Trust for AI agents

The problem

An autonomous agent negotiating or delegating has no way to answer “should I rely on this counterparty?”, so it either trusts everything or escalates everything to a human.

The other direction is worse: an agent acting for a real person has no way to prove that person’s standing without handing over an account.

And an agent cannot safely trust a claim that arrived over the same channel as the request. It needs something it can check independently.

The solution

• The Credda MCP server exposes trust as tools an agent calls mid-reasoning: check a counterparty’s token, fetch a full export, or verify a credential it was handed.
• Verification is cryptographic and offline: the agent checks a signature against published issuer keys, so a forged or revoked claim fails regardless of how it arrived.
• The agent can also mint and present its own principal’s credential, which makes the handshake symmetric rather than one-sided.
• One deliberate boundary: AI never decides a score. There is no “AI verdict” endpoint to call. The agent reads a deterministic number computed from a ledger, which is precisely why it is safe for an agent to act on.

How it works

The MCP server is a thin client over the public endpoints below: it adds no scoring logic and no new API surface.

The API calls involved

• GET/api/v1/verify/{token}What check_trust resolves. Public.
• GET/api/v1/verify/{token}/exportWhat get_trust_export and present_my_credential return.
• POST/api/v1/users/{id}/share-tokenWhat mint_my_trust_token calls. Needs a platform key.
• GET/api/v1/status/revocationChecked during offline verification of a presented credential.
• GET/.well-known/credda-trust-registry.jsonRecognized issuers, exposed to agents as an MCP resource.

{ "mcpServers": { "credda": { "command": "node",
    "args": ["packages/mcp/dist/index.js"] } } }

# tools: check_trust · get_trust_export · verify_trust_credential
#        verify_verifiable_credential · mint_my_trust_token · present_my_credential
# resources: credda-trust://registry · credda-trust://did

Full request and response shapes are in the API reference.

Start building