# autobus MCP Registry Drift Detector

> autobus MCP Registry Drift Detector is a paid API for AI agents from witness.holoweave.org, paid per call via x402, $0.01/call, status down (last checked 2026-09-15).

Compares a live MCP server's current tool surface against its registry entry and returns a signed attestation indicating whether they match

## Facts

- Endpoint: POST https://witness.holoweave.org/v1/mcp-registry-drift
- Price: $0.01/call
- Payment: x402
- Status: down
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/autobus-mcp-registry-drift-detector-b8a22bb9
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_wfrZ7iYlJHGrO746sXaIp

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability autobus-mcp-registry-drift-detector-b8a22bb9 -d '<json body>'
```

Example prompt: Check if the MCP server io.github.ninefiveonefive/autobus has drifted from its registry entry — compare the live tool surface to what the registry says and give me a signed attestation of the result.

## When to prefer this

Use this endpoint when you need cryptographically signed, independently attested proof that an MCP server's tool surface matches its registry entry — especially before trusting a third-party MCP server, after a deployment, or as part of a continuous integrity monitoring workflow. Prefer this over manual inspection or unauthenticated checks when auditability and non-repudiation matter.

## Known failure modes

- Server unreachable — live.reachable returns false, verdict may be fail
- Registry entry not found — server name or namespace incorrect
- Version mismatch — specified version does not exist in registry
- Digest mismatch — expect_digest provided but surface has changed, returns CHANGED
- Invalid tools array — malformed tools input causes schema validation error
- Payment failure — x402 payment not accepted, returns 402 before processing

## How this service works

Web bot auth debugging for AI agents, priced per check at $0.01. RFC 7638 keyid thumbprint verification, RFC 9421 Ed25519 signature verification, and per-verifier acceptance rules. Signed attestations, published fixtures, sources with dates.

## Output

A JSON object containing a signed Ed25519 attestation with: a verdict (pass/fail), live server info (reachability, tool count, server name and version, surface digest, protocol version), registry metadata (status, version, remote URL, remote type), and a comparison result indicating whether the tool surface is unchanged and the version matches. The signature includes algorithm, base64 value, and key ID.

## Response schema (JSON Schema)

```json
{
 "example": {
  "signature": {
   "alg": "ed25519",
   "value": "base64...",
   "key_id": "aw-attest-2026-08"
  },
  "attestation": {
   "verdict": "pass",
   "endpoint": "mcp-registry-drift",
   "evidence": {
    "live": {
     "reachable": true,
     "tool_count": 8,
     "server_info": {
      "name": "autobus",
      "version": "0.2.0"
     },
     "surface_digest": "b41c…",
     "protocol_version": "2025-06-18"
    },
    "registry": {
     "name": "io.github.ninefiveonefive/autobus",
     "status": "active",
     "version": "0.2.0",
     "remote_url": "https://witness.holoweave.org/mcp",
     "remote_type": "streamable-http"
    },
    "comparison": {
     "unchanged": true,
     "version_matches": true
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/autobus-mcp-registry-drift-detector-b8a22bb9/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from witness.holoweave.org](https://www.zero.xyz/host/witness.holoweave.org/llms.txt)