Mnemom — Trust Ratings for AI Agents

Measured conclusion: Deep-tested. L2 outcome: tools_ok.

Trust infrastructure for AI agents: read a verifiable Trust Rating, claim an identity, earn a badge.

Add to your agent

Copy this into your MCP client config:

{
  "mcpServers": {
    "Mnemom — Trust Ratings for AI Agents": {
      "url": "https://api.mnemom.ai/mcp?profile=directory",
      "transport": "streamable-http"
    }
  }
}

Measured tools (15)

• claim_agent destructive

  Claim a verifiable identity — bind an agent to your organization so its trust and accountability record is provably yours. Requires the agent's possession proof (`hash_proof`). Re-claiming an agent you already own keeps its original claim date but files it under the organization you pass (`org_id`; if omitted, your personal organization), which can change the organization that owns and bills it.

  Parameters:

  • agent_id (required) — string — Agent identifier (e.g. smolt-abc123)
  • hash_proof (required) — string — Agent possession proof — either the live birth token (`mnbt_…`) whose row pins this agent's hash, or the full 64-hex SHA-256 digest of `${apiKey}|${agentName}` (or `${apiKey}` for an unnamed singleton agent).
  • org_id — string — Optional. The organization to claim the agent into (e.g. `org-...` or `pers-...`). The caller must be a member of this org (role floor: member). If omitted, the agent is claimed into the caller's personal org.

  Hints: read-only no · destructive yes · idempotent no · open-world no

• get_agent read-only

  Look up an agent's public identity and trust state by ID — the accountable record other agents and humans can rely on.

  Parameters:

  • agent_id (required) — string — Agent identifier (e.g. smolt-abc123)

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• get_reputation read-only

  Look up an AI agent's published Trust Rating — Mnemom's portable reliability signal for autonomous software, computed from the agent's own verified activity record. Returns the rating plus the technical factors behind it. Free, public, read-only: ratings are public by default, unless the agent's owner has opted out.

  Parameters:

  • agent_id (required) — string — Agent identifier (e.g. smolt-abc123)

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• get_reputation_badge read-only

  Get an embeddable Trust Rating badge for an agent — returns the badge image URL plus ready-to-paste Markdown and HTML snippets for a README or agent card.

  Parameters:

  • agent_id (required) — string — Agent identifier (e.g. smolt-abc123)

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• get_started read-only

  Zero-auth, no-args orientation: who Mnemom is, the surface map, how to authenticate and what it unlocks, and the tools to try right now (scan_trust and the reputation lookups).

  Parameters:

  • token — string — Optional Dojo try-me invite token. When supplied and valid, returns the token-gated dojo briefing manifest (the same content as GET /v1/dojo/try-me/resolve); omit for public orientation.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• list_agents read-only

  List the agents your account owns, with pagination (`limit`, `offset`). Read-only.

  Parameters:

  • limit — integer — How many agents to return, 1-100.
  • offset — integer — How many agents to skip, for pagination.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• preview_compose_alignment_by_agent read-only

  Dry-run an alignment card: shows the card that would result after merging with the platform, organization and team policies above it, plus any conflicts. Nothing is saved.

  Parameters:

  • agent_id (required) — string — The agent this card belongs to (e.g. `smolt-abc123`). Identifier only — never place an API key, a secret, an email address, or any other personal data in this field.
  • card_version (required) — string — Card schema version. REQUIRED by the server-side validator. Current canonical value: `unified/2026-04-26`.
  • autonomy_mode (required) — string — Master switch for the action-policing pipeline. Required. `off` disables it; `observe` records only; `nudge` warns; `enforce` blocks.
  • integrity_mode (required) — string — Master switch for the values pipeline. Required. Same four states as `autonomy_mode`.
  • principal (required) — object — Whose authority this agent acts under. Required.
  • values (required) — object — The values this agent declares it is bound by. Required.
  • autonomy (required) — object — What the agent may do on its own authority. Required.
  • audit (required) — object — How long this agent's own decision log is kept, and whether it can be queried. Required. (This is the agent's audit policy — it is NOT Mnemom's retention policy for the card itself; see the tool's data-handling disclosure for that.)

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• preview_compose_protection_by_agent read-only

  Dry-run a protection card: shows the card that would result after merging with the platform, organization and team policies above it, plus any conflicts. Nothing is saved, and no publish grant is needed.

  Parameters:

  • agent_id (required) — string — The agent this card belongs to (e.g. `smolt-abc123`). Identifier only — never place an API key, a secret, an email address, or any other personal data in this field.
  • card_version (required) — string — Card schema version. REQUIRED by the server-side validator. Current canonical value: `protection/2026-04-26`.
  • mode (required) — string — Screening mode for the protection pipeline. Required. `off` disables screening; `observe` records only; `nudge` warns; `enforce` blocks.
  • thresholds (required) — object — Risk-score cutoffs, each in [0, 1] and ordered warn ≤ quarantine ≤ block. Required. Send the full set: a publish replaces the agent's current card rather than patching it.
  • screen_surfaces (required) — object — Which traffic surfaces are screened. Required, with all four flags set.
  • trusted_sources (required) — object — Sources exempt from screening. Required, with all three lists present; send empty lists to trust nothing extra. Enumerate specific hosts — wildcards are rejected, and a server-side deny-list (public LLM/DNS endpoints, 0.0.0.0/0, ::/0, link-local, multicast) is always applied.
  • protected_surface — object — The assets and operations this agent must protect. Omit to accept the composed default (empty surface).

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• put_alignment_by_agent destructive

  Publish or replace an agent's alignment card: its governance modes, the principal it acts for, its declared values, the actions it may take on its own, and its audit policy. The server merges the card with the platform, organization and team policies above it and stores the result. Use preview_compose_alignment_by_agent to dry-run first.

  Parameters:

  • agent_id (required) — string — The agent this card belongs to (e.g. `smolt-abc123`). Identifier only — never place an API key, a secret, an email address, or any other personal data in this field.
  • card_version (required) — string — Card schema version. REQUIRED by the server-side validator. Current canonical value: `unified/2026-04-26`.
  • autonomy_mode (required) — string — Master switch for the action-policing pipeline. Required. `off` disables it; `observe` records only; `nudge` warns; `enforce` blocks.
  • integrity_mode (required) — string — Master switch for the values pipeline. Required. Same four states as `autonomy_mode`.
  • principal (required) — object — Whose authority this agent acts under. Required.
  • values (required) — object — The values this agent declares it is bound by. Required.
  • autonomy (required) — object — What the agent may do on its own authority. Required.
  • audit (required) — object — How long this agent's own decision log is kept, and whether it can be queried. Required. (This is the agent's audit policy — it is NOT Mnemom's retention policy for the card itself; see the tool's data-handling disclosure for that.)

  Hints: read-only no · destructive yes · idempotent yes · open-world no

• put_protection_by_agent destructive

  Publish or replace an agent's protection card (screening mode, thresholds, trusted sources, protected assets). When connected by OAuth sign-in (e.g. ChatGPT), each publish first needs a one-time grant from the same signed-in account: open https://www.mnemom.ai/authorize-protection?agent_id=<agent_id>, approve, then publish within 15 minutes (each grant covers one publish). Required: agent_id, card_version, mode, thresholds, screen_surfaces and trusted_sources (protected_surface is optional); mode `enforce` also needs Safe House on the organization. Use preview_compose_protection_by_agent to dry-run without a grant.

  Parameters:

  • agent_id (required) — string — The agent this card belongs to (e.g. `smolt-abc123`). Identifier only — never place an API key, a secret, an email address, or any other personal data in this field.
  • card_version (required) — string — Card schema version. REQUIRED by the server-side validator. Current canonical value: `protection/2026-04-26`.
  • mode (required) — string — Screening mode for the protection pipeline. Required. `off` disables screening; `observe` records only; `nudge` warns; `enforce` blocks.
  • thresholds (required) — object — Risk-score cutoffs, each in [0, 1] and ordered warn ≤ quarantine ≤ block. Required. Send the full set: a publish replaces the agent's current card rather than patching it.
  • screen_surfaces (required) — object — Which traffic surfaces are screened. Required, with all four flags set.
  • trusted_sources (required) — object — Sources exempt from screening. Required, with all three lists present; send empty lists to trust nothing extra. Enumerate specific hosts — wildcards are rejected, and a server-side deny-list (public LLM/DNS endpoints, 0.0.0.0/0, ::/0, link-local, multicast) is always applied.
  • protected_surface — object — The assets and operations this agent must protect. Omit to accept the composed default (empty surface).

  Hints: read-only no · destructive yes · idempotent yes · open-world no

• report_recipe_fn_fp

  Submit a false-positive / false-negative correction for one of Mnemom's automated detection rules (a 'recipe') — technical feedback that improves detection accuracy, like filing a bug report against a spam filter.

  Parameters:

  • recipeId (required) — string — The detection recipe the report is filed against (the one that misfired or failed to fire). Identifier only.
  • type (required) — string — `fn` = false negative (the recipe should have fired). `fp` = false positive (it fired on legitimate behaviour).
  • summary (required) — string — A short description of what the recipe got wrong — what it flagged, or what it missed, and why that was incorrect. DESCRIBE the misfire; do NOT paste the conversation, the prompt, the raw payload or the log that triggered it. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.
  • agent_id — string — Optional. The agent the report concerns. Identifier only.
  • checkpoint_id — string — Optional. The related integrity checkpoint, so the reviewer can correlate. Identifier only.

  Hints: read-only no · destructive no · idempotent no · open-world no

• scan_trust read-only

  Scan a website's agent-trust-readiness and return a signed scorecard (Trust, plus an Access axis on newer rubrics). Zero-auth. Results are CACHED for up to 24h — check `cached` and `scannedAt` on the result; pass `fresh: true` to force a re-scan (rate-limited). Proxies to the SSRF-locked isittrustready scanner; the Ed25519 signature + permalink are preserved verbatim. Rubric + docs: https://www.isittrustready.ai/rubric and https://docs.mnemom.ai/.

  Parameters:

  • url (required) — string — Domain or URL to scan, e.g. "example.com" or "https://example.com".
  • fresh — boolean — Force a fresh re-scan instead of the cached result (results are cached up to 24h; the engine rate-limits re-scans). Equivalent to the scanner's rescan flag.

  Hints: read-only yes · destructive no · idempotent yes · open-world yes

• search_reputation_directory read-only

  Resolve an agent name or id-prefix to a real agent_id over the PUBLIC reputation directory (only agents whose reputation visibility is public). Zero-auth. The arriving-agent entry point: discover a concrete agent_id, then call get_reputation / verify_reputation on it.

  Parameters:

  • q — string — Name search (ilike) or agent-id prefix match.
  • page — integer — 1-based page number for pagination. Default 1.
  • sort — string — Result ordering. Default "score" (highest-rated first); other supported keys order by recency or name.
  • grade — string — Filter to one grade (e.g. `AAA`, `B`, `NR`).
  • per_page — integer — Number of results per page. 1–100, default 20.
  • confidence — string — Filter to agents at a given reputation-confidence level (driven by how much evidence backs the score).

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• verify_reputation read-only

  Attest an agent's Trust Rating — returns a Merkle-root + hash-chain attestation (hash_chain_valid) proving the rating derives from an unbroken, append-only checkpoint chain, plus a pointer to the signed integrity certificate. This is a chain-integrity attestation, NOT an in-band Ed25519 signature check (that parity is verify_scan, for website scorecards).

  Parameters:

  • agent_id (required) — string — Agent identifier (e.g. smolt-abc123)

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• verify_scan read-only

  Verify a website scan scorecard's Ed25519 signature IN-BAND (verify, don't trust). Pass a `scan` (a scorecard from scan_trust) or a `url` to re-scan; returns {verified, key_id, canonicalization} checked against the public key at mnemom://iitr/jwks. Zero-auth. Spec + rubric: https://www.isittrustready.ai/rubric and https://docs.mnemom.ai/.

  Parameters:

  • url — string — Alternatively, a domain/URL to re-scan and then verify.
  • scan — object — A scan scorecard previously returned by scan_trust (or iitr's /r/ JSON), passed back verbatim to verify. Same shape as scan_trust's result; the signature is checked against mnemom://iitr/jwks.

  Hints: read-only yes · destructive no · idempotent yes · open-world yes

Publisher website Repository

Measured by MCPYP probing. Untested fields are omitted, never estimated. Listing is always free; MCPYP never proxies calls or stores user tokens.