Agent Tool-Trust Verifier

Creator Fusion Labs — Agent Protection Suite

Verify the provenance of an MCP tool or A2A agent before your agent trusts it and calls it. Point this actor at an A2A agent-card or MCP manifest URL and it returns a single, structured verdict row: a trustScore (0–100), a verdict (trusted / caution / untrusted), a per-check breakdown, and a signature status — so an autonomous agent can gate the decision to load a tool.

It is honest about what provenance actually proves. Signals that cannot be determined from the document alone (for example, a signature with no published key to check it against) are reported as present-unverified or not assessed, never inflated into a false positive.

What it checks

Check	What it means
https-enforced	Endpoint uses TLS; plain HTTP is flagged.
reachable	The URL responds 2xx (GET, hard-timeout guarded).
parses-json	The body is a JSON object.
schema-valid	Required fields for its type are present (A2A agent-card: name, url, capabilities/skills; MCP manifest: identity + tools/capabilities/protocolVersion).
signature	JWS/proof present? If a public key is embedded in a compact JWS, it is cryptographically verified. Otherwise reported as present-but-unverifiable.
domain-sanity	Typosquat/lookalike vs expectedDomain (edit distance), IP-literal host, and punycode/homograph hosts are flagged.
scope-analysis	Declared capabilities vs your requiredScopes — extra capabilities are flagged as over-permissioning, missing ones as gaps.

What it can and cannot determine (read this)

• It can verify a compact JWS only when the signer's public key is embedded in the token header. In the common case where the key lives out-of-band (a JWKS URL), the signature is honestly reported as present-unverified — presence is confirmed, authenticity is not.
• It does not fetch or trust external key registries, and it does not assert reputation. There is no "this vendor is reputable" score here, because that cannot be derived from a manifest. Domain match is structural (edit distance + suffix), not a public-suffix-list parse.
• A trusted verdict means "the declared provenance is internally consistent and matches what you expected", not "this tool is safe to run with your credentials". Treat it as a gate, not a guarantee.

Input

{
  "agentCardUrl": "https://example.com/.well-known/agent-card.json",
  "mcpManifestUrl": "https://example.com/mcp.json",
  "expectedDomain": "example.com",
  "requiredScopes": ["get_forecast"]
}

At least one of agentCardUrl or mcpManifestUrl is required. If both are given, the agent card is the primary target. expectedDomain and requiredScopes are optional; omit them to skip those checks (they are then reported as not assessed).

Output (one row)

{
  "target": "https://example.com/.well-known/agent-card.json",
  "targetType": "a2a",
  "trustScore": 82,
  "verdict": "trusted",
  "signatureStatus": "present-unverified",
  "checks": [{ "name": "https-enforced", "pass": true, "detail": "..." }],
  "warnings": ["Signature present but could not be verified."]
}

Integration

MCP (any MCP-capable agent via the Apify MCP server):

Call actor apricot_blackberry/agent-tool-trust-verifier with
{ "agentCardUrl": "https://example.com/.well-known/agent-card.json", "expectedDomain": "example.com" }

curl (run and read the result):

curl -X POST "https://api.apify.com/v2/acts/apricot_blackberry~agent-tool-trust-verifier/run-sync-get-dataset-items?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"agentCardUrl":"https://example.com/.well-known/agent-card.json","expectedDomain":"example.com","requiredScopes":["get_forecast"]}'

JavaScript (apify-client):

import { ApifyClient } from 'apify-client';
const client = new ApifyClient({ token: process.env.APIFY_TOKEN });
const run = await client.actor('apricot_blackberry/agent-tool-trust-verifier').call({
  agentCardUrl: 'https://example.com/.well-known/agent-card.json',
  expectedDomain: 'example.com',
  requiredScopes: ['get_forecast'],
});
const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items[0].verdict, items[0].trustScore);

Python (apify-client):

from apify_client import ApifyClient
client = ApifyClient(token="APIFY_TOKEN")
run = client.actor("apricot_blackberry/agent-tool-trust-verifier").call(run_input={
    "mcpManifestUrl": "https://example.com/mcp.json",
    "expectedDomain": "example.com",
    "requiredScopes": ["read_file"],
})
row = client.dataset(run["defaultDatasetId"]).list_items().items[0]
print(row["verdict"], row["trustScore"])

Pricing

Pay-per-event. You pay a small actor-start fee plus one verify charge per completed verification. Verifications that cannot reach or parse the target are not charged — the run fails loud and no verify event is billed (the failing-check row is still written to the dataset for you to read). Any proxy usage is billed to you, the caller.