold — string — Minimum severity to report
  • related_proof_event — object — Optional: if the artifact being reviewed IS another party's already-signed verdict proof (a verdict-of-verdict re-review), pass that proof's full signed event ({id, pubkey, created_at, kind, tags, content, sig}). We independently re-verify it ourselves before its source_class can affect this call's own — capped, never upgraded (an independent_mediator call reviewing an agent_reported inner verdict stays agent_reported). Fails closed to agent_reported if the inner event doesn't verify, regardless of your own registry status. One hop only. HONEST SCOPE: we verify the cited event's own authenticity, not that it's actually the thing your artifact claims to be re-reviewing.
  • request_capture_ref — string — Optional: a requester-controlled commitment (a hash/id you generated and can independently prove existed at request-time) that this artifact was submitted for review — the captured-admission-v0 review profile (trustless-ai/recompute-kit). Echoed back verbatim in the response's admission_receipt. NOT independently verified by us; closes the /ledger raw-tape-vs-published gap only for requesters who opt in.
  • confidentiality_tier — string — Which privacy/evidentiary tradeoff this verdict should use, only meaningful with sign=true. 'hash_only' (default): the proof carries only artifact_hash, raw content never disclosed — strongest privacy, weakest standalone evidentiary value (a third party can't confirm what the hash corresponds to without your later cooperation). 'partial_disclosure': pass disclosed_summary, bound raw into decision_ref, so a third party gets real checkable context without full exposure. 'full_disclosure': records intent to publish this verdict to the public /ledger (full_disclosure_requested=true in the proof) — strongest evidentiary tier, but actual publication is still a separate curated step on our side, not yet fully self-serve.
  • mediator_attestation — object — Optional (v22): your mediator proves control of its own key. {key_url (https, mediator's own domain), public_key_ed25519_b64, requested_at (unix s, +-600 s), nonce (8-128 ASCII), signature_ed25519_b64} -- Ed25519 over the RFC 8785 JCS bytes of {schema:'invinoveritas.mediator_request.v1', artifact_hash (sha256 hex of the exact artifact), artifact_type, requested_at, nonce}; key_url must list the key. Requires sign=true; checked before any charge; bound into the proof as mediator_attestation_hash. Establishes key control at issue time, NOT independence.

  Hints: read-only yes · destructive no · idempotent not declared · open-world no

• verify_proof read-only

  Checks a signed invinoveritas proof without trusting whoever handed it over: recomputes the event id, checks the Schnorr signature, and confirms the signing key is invinoveritas's published key. Optionally pass expect_artifact_hash (sha256 of the content you received) to confirm the proof covers that exact content. Accepts the full event, or an event_id to look up. Returns {valid, checks, proof_payload}. Free, no sign-in. Docs: https://api.babyblueviper.com/verify

  Parameters:

  • event — object — The signed proof event {id,pubkey,created_at,kind,tags,content,sig} the counterparty handed you (from a /prove or /review sign=true response).
  • event_id — string — Alternatively, the Nostr event id alone (from a /review sign=true, /prove, or /witness proof) — fetches the durably-stored full event, independent of relay retention, and verifies it.
  • proof_id — string — Alternatively, a stored attestation proof_id to fetch + verify.
  • verifier_signature — string — Optional (added 2026-08-16) — an EIP-191 personal_sign signature over 'invinoveritas-verify-proof:<event_id>', signed by the key controlling the address in expect_intended_verifier (eip155 CAIP-10 namespace only). Cryptographically PROVES presenter identity rather than just asserting it — sets checks.intended_verifier_authenticated.
  • expect_artifact_hash — string — Optional sha256 hex of the output you received — asserts the proof is ABOUT that exact artifact.
  • expect_intended_verifier — string — Optional (added 2026-08-16) — asserts the proof's declared intended_verifier matches you, the consumption-identity check alongside expect_artifact_hash's content-identity check. A match confirms the issuer's declared intent, not that delivery was actually restricted to you.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• payment_receipt

  Signed receipt for one verdict-governed payment: endpoint, network, asset, max amount, payer, facilitator verdict, settlement id, denial reason, and retry state. retry_state is read from the token's authorizationState, so retrying with the same nonce cannot double-pay. Pass the signed review event and the payment args it bound; optional tx_hash. Refuses unsigned when the verdict does not verify or does not bind those args. The receipt itself checks with verify_proof. Free, no sign-in. Does not move funds. Docs: https://github.com/babyblueviper1/invinoveritas/tree/main/examples/qbtlabs-x402-verdict-gate#payment-receipt-safe-to-retry

  Parameters:

  • event (required) — object — The signed /review verdict (Nostr event) that governed the payment.
  • args (required) — object — The payment args that verdict bound. Their hash must match the verdict's action_binding_args_hash.
  • tx_hash — string — Optional 0x + 64 hex settlement transaction. settlement_id is set only when this tx is the payment the verdict bound.
  • terms_hash — string — Optional sha256 (64 hex, optionally sha256:) of the terms the payment was for. A terms hash bound in the verdict's args takes precedence; a supplied one is labelled not bound.
  • output_hash — string — Optional sha256 of the delivered result. With it, a settled payment reads paid_output_recorded; without it, paid_no_output_recorded (a possible ghost result: do not pay again for the same job).
  • resource_url — string — Optional https URL of the resource the payment was for, when the verdict bound no endpoint.
  • authorization_signature — string — Optional: the payer's 65-byte EIP-3009 signature (hex). The receipt verifies it recovers to the payer over the bound amount, payee, validity window and the verdict's nonce, under the token's on-chain EIP-712 domain.
  • max_verdict_age_seconds — integer — Optional max age of the verdict in seconds (1..86400). Default 120.

  Hints: read-only no · destructive no · idempotent no · open-world yes

• verify_media read-only

  Check whether a video, audio or image file is byte-for-byte a file a publisher registered with invinoveritas. Pass the file's SHA-256 (compute it locally; the file is not sent). A match returns the registration: per-claim evidential states from its C2PA Content Credentials (signature/hash binding, signer trust, declared edit history, declared AI-generation labels: VERIFIED / DECLARED_ONLY / CONTRADICTED / INSUFFICIENT), any capture tier with its caveat, the signed verdict and the Bitcoin timestamp. No match means not registered, which says nothing either way about the file. A re-encoded copy has a different hash. It never asserts that content is true. Full checks of the file itself: POST /verify-media (upload, free). Free, no auth.

  Parameters:

  • sha256 (required) — string — SHA-256 of the exact file bytes, 64 hex characters.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• witness

  Timestamps and signs a third party's exact claim, unmodified and unjudged: 'we received this text, attributed to source X, at time T', not 'we agree with it'. The source is recorded as self-declared. The resulting proof checks with verify_proof. Docs: https://api.babyblueviper.com/docs

  Parameters:

  • source (required) — string — Who this claim is attributed to (self-declared, NOT verified by us)
  • body (required) — string — The exact claim to anchor, byte-for-byte (max 16000 chars)

  Hints: read-only no · destructive no · idempotent no · open-world no

• validate read-only

  Statistical reality-check of a backtest from its realized returns (or trade rows), not the strategy itself. Returns likely_real / borderline / overfit_or_noise using the Deflated Sharpe Ratio (adjusted for the number of variants tried), a sign-flip permutation test, and out-of-sample decay across purged folds. Inputs are not retained beyond a redacted audit hash. Docs: https://api.babyblueviper.com/docs

  Parameters:

  • trades — array — Alternative to 'returns': rows with a return field (ret/pnl/net_bps) and optional 'coin'/'ts'/'entry'/'exit' fields.
  • k_folds — integer
  • n_perms — integer
  • returns — array — Per-trade (or per-period) realized returns.
  • agent_id — string — Optional caller agent ID
  • n_trials — integer — How many strategy variants/params you tried before selecting this one. Be honest — more trials = bigger Deflated-Sharpe haircut.
  • trial_sharpes — array — Optional: Sharpes of all variants tried → exact DSR variance.
  • periods_per_year — number — Optional, for annualized-Sharpe display only.

  Hints: read-only yes · destructive no · idempotent not declared · open-world no

• ledger read-only

  Reads invinoveritas's public track record of signed verdicts, including ones that turned out wrong. Each entry is a signed Nostr event whose id and signature can be recomputed against invinoveritas's published key; entries are append-only and Bitcoin-timestamped, so they can't be edited after the fact. No arguments returns the index; pass entry to read one. Free, no sign-in. Docs: https://api.babyblueviper.com/ledger

  Parameters:

  • entry — string — Optional entry number (e.g. '1'); omit for the full index.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• ledger_submit

  Publishes one of your own signed review proofs (from review with sign=true) as a public entry on the invinoveritas ledger. Publication is immediate and permanent: the entry is broadcast to Nostr relays and Bitcoin-timestamped. Only genuine invinoveritas-signed proofs are accepted. Docs: https://api.babyblueviper.com/ledger

  Parameters:

  • event (required) — object — The signed Nostr event from a prior /review(sign=true) call — the exact proof.event object that response returned.
  • note — string — Optional short context: what this verdict was for, why it's worth featuring.

  Hints: read-only no · destructive no · idempotent no · open-world yes

• conformance_certify

  Publishes a verifier's current conformance grade from the public registry (conformance.json) as a permanent, signed ledger entry, labeled 'certified as of this measurement'. It records the registry's existing measurement and cannot change it. Only works for a verifier currently listed as certified. Docs: https://api.babyblueviper.com/conformance

  Parameters:

  • name (required) — string — The verifier's exact name as listed on GET /conformance.json (must currently show certified:true).
  • note — string — Optional short context for the ledger entry.

  Hints: read-only no · destructive no · idempotent yes · open-world yes

• audit_agent_readiness read-only

  Audits a public agent or API URL for verifiability: discovery files (llms.txt, MCP card, robots, sitemap), handshake endpoints, and whether presented signed proofs validate. Returns a 0-100 score, a grade, ranked fixes, and a signed proof of the audit. Every result re-derives from a public fetch. Docs: https://api.babyblueviper.com/docs

  Parameters:

  • url (required) — string — The agent endpoint/site URL to audit (public http(s) only)

  Hints: read-only yes · destructive no · idempotent not declared · open-world yes

Repository

Measured by MCPYP probing. Untested fields are omitted, never estimated. Listing is always free; MCPYP never proxies calls or stores user tokens.