Official MCP RegistryListed
TWZRD Agent Intelligence
Pre-spend trust for AI agents that buy: check x402 services and product listings before paying.
First seen 2 Oct 2026. Evidence as of 10 Oct 2026.
28
Tools
From an anonymous probe
1
Source listings
Each with its own history
2
Recorded changes
Since first seen
Tools
| Tool | Description | Behaviour |
|---|---|---|
| check_listing | Pre-spend check of one product against the published listing cards. Free, read-only. Returns unknown_seller when no published card covers the product (not a clean seller), expired when the card is past expires_at, check_failed when the card cannot be verified or the declared price is above the advertised one, and advertised when a current card matches. It never authorizes a payment: authorizes_spend is always false. needs_approval is true for every result except advertised, and also for an advertised card that advertises nothing, advertises no price, cannot check the declared price, or is declared below its advertised price (an unverified discount, including zero). It does not fetch the store page, open a checkout or move money. | Read-only |
| compare_wallets | Free discovery: side-by-side intel for two wallets (e.g. choosing between two candidate providers). Returns both full score objects and which ranks higher by the wash-discounted effective_score ("tie" on equal, null if a side is unavailable). | Read-only |
| evaluate_x402_resource | One-shot x402 guard. Fetches resource_url, extracts the seller wallet from the 402 accepts array (prefers Solana network entries), runs TWZRD preflight, and returns a spending decision. Side effect: a live 402 observation (resource_url, payTo, price) is upserted into the service catalog when the catalog database is configured; this tool is not read-only. wash_flagged=true never soft-allows. Unlabeled leftover 0.05 / leftover=0 is not a unit price. Decision: "allow" -> proceed only under agent policy. Never when wash_flagged=true. "warn" -> proceed with caution up to the cap; first paid hop is teaser_url ($0.001 /quick). Optional V7 receipt_url is $0.05. "block" -> DO NOT PAY. Stop immediately. "unknown" -> is_x402 == False: no 402 challenge was issued at all, so nothing was evaluated -- this is NOT a trust verdict. A seller can trivially make this happen by returning a non-402 status to this probe while charging through a different path for a real caller. Never treat "unknown" as a green light; if the caller actually intends to pay this resource_url, that separate payment path needs its own evaluation. Hard-stops: wash_flagged=true never soft-allows (decision=block). price_usdc is a unit price only when price_kind=exact. Unlabeled leftover 0.05 / leftover=0 and scheme=upto leftover defaults are not a per-request price. Revenue path: when decision is "warn", fetch teaser_url first ($0.001 USDC to TWZRD, GET /v1/intel/quick/{seller}). Optional receipt_url is the $0.05 V7 signed credential. | Destructive |
| get_claim | Read the Vuori Kore Short listing-claim artifact (com.twzrd.shopping.listing_claims/1.1). Tool twin of the twzrd://claims/vuori-kore resource: what is claimed about this checkout, by whom, in what state, on what evidence. Verified on every read (publication signature, artifact digest, schema, evidence binding); a read that fails any check is refused, never served. `unknown` claims stay unknown. Each claim carries expires_at; after it, treat the claim as historical. Read-only; this never starts a payment or checkout. | Read-only |
| get_counterparties | Free discovery (capped teaser): the top-N merchants a wallet actually pays, by event count, with per-edge tx_count / total_usdc / first+last timestamps. See WHO a counterparty transacts with before trusting it. The list is capped (default 10, max 25) and `capped`/`total_distinct_merchants` disclose how much is withheld; the FULL deduped payment graph and numeric edge weights are part of the paid intel surface (GET /v1/intel/trust/{wallet}). Fail-open. | Read-only |
| get_evidence | Read the evidence bundle behind the Vuori Kore Short listing claims. Tool twin of the twzrd://claims/vuori-kore/evidence resource: canonical_evidence/1 envelopes and capture records. A claim's evidence digest is the RFC 8785 SHA-256 of its envelope; recompute it to check. Verified with the artifact on every read and refused on any mismatch. Raw page bytes are not served. Read-only. | Read-only |
| get_facilitator_footprint | Free discovery: which x402 facilitators a payer has settled through, and how many. unique_facilitators = 1 is a thin/captive agent (locked to one rail); breadth across facilitators indicates a more established cross-rail agent. Returns the facilitator_ids list plus tx/merchant context. Fail-open: a DB gap returns data_available=false rather than erroring. | Read-only |
| get_merchant_card | Free merchant card: observed inbound payment-graph quality around a Solana receive wallet. Dual input (PR-3): pass ``wallet`` and/or ``resource_id``. Resource resolves via the first-party registry (TWZRD seed) to a pay_to, then the same graph card. Does NOT claim service quality (resource_listing_only / catalog_listing_only). HTTP twin: GET /v1/intel/merchant_card/{wallet_or_resource_id}. Compact (default) includes observed_at, stale, corpus_complete_day, corpus_age_days. Catalog services stay behind full=true. wash_flagged is tri-state: true (flagged) | false (evaluated clean) | null (never evaluated - NOT clean). wash_flagged=true never soft-allows (next_action.decision=refuse; no warn/allow/quick). Unlabeled leftover 0.05 / leftover=0 is not a unit price; cheapest_listed_price_usdc omits leftover and upto_cap amounts. Route on next_action.decision (refuse | insufficient_evidence | no_negative_signal); the card is down-only and never returns allow. `reason` carries the specific finding (e.g. a soft wash risk collapsed into "refuse", or a corpus outage collapsed into "insufficient_evidence") when the 3-value decision alone is not enough context. | Read-only |
| get_poec_score | Free preview: PoEC v0 (Proof of Economic Contribution) for a payer wallet, computed from the same observed x402 snapshot score_wallet_for_intel returns. poec_score = log10(1 + observed USDC sent) x success_quality x diversity x wash_cleanliness, behind hard floors (>=5 paid calls, >=3 distinct counterparties, wash_factor >= 0.5, not single-counterparty, wash_flag clean). Any failed floor, or an unobservable corpus, scores 0.0 with floors_passed=false - the floors fail closed, never open. wash_factor is a cleanliness multiplier (1.0 = clean) and is never inverted. Honesty contract: `claimable` is ALWAYS false. Volume here is corpus-observed, not a payout unlock. `success_quality` comes from the payer join onto signed `receipt_settlement_leaves` (0211); if that join is unobservable, `success_rate` stays in evidence_gaps and the score reads 0.0. What this surface already shows honestly is the floor filter (eligible_v0) and every component the score is built from. Self-reported settlements go through submit_contribution_claims. Base (EVM) 0x wallets are scored from the relayer-attributed x402_base_daily rollup (90d) with the same shape, but no wash/sybil graph exists for Base payers yet, so their wash_flag reads "unknown" (never "clean"), the wash floor stays closed, and poec_score stays 0.0 regardless of real volume. A wallet the corpus could not observe at all returns `error` set; on that path any real observed Base volume is attached under `base_observed`. | Read-only |
| get_provider_reputation | Free discovery: corpus-backed SELLER reputation for a merchant/provider wallet. Answers "is this provider organic, narrow, or a wash fleet?" from the merchant's inbound payment graph over the last 90 days: unique payers, repeat-payer %, heavy-fleet revenue concentration, captive-payer % (onboarding-sink proxy), and a scripted-fleet uniformity signal, and top_payer_tx_pct (captive concentration). Returns wash_label + reputation tier + wash_flagged (tri-state: true | false | null; null = never evaluated, not clean). Complements score_wallet_for_intel (payer side) with the seller side. wash_flagged=true never soft-allows (buyer refuse; preflight block). Fail-open: a DB gap returns wash_label/tier "unknown" AND wash_flagged=null (plus wash_confidence) - an unevaluated verdict, never a clean one. This is the free seller signal. First paid hop is GET /v1/intel/quick/{wallet} (0.001 USDC). Optional V7 renorm + signed receipt is GET /v1/intel/trust/{wallet} (0.05 USDC). | Read-only |
| get_publication | Read the signed publication record behind the current Vuori Kore Short claims. Tool twin of the twzrd://claims/vuori-kore/publication resource. Returns the Ed25519 publication record, the verify key and its sha256 fingerprint. Verify the signature over the signed message, then compare sha256 of each get_claim / get_evidence text with artifact_digest / evidence_digest. With the key fingerprint pinned from a second source (the published fingerprint in the connector packet), that check does not trust this server; without it, it shows only that the record and the served bytes agree. The signature admits bytes to the resource; it is not a merchant attestation. Read-only. | Read-only |
| get_readiness_card_tool | PRIMARY free pre-spend gate (advisory). Pass seller_wallet OR resource_name. wash_flagged=true never soft-allows. Unlabeled leftover 0.05 / leftover=0 is not a unit price. When to use: before any x402 payment to a seller/resource. When not to use: after you already decided to refuse; use verify_receipt for signed receipts only. Pricing: free. Result is advisory (buyer policy still applies). Hard-stops: wash_flagged=true never soft-allows (decision=block / do_not_pay; no warn/allow/quick). Unlabeled leftover 0.05 / leftover=0 is not a unit price; read price_kind. Caller-supplied or scheme/price_kind=exact 0.05 stays a unit price. Decision semantics (top-level, no nesting via MCP): decision=block / recommended_action=do_not_pay -> DO NOT PAY. decision=warn / recommended_action=proceed_with_cap -> pay only up to maximum_recommended_spend_usdc. decision=allow / recommended_action=proceed_for_small_spend -> proceed under agent policy (no free-tier cap). next_action (enrollment handoff — do not stop after free card): next_step_type / payment_required / executable / command describe an optional next step. A host may use command only under its own policy. Never paste path templates (:pubkey / {pubkey}) as seller_wallet. Also returns reason_codes[], confidence, model_version, decision_envelope. No counterparty named (seller_wallet missing / a template / not a wallet, and no resource_name or resource_url): decision=block, trust_score null, score null, null_reason=no_subject, reason_codes NO_COUNTERPARTY (+ PLACEHOLDER_SELLER_WALLET), seller_wallet_rejected echoes what you sent. That is an input bug, not a seller verdict: fix the input and re-run. trust_score is a free heuristic, NOT the full corpus. Next: on allow/warn for material spend, next_action.command is the optional AgentCash paid-trust or AutoGate install string, then verify_receipt on the signed V7 receipt. Optional: twzrd_watch_add for re-check after recheck_after_unix. Additive: top-level aop_bind program registry (evidence hierarchy) when enabled; never mutates decision / can_spend. | Read-only |
| get_shopping_check | Read the free Agent Shopping Check for Vuori Kore Short, Ink, US. Same report as https://twzrd.xyz/shopping-check/vuori-kore/: product context, advertised claims with exact sources and observation times, unverified purchase completion and other gaps, and three editorial merchant fixes. Built from the verified signed publication on every read. Expired observations are historical. Never pays or starts checkout. | Read-only |
| get_solana_market_status | Health probe for the Solana Market API data backend. Call this to gate or degrade gracefully BEFORE the other get_solana_market_* tools: it does a short-timeout hit on the data service and reports whether it is reachable, so an agent can tell "market has no data" from "service is down" without failing a real query. Free discovery tool. When the market data service exposes /status, the response includes prod_key_configured, data_first_available, and an actionable note describing what to configure for full on-chain visibility. | Read-only |
| get_top_intel_agents | Leaderboard of observed payer wallets in the x402 settlement graph, each with its intel score. This is behavioral corpus research, not identity proof or evidence that the wallet is a TWZRD customer. Ranks by the wash-discounted effective_score (single-counterparty fleets are demoted, not hidden) with a deterministic tiebreaker. Set min_paid_calls to suppress one-shot wallets and max_days_since_last to suppress dormant ones. | Read-only |
| get_x402_directory | Wash overlay on ingested PayAI/CDP/Agentic listings (PayAI not_indexed). Prefer HTTP GET /v1/intel/resources for the resource join SOT (callable URL + discovery claim listed|live_402 + settlement reputation on pay_to). That surface is HTTP-only. Use this tool when you need the ingested listing overlay indexed by payTo. Not GET /v1/intel/bazaar/offers (TWZRD Bazaar catalog) and not 402 extensions.bazaar. Solana wash overlay is the only wash graph. Base listings additionally carry high-confidence EIP-3009 corpus membership from x402_base_daily; they remain wash_unknown. Polygon listings carry wash_unknown. Query params — flagged_only, limit, source — mirror GET /v1/intel/x402-directory. | Read-only |
| is_wash_fleet | Free discovery: cheap circular-flow (wash) check for a payer wallet. Returns the CATEGORICAL classification (clean / self_pay / reciprocal / self+reciprocal), an is_circular bool, and the observed event counts + distinct_merchants from the wallet's corpus edges. Use as a fast Sybil/wash gate before trusting a counterparty. Accepts a Solana public key or a Base/EVM address. On Base the signal reads the high-confidence x402 rollup only, and 3-cycle ring detection does not run (Solana-only precomputed matview), so ring_events=0 there means NOT EVALUATED, never "no rings observed". Fail-open: a DB gap returns classification "unknown". The numeric wash discount (wash_factor / wash_ratio) and the full renormalized model stay paid — they are NOT returned here. | Read-only |
| low_level_preflight | Low-level preflight check. Returns a richer result object including paid_quick_endpoint ($0.001 first hop) and optional paid_trust_endpoint ($0.05 V7). wash_flagged=true never soft-allows. Unlabeled leftover 0.05 / leftover=0 is not a unit price. Prefer get_readiness_card_tool for most callers. Use this when you need max_spend_recommendation_usdc, full_report_hint, or the suggest_full_report flag. The embedded `readiness_card` carries the SAME full shape as get_readiness_card_tool (see the outputSchema). Hard-stops: wash_flagged=true never soft-allows (decision=block; no warn/allow/quick). Unlabeled leftover 0.05 / leftover=0 is not a unit price; read readiness_card.price_kind. | Read-only |
| score_wallet_for_intel | Free discovery: PAYER-side 0-100 intel score for a wallet from the x402 payments it SENT (paid calls, distinct counterparties, volume, recency). Not a seller check: to vet a seller/payTo before paying, use get_readiness_card_tool (gate) or get_provider_reputation / get_merchant_card (seller reputation). A pure seller scores 0 here by construction and the response says so in seller_side_hint. A Base 0x wallet is scored from the relayer-attributed x402_base_daily rollup (90d) with the same shape; no Base wash graph exists yet, so its wash_flag is "unknown" unless single-counterparty. Uses a simple transparent heuristic (volume log + breadth + spend log + recency decay) — the exact formula is returned inline as `score_model`. Returns intel_score, the wash-discounted effective_score + wash_flag/wash_factor (cheap Sybil signal), counts, component breakdown, and a data_available flag. Malformed pubkeys are rejected cleanly; the failure path returns the same shape as success. Sourced from the cross-facilitator corpus via the public Rust HTTP endpoint GET /v1/agents/{wallet}/x402 (backed by the x402_solana_payer_agg matview). First paid hop is the score-only teaser GET /v1/intel/quick/{wallet} (0.001 USDC). Optional V7 signed receipt (intel_renorm_v1_1: score_raw, confidence, breadth_factor, wash_factor) is GET /v1/intel/trust/{wallet} (0.05 USDC). | Read-only |
| score_wallets_batch | Free discovery: score up to 25 wallets in a single call (each via the same transparent model as score_wallet_for_intel). Convenience for triaging a set of candidate counterparties at once; `requested`/`capped` disclose any truncation. | Read-only |
| submit_contribution_claims | PoECX bridge: report settlements from your OWN rails (not TWZRD's paid routes) for cross-check against TWZRD's independently-ingested x402 corpus, by on-chain signature. A claim whose tx_signature, payer/merchant, and amount all match what TWZRD's own ingest independently observed is materially stronger evidence than either a bare self-report or the anonymous corpus alone — the signature is real and on-chain, and a mismatch can't be forged to pass. Unmatched claims are returned too, with a reason, never silently dropped. This is a preview, not an unlock: `claimable` is always false. It exists to let a real counterparty with its own settlement volume start feeding PoECX before any on-chain payout path exists — see the PoECX plan. Capped at 25 claims per call (discovery convenience, not bulk export); extras are dropped, never silently ignored — see `capped`/`claims_requested`. Within that cap, only the first claim per (chain, tx_signature, transfer_index) is checked. Omitted transfer_index is the first leg (dedup key 0). Later copies of the same leg appear in `unverified` with reason_code `duplicate_claim` and `duplicate_of` pointing to the zero-based first input index. Two legs of one tx count twice. This deduplicates one preview report, not claims across separate calls. | Read-only |
| twzrd_demo_gate | No-spend transcript of the TWZRD buyer-side x402 trust gate, a recorded example, not a live run - discoverable at runtime with no install and no human. Returns a deterministic transcript showing the gate's behaviour on a fixture counterparty: the block path ABORTS and a wallet/signer is never contacted, the allow path would proceed, and ok=true. Spends no USDC, contacts no wallet. This call surfaces an EXTERNAL_RUN *candidate* in TWZRD's honest attribution ledger (it carries a non-internal integration id + your run_id, tagged with your real inbound IP). A candidate is NOT an EXTERNAL_RUN: proof still requires a non-VPS source_ip and matching your run_id to your own transcript via packages/twzrd-agent-intel/scripts/count_attributed_runs.py --confirm. See the returned not_external_run_proof. | Read-only |
| twzrd_watch_add | Register a re-call watch on a seller wallet. After registration, TWZRD will proactively re-check the seller's trust intel when `recheck_after_unix` elapses and POST a notification to your webhook_url if the score/decision materially changes. Returns the watch row with the computed recheck_after_unix timestamp so your agent knows exactly when to expect a re-call or proactively re-check itself. | Changes data |
| twzrd_watch_list | List active re-call watches for your agent wallet. Each watch shows the seller, current score/decision, and recheck_after_unix timestamp (untrusted V5/V6 hint). evaluateRecall / shouldRecheckTrusted is the consumer gate; do not treat due / shouldRecheck as a trusted allow. | Read-only |
| twzrd_watch_remove | Deactivate a re-call watch by ID. payer_wallet must match the owner. | Changes data |
| verify_receipt | Free utility: offline-verify a portable V7 trust receipt (earlier V5/V6 receipts still verify), the "after you pay" half of the loop. Recomputes the Keccak256 leaf from the receipt's preimage (tamper-evidence) AND verifies the Ed25519 signature against the published TWZRD receipt-signing key (authenticity). Returns valid/leaf_valid/signature_valid plus the recomputed leaf and any errors. Pure and offline — no DB, no network, no payment. Pass the entire PaidReceipt object you were issued. Trust is anchored on the published key (or expected_pubkey), NOT on whatever pubkey the receipt carries. max_age_seconds: optional freshness gate (replay protection). Same semantics as the Python library verify_paid_receipt(..., max_age_seconds=...) and the standalone CLI --max-age. | Read-only |
| verify_root_inputs | Independent root verification (see tools/root_verifier.py for the recompute logic). | Read-only |
| verify_x402_settled_claim | Verify a receipts-ledger settlement; this is evidence, not a spend decision. | Read-only |
Change history
- evaluate_x402_resource: description changed (+"Side effect: a live 402 observation (resource_url, payTo, price) is upserted into the service catalog when the catalog database is configured; this tool is not read-only.")
- evaluate_x402_resource: annotations changed
| Source | Listing | First seen | Last seen | Versions |
|---|---|---|---|---|
| Official MCP Registry | xyz.twzrd.intel/twzrd-agent-intel | 2 Oct 2026 | 10 Oct 2026 | 1 |