io.github.lithvall/trustbench

Est-ce que io.github.lithvall/trustbench est sûr ?

Au dernier audit MCP Hub, le serveur MCP « io.github.lithvall/trustbench » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 3 outils

• get_rankings≈ 237 tokens

  Get TrustBench liveness rankings for x402 providers by capability. Returns a scored list of providers with latency and success-rate telemetry. Methodology note: scores are derived from HEAD-probe liveness checks (3 samples from one host), not a rigorous benchmark. See trustbench.io/methodology. Output: returns a JSON array. Each object has name (string, provider name), score (number 0-100, composite liveness score), latency_p50 (number, ms), success_rate (number 0.0-1.0, last 7 days), endpoint (string, URL), capabilities (array of strings).

  Paramètres, retour & exemple (1)

  Paramètres

  • capability · string · requis · search | inference | data | media | infra
    The provider capability to query rankings for.

  Exemple d'appel

  {"name": "get_rankings", "arguments": {"capability": "search"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_receipt≈ 278 tokens

  Fetch a TrustBench routing receipt by ID. Receipts are immutable, Ed25519-signed records of a routing or payment event. Use to verify what was paid, to whom, for what capability, and what the on-chain settlement reference is. IDs start with rcpt_ (Phase 3) or rrcpt_ (Phase 4). Output: returns the signed receipt envelope as JSON. Phase 3 (rcpt_) returns a SignedReceipt with receipt (call metadata + settlement ref) and signature (Ed25519 over JCS-canonicalized receipt body). Phase 4 (rrcpt_) returns {receipt, signature} where receipt.paid contains routing details and signature covers the canonical envelope. To verify an envelope offline use the verify_receipt tool with the returned JSON, or @trustbench/verify-receipt npm.

  Paramètres, retour & exemple (1)

  Paramètres

  • receipt_id · string · requis
    The receipt ID, e.g. rcpt_01KQY7C44GAPSXZPFQYRZ1D10C or rrcpt_…

  Exemple d'appel

  {"name": "get_receipt", "arguments": {"receipt_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• verify_receipt≈ 384 tokens

  Verify the Ed25519 signature on a TrustBench receipt. Two modes: (1) Lookup mode — pass receipt_id and the server fetches the receipt from trustbench.io and re-runs verification (handy when you only have an ID). (2) Offline mode — pass receipt_json (the full {receipt, signature} envelope an agent received from a third party) and the server verifies the Ed25519 signature against the published public key at trustbench.io/.well-known/trustbench-pubkey without trusting the database. Exactly one of receipt_id or receipt_json must be provided. Output: returns JSON with receipt_id, signature_valid (boolean), on_chain_verified (boolean, where present), signature_alg ("ed25519"), verify_url, pubkey_url. For non-server-mediated verification with no network round-trip, use the @trustbench/verify-receipt npm package.

  Paramètres, retour & exemple (2)

  Paramètres

  • receipt_id · string · optionnel
    Lookup mode: the receipt ID to fetch and verify. Mutually exclusive with receipt_json.
  • receipt_json · object · optionnel
    Offline mode: a full signed-receipt envelope {receipt, signature} (or a Phase 3 SignedReceipt). Verified against the published Ed25519 public key without database lookup. Mutually exclusive with receipt_id.

  Exemple d'appel

  {"name": "verify_receipt", "arguments": {"receipt_id": "texte", "receipt_json": {}}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://trustbench.io/mcp