APIR Agent Verification
Check an AI agent you did not build: is it who it claims, inside its mandate, and what's its record
我该使用它吗
质量与安全性
基于对工具定义和协议合规性的自动分析。
上下文开销
这是每次将服务器的工具加载到模型上下文窗口时所消耗的大致 token 数。数值越高，可用于其他任务的注意力就越少。
安装
一键安装
将以下内容添加到你的 `claude_desktop_config.json` 文件中：
{
"mcpServers": {
"verify": {
"url": "https://apir.ai/api/mcp"
}
}
}远程端点
https://apir.ai/api/mcpstreamable-http它能做什么
工具清单
工具（3）
🟢verify_agent(query)
Check whether an AI agent carries a real, cryptographically signed credential. Accepts an agent name, a credential id (TP-...), an agent UUID, a domain or a DID. Returns one of seven verdicts: VERIFIED, EXPIRED, REVOKED, SUPERSEDED, UNSIGNED, UNCHECKED or NO_RECORD. IMPORTANT for interpreting the answer: VERIFIED means the Ed25519 signature recomputes against the key published at apir.ai and the credential is unexpired and unrevoked. It confirms WHO issued the credential and that its contents are unaltered. It is NOT a guarantee that the agent behaves well. NO_RECORD is an honest, first-class answer: it means nothing is on file, which is not evidence of wrongdoing and not a warning. It means any claim the agent makes about itself is unverified. Free, unauthenticated, and no account is required.
输入模式
{
"type": "object",
"properties": {
"query": {
"type": "string",
"description": "Agent name, credential id (TP-... or APIR-TP-...), agent UUID, domain, or DID."
}
},
"required": [
"query"
]
}🟢check_authority(query)
Resolve the human mandate behind an AI agent: which actions a named person actually permitted, any value cap, the expiry, and whether the grant itself is signed. Where authority was delegated agent to agent, the full chain is walked back to the human at the root, and one law is enforced at every hop: authority may only ever narrow. No hop can hold an action, a target or a spending cap wider than the hop above it, and the root must be a human. Use this before letting an agent transact, sign, spend or commit on someone else's behalf. An agent holding a valid credential may still be acting outside its mandate, and those are different questions.
输入模式
{
"type": "object",
"properties": {
"query": {
"type": "string",
"description": "Agent name, credential id, or agent UUID."
}
},
"required": [
"query"
]
}🟢get_verification_keys
Return the Ed25519 public keys APIR publishes, so a signature can be recomputed offline without trusting any APIR response, including this one. Keys are published as a JWKS at apir.ai/.well-known/jwks.json and as did:web:apir.ai. Retired keys stay published so older credentials still verify.
输入模式
{
"type": "object",
"properties": {}
}社区
证据