autobus — signed attestations for agents, $0.01 per call

Officialdeprecated12 tools

by ninefiveonefive · JavaScript

Signed attestations for agents, $0.01/call via x402: URL witness, AI permission, tx finality, JWKS.

This MCP server provides signed attestations for agents using $0.01 per call via x402 on Base. It supports an end-to-end flow involving an x402 URL witness, AI permission, and transaction finality, along with JWKS for verification. The repository emphasizes how to call the service and verify what is returned.

🛠️ Key Features

Signed attestations for agents
x402-based calls priced at $0.01/call on Base
URL witness, AI permission, and tx finality inputs
JWKS included for verification

🚀 Use Cases

Verifying web-bot authentication signatures
Request/response workflows where an agent needs signed attestations

⚡ Developer Benefits

Buyer-side documentation for calling and verifying the service
JWKS facilitates verification of signed attestations

⚠️ Limitations

Live endpoint requires using https://witness.holoweave.org and the x402 flow
Does not add dependencies (as stated in the excerpt) and includes no “phones home” behavior

Topics

ai-agentshttp-message-signaturesrfc7638rfc9421web-bot-authx402

Captured live from the server via tools/list.

pin_tool_surface

Compute a stable digest over an MCP server's tools/list — each tool's name, description and inputSchema — and return a signed attestation. Keep the digest; it is the baseline check_tool_surface_drift compares against later. Re-ordering tools and added metadata do not move it; a reworded description does.

Parameters1

tools

array

optional

The array returned by the MCP server's tools/list call, verbatim.

Raw schema

{
  "type": "object",
  "properties": {
    "tools": {
      "type": "array",
      "description": "The array returned by the MCP server's tools/list call, verbatim.",
      "items": {
        "type": "object",
        "properties": {
          "name": {
            "type": "string",
            "description": "The tool name a client selects by."
          },
          "description": {
            "type": "string",
            "description": "The text the model reads and obeys. This is what a rug pull rewrites."
          },
          "inputSchema": {
            "type": "object",
            "description": "The tool's declared input schema."
          }
        },
        "required": [
          "name"
        ]
      }
    }
  },
  "anyOf": [
    {
      "required": [
        "tools"
      ]
    },
    {
      "required": [
        "url"
      ]
    }
  ]
}

check_tool_surface_drift

Compare an MCP server's current tools/list against a baseline digest you hold and return a signed attestation naming every tool added, removed or silently redefined since then. A rewritten tool description is still schema-valid, so nothing that validates conformance can see it — only a comparison against what you pinned can.

Parameters3

url	string	optional	Instead of tools: the https address of the server's Streamable HTTP MCP endpoint; the surface is read from it.
tools	array	optional	The array returned by the MCP server's tools/list call now.
baseline	object	optional	The evidence block from a previous /v1/mcp-digest attestation.

Raw schema

{
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "description": "Instead of tools: the https address of the server's Streamable HTTP MCP endpoint; the surface is read from it."
    },
    "tools": {
      "type": "array",
      "description": "The array returned by the MCP server's tools/list call now.",
      "items": {
        "type": "object",
        "properties": {
          "name": {
            "type": "string"
          }
        },
        "required": [
          "name"
        ]
      }
    },
    "baseline": {
      "type": "object",
      "description": "The evidence block from a previous /v1/mcp-digest attestation.",
      "properties": {
        "tools": {
          "type": "object",
          "description": "The { name: digest } map from that call."
        },
        "surface_digest": {
          "type": "string",
          "description": "Optional. The whole-surface digest from that call."
        }
      },
      "required": [
        "tools"
      ]
    }
  },
  "anyOf": [
    {
      "required": [
        "tools",
        "baseline"
      ]
    },
    {
      "required": [
        "url",
        "baseline"
      ]
    }
  ]
}

witness_url

Fetch a public URL and return signed, timestamped evidence of what it served: status, provenance headers, SHA-256 of the body. Pass expect_sha256 from an earlier witness to learn whether the bytes changed. Keep the attestation; it verifies with our public key.

Parameters3

url	string	required	The public http(s) URL to witness. Private and loopback hosts are refused.
expect_sha256	string	optional	Optional: the body_sha256 from an earlier witness. You get UNCHANGED or CHANGED, signed.
method	string	optional	GET (default) or HEAD.

Raw schema

{
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "description": "The public http(s) URL to witness. Private and loopback hosts are refused."
    },
    "expect_sha256": {
      "type": "string",
      "description": "Optional: the body_sha256 from an earlier witness. You get UNCHANGED or CHANGED, signed."
    },
    "method": {
      "type": "string",
      "description": "GET (default) or HEAD."
    }
  },
  "required": [
    "url"
  ]
}

check_tx_finality

Read a Base transaction's receipt and return a signed settlement statement: succeeded or reverted, every USDC transfer it carried, block time, confirmations, and whether the block is safe or finalized by the chain's own tags. Verify an x402 payment without trusting the facilitator.

Parameters4

tx_hash	string	optional	The transaction hash, 0x + 64 hex. Or give payment_response instead.
payment_response	string	optional	The x402 v2 PAYMENT-RESPONSE header you received on payment, as is (base64 JSON with transaction and network). Replaces tx_hash and chain.
chain	string	optional	eip155:8453 (Base mainnet, default) or eip155:84532 (Base Sepolia).
expect	object	optional	Optional: { to, amount, token } — the transfer you expect; you get EXPECTED_TRANSFER_PRESENT or ABSENT.

Raw schema

{
  "type": "object",
  "properties": {
    "tx_hash": {
      "type": "string",
      "description": "The transaction hash, 0x + 64 hex. Or give payment_response instead."
    },
    "payment_response": {
      "type": "string",
      "description": "The x402 v2 PAYMENT-RESPONSE header you received on payment, as is (base64 JSON with transaction and network). Replaces tx_hash and chain."
    },
    "chain": {
      "type": "string",
      "description": "eip155:8453 (Base mainnet, default) or eip155:84532 (Base Sepolia)."
    },
    "expect": {
      "type": "object",
      "description": "Optional: { to, amount, token } — the transfer you expect; you get EXPECTED_TRANSFER_PRESENT or ABSENT."
    }
  },
  "anyOf": [
    {
      "required": [
        "tx_hash"
      ]
    },
    {
      "required": [
        "payment_response"
      ]
    }
  ]
}

check_ai_permission

May a named AI agent fetch, or train on, a URL? Reads robots.txt (RFC 9309) for that product token, Content-Signal, TDM reservation and noai signals, and returns a signed, dated verdict for that agent and that use.

Parameters5

url	string	required	The public http(s) URL you intend to use.
agent	string	optional	Your product token as it appears in robots.txt, e.g. GPTBot, ClaudeBot, CCBot. Default * (all agents).
use	string	optional	fetch (default), train, or input — the use the verdict is about.
check_page	boolean	optional	Also read the page for noai / TDM signals (default true).
expect_digest	string	optional	Optional. The `permission_digest` from a previous answer. The attestation then says whether the publisher's position on this agent and use has moved since.

Raw schema

{
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "description": "The public http(s) URL you intend to use."
    },
    "agent": {
      "type": "string",
      "description": "Your product token as it appears in robots.txt, e.g. GPTBot, ClaudeBot, CCBot. Default * (all agents)."
    },
    "use": {
      "type": "string",
      "description": "fetch (default), train, or input — the use the verdict is about."
    },
    "check_page": {
      "type": "boolean",
      "description": "Also read the page for noai / TDM signals (default true)."
    },
    "expect_digest": {
      "type": "string",
      "description": "Optional. The `permission_digest` from a previous answer. The attestation then says whether the publisher's position on this agent and use has moved since."
    }
  },
  "required": [
    "url"
  ]
}

witness_keys

Fetch a counterparty's JWK Set (OIDC jwks_uri or web bot auth key directory) and return a signed record of every key by RFC 7638 thumbprint, its defects, and a set digest; pass your prior digest or thumbprints to be told whether the keys rotated and which.

Parameters3

url	string	required	The https URL of a JWK Set. An origin alone is read at /.well-known/http-message-signatures-directory.
expect_digest	string	optional	Optional: set_digest from an earlier witness — you get UNCHANGED or ROTATED.
expect_thumbprints	array	optional	Optional: the thumbprints you pinned — ROTATED names which were added and removed.

Raw schema

{
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "description": "The https URL of a JWK Set. An origin alone is read at /.well-known/http-message-signatures-directory."
    },
    "expect_digest": {
      "type": "string",
      "description": "Optional: set_digest from an earlier witness — you get UNCHANGED or ROTATED."
    },
    "expect_thumbprints": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Optional: the thumbprints you pinned — ROTATED names which were added and removed."
    }
  },
  "required": [
    "url"
  ]
}

check_registry_drift

Give an official-registry server name (io.github.org/server). Reads the record, connects to the server it points at, and returns a signed attestation: record status, whether the remote answers as MCP, whether its stated version matches the record, and the tool surface's digest — CHANGED or UNCHANGED against a digest you hold. For agents that install by name.

Parameters4

server	string	required	The registry server name, namespace/name, e.g. io.github.example/weather.
version	string	optional	Optional: a specific version in the registry. Default: the latest.
expect_digest	string	optional	Optional: a surface_digest from an earlier call (or from /v1/mcp-digest). You get CHANGED or UNCHANGED, signed.
tools	array	optional	Optional: the tools/list array from your own session, for servers with no remote or that need your credentials.

Raw schema

{
  "type": "object",
  "properties": {
    "server": {
      "type": "string",
      "description": "The registry server name, namespace/name, e.g. io.github.example/weather."
    },
    "version": {
      "type": "string",
      "description": "Optional: a specific version in the registry. Default: the latest."
    },
    "expect_digest": {
      "type": "string",
      "description": "Optional: a surface_digest from an earlier call (or from /v1/mcp-digest). You get CHANGED or UNCHANGED, signed."
    },
    "tools": {
      "type": "array",
      "description": "Optional: the tools/list array from your own session, for servers with no remote or that need your credentials.",
      "items": {
        "type": "object"
      }
    }
  },
  "required": [
    "server"
  ]
}

witness_agent_card

Fetch an agent's /.well-known/agent-card.json, check it against the A2A specification's required fields, digest the card and each skill, and return a signed attestation — CHANGED or UNCHANGED against a digest you hold, naming skills added, removed or reworded. Signatures are recorded, not verified.

Parameters3

url	string	required	The agent's https origin (the card is read at /.well-known/agent-card.json) or the full https URL of its card.
expect_digest	string	optional	Optional: card_digest from an earlier witness. You get UNCHANGED or CHANGED, signed.
expect_skills	object	optional	Optional: the { skillId: digest } map from an earlier witness; skills added, removed or reworded are named.

Raw schema

{
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "description": "The agent's https origin (the card is read at /.well-known/agent-card.json) or the full https URL of its card."
    },
    "expect_digest": {
      "type": "string",
      "description": "Optional: card_digest from an earlier witness. You get UNCHANGED or CHANGED, signed."
    },
    "expect_skills": {
      "type": "object",
      "description": "Optional: the { skillId: digest } map from an earlier witness; skills added, removed or reworded are named."
    }
  },
  "required": [
    "url"
  ]
}

attest_mcp_server

Give a registry server name and, optionally, the baseline you hold. Returns one signed attestation: the registry record, the live server's tool surface and digest, every tool added, removed or redefined since your baseline, and the agent card at its origin if one is published.

Parameters5

server	string	required	The registry server name, namespace/name.
version	string	optional	Optional: a specific registry version.
baseline	object	optional	Optional: the evidence block from an earlier mcp-digest or mcp-server-attest call — { surface_digest, tools: { name: digest } }.
expect_card_digest	string	optional	Optional: card_digest from an earlier agent-card-witness call.
tools	array	optional	Optional: the tools/list from your own session, for servers with no remote.

Raw schema

{
  "type": "object",
  "properties": {
    "server": {
      "type": "string",
      "description": "The registry server name, namespace/name."
    },
    "version": {
      "type": "string",
      "description": "Optional: a specific registry version."
    },
    "baseline": {
      "type": "object",
      "description": "Optional: the evidence block from an earlier mcp-digest or mcp-server-attest call — { surface_digest, tools: { name: digest } }.",
      "properties": {
        "tools": {
          "type": "object"
        },
        "surface_digest": {
          "type": "string"
        }
      }
    },
    "expect_card_digest": {
      "type": "string",
      "description": "Optional: card_digest from an earlier agent-card-witness call."
    },
    "tools": {
      "type": "array",
      "description": "Optional: the tools/list from your own session, for servers with no remote.",
      "items": {
        "type": "object"
      }
    }
  },
  "required": [
    "server"
  ]
}

witness_urls

Fetch up to ten public URLs and return one signed attestation: per URL the status, provenance headers and SHA-256 of the body, with CHANGED or UNCHANGED against the digest you pinned for each. The same witness as witness_url, ten at a time, for watching many sources on a schedule.

Parameters1

items

array

required

Raw schema

{
  "type": "object",
  "properties": {
    "items": {
      "type": "array",
      "minItems": 1,
      "maxItems": 10,
      "items": {
        "type": "object",
        "properties": {
          "url": {
            "type": "string"
          },
          "expect_sha256": {
            "type": "string",
            "description": "Optional: the body_sha256 from an earlier witness of this URL."
          },
          "method": {
            "type": "string",
            "description": "GET (default) or HEAD."
          },
          "read": {
            "type": "boolean",
            "description": "Optional: also return the page as text (title and body, as /v1/url-read does, honouring the site's robots.txt)."
          },
          "max_chars": {
            "type": "integer",
            "description": "With read: the text limit, up to 200000."
          }
        },
        "required": [
          "url"
        ]
      }
    }
  },
  "required": [
    "items"
  ]
}

check_txs_finality

Up to ten Base transactions in one call — each by hash or by the x402 PAYMENT-RESPONSE header — returning one signed attestation: success, USDC transfers, block time, confirmations, safe or finalized. Reconcile a day's payments without trusting the facilitator.

Parameters1

items

array

required

Raw schema

{
  "type": "object",
  "properties": {
    "items": {
      "type": "array",
      "minItems": 1,
      "maxItems": 10,
      "items": {
        "type": "object",
        "properties": {
          "tx_hash": {
            "type": "string"
          },
          "payment_response": {
            "type": "string",
            "description": "The x402 PAYMENT-RESPONSE header, as is."
          },
          "chain": {
            "type": "string",
            "description": "eip155:8453 (default) or eip155:84532."
          },
          "expect": {
            "type": "object",
            "description": "Optional: { to, amount } the transfer must carry."
          }
        },
        "anyOf": [
          {
            "required": [
              "tx_hash"
            ]
          },
          {
            "required": [
              "payment_response"
            ]
          }
        ]
      }
    }
  },
  "required": [
    "items"
  ]
}

read_url

Fetch a public page and return its title and extracted text, bound to signed evidence of the bytes it came from — URL, time, status, SHA-256 — so what you quote is traceable to what was served.

Parameters3

url	string	required	The public http(s) URL to read.
max_chars	integer	optional	Characters of extracted text to return (default 20000, max 200000).
expect_text_sha256	string	optional	Optional. The `text_sha256` from a previous answer. The attestation then says whether the WORDS moved, ignoring bytes that change on every fetch. Covers the whole document whatever max_chars returns.

Raw schema

{
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "description": "The public http(s) URL to read."
    },
    "max_chars": {
      "type": "integer",
      "description": "Characters of extracted text to return (default 20000, max 200000)."
    },
    "expect_text_sha256": {
      "type": "string",
      "description": "Optional. The `text_sha256` from a previous answer. The attestation then says whether the WORDS moved, ignoring bytes that change on every fetch. Covers the whole document whatever max_chars returns."
    }
  },
  "required": [
    "url"
  ]
}

README.md4 KBView on GitHub

web-bot-auth-check

Find out why your web bot auth signature is being rejected.

Signed attestations, paid per call over x402 on Base.

Part of autobus, which is where the rest of these live — one face per product, each carrying everything its buyer needs.

This repository is the buyer's side: how to call the service, and how to verify what it gave you. It carries no dependencies and nothing here phones home.

Live at https://witness.holoweave.org. No account, no key, no signup. Call the endpoint, get a 402 with a quote, pay, get a signed attestation.

What it answers

`POST /v1/wba-thumbprint` — $0.01

Web bot auth keyid verification for AI agents. Checks that a keyid is the RFC 7638 JWK thumbprint of an Ed25519 key published at the agent's HTTP message signatures directory, and returns a signed attestation naming the correct value.

Anchored to RFC 7638 JWK Thumbprint, with RFC 8037 Appendix A.3 for Ed25519 (RFC 7638), read 2026-08-23.

`POST /v1/wba-signature` — $0.01

Web bot auth signature verification for AI agents. Verifies an RFC 9421 HTTP message signature against the Ed25519 key published at the agent's key directory, and returns a signed attestation naming the component that failed.

Anchored to RFC 9421 HTTP Message Signatures (RFC 9421), read 2026-08-23.

`POST /v1/signature-acceptance` — $0.01

Web bot auth acceptance check for AI agents. Verifies a signed request end to end — key directory, RFC 7638 keyid thumbprint, RFC 9421 Ed25519 signature — and returns a signed attestation naming which verifiers' published rules it breaks.

Anchored to draft-meunier-web-bot-auth-architecture (-05), read 2026-08-23.

`POST /v1/wba-self` — $0.01

Web bot auth standing check for AI agents, on the request that arrives: sign this call the way your agent signs every request and receive a signed attestation covering your key directory, the keyid against the RFC 7638 thumbprint of a key published there, the RFC 9421 Ed25519 signature verified against that key, and which named verifiers' published rules the request breaks. Nothing to paste, nothing stored; call it from your own schedule.

Anchored to draft-meunier-web-bot-auth-architecture (-05), read 2026-08-23.

Evidence, never conclusions

An attestation says what is true of the artifact you sent, against a named specification, at a stated time. It never says you are compliant, valid or approved — those are conclusions, and they are yours to draw.

A finding looks like "keyid matches the kid of key 0 but NOT its RFC 7638 thumbprint". It does not look like "your setup is wrong".

Calling it

code

POST https://witness.holoweave.org/v1/wba-thumbprint
Content-Type: application/json

{
  "key_directory": "https://signer.example/.well-known/http-message-signatures-directory",
  "keyid": "poqkLGiymh_W0uP6PZFw-dvez3QJT5SolqXBCW38r0U"
}

Unpaid, that returns 402 with a PAYMENT-REQUIRED header carrying the quote: scheme exact, network eip155:8453 (base-mainnet), the amount in atomic units, and the asset. Pay with an x402 client and repeat the call with the PAYMENT-SIGNATURE header. See examples/call.mjs for the whole flow in one dependency-free file.

A GET returns the same 402, so a crawler can read the price without buying anything.

Verifying what you were given

Every attestation is signed Ed25519 over the RFC 8785 canonical form of the attestation object alone — the signature block is not part of what is signed.

code

node verify.mjs attestation.json

verify.mjs has no dependencies and does not call us. The public key is in key.json and is also served live at https://witness.holoweave.org/v1/key.

examples/attestation.json is a real one, bought on mainnet for a cent. Verify it before you trust anything else here.

Fixtures

fixtures.json is the published fixture suite: inputs and the exact findings they must produce. If a fixture stops matching, our judgment moved, and you can tell without asking us.

Idempotence

The same input digest is served from cache and not charged twice. Asking the same question again is free; asking a different one is a different question.

Operated from Austria as a Kleinunternehmen. Imprint and privacy notice at https://witness.holoweave.org/impressum.html and /datenschutz.html.

Install

Tools (12)

pin_tool_surfacecheck_tool_surface_driftwitness_urlcheck_tx_finalitycheck_ai_permissionwitness_keyscheck_registry_driftwitness_agent_card

Remote endpoint

Streamable HTTP

Hosted server - connect over the network, no local install.

url

https://witness.holoweave.org/mcp

Add to VS Code Add to Cursor

claude_desktop_config.json

json

{
  "mcpServers": {
    "autobus": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://witness.holoweave.org/mcp"
      ]
    }
  }
}

Desktop config is stdio-only; this bridges via mcp-remote. Native remote: Settings > Connectors.

🛠️ Key Features

🚀 Use Cases

⚡ Developer Benefits

⚠️ Limitations

Topics

pin_tool_surface

check_tool_surface_drift

witness_url

check_tx_finality

check_ai_permission

witness_keys

check_registry_drift

witness_agent_card

attest_mcp_server

witness_urls

check_txs_finality

read_url

web-bot-auth-check

What it answers

POST /v1/wba-thumbprint — $0.01

POST /v1/wba-signature — $0.01

POST /v1/signature-acceptance — $0.01

POST /v1/wba-self — $0.01

Evidence, never conclusions

Calling it

Verifying what you were given

Fixtures

Idempotence

Install

Remote endpoint

Related servers

`POST /v1/wba-thumbprint` — $0.01

`POST /v1/wba-signature` — $0.01

`POST /v1/signature-acceptance` — $0.01

`POST /v1/wba-self` — $0.01