# autobus MCP Server Attestation

> autobus MCP Server Attestation is a paid API for AI agents from witness.holoweave.org, paid per call via x402, $0.03/call, status down (last checked 2026-09-15).

Attests the live tool surface of an MCP server against its registry definition, returning a signed Ed25519 verdict on whether the server matches its published version

## Facts

- Endpoint: POST https://witness.holoweave.org/v1/mcp-server-attest
- Price: $0.03/call
- Payment: x402
- Status: down
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/autobus-mcp-server-attestation-f9b44d86
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_miEEx5AhHd-7LwB8SX5E0

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability autobus-mcp-server-attestation-f9b44d86 -d '<json body>'
```

Example prompt: Can you attest the live tool surface of the MCP server io.github.ninefiveonefive/autobus at version 0.2.0 and give me a signed verdict on whether it matches its registry definition?

## When to prefer this

Choose this endpoint when you need a cryptographically signed, third-party attestation that an MCP server's live tool surface matches its published registry definition — particularly before trusting an MCP server in an automated pipeline, after a deployment, or for compliance logging. Prefer it over simple reachability pings when you need tamper-evident proof (Ed25519 signature) and a structured diff of tool changes.

## Known failure modes

- Registry server name not found — returns error if namespace/name does not exist in registry
- Server unreachable — live reachability check fails, verdict reflects this in evidence
- Version mismatch — requested version differs from active registry version
- Tool surface drift detected — diff shows added/changed/removed tools, verdict may fail
- Invalid baseline digest format — malformed surface_digest in baseline block causes validation error
- Payment not received — x402 payment of $0.03 USDC required; unpaid requests are rejected

## How this service works

Web bot auth debugging for AI agents, priced per check at $0.01. RFC 7638 keyid thumbprint verification, RFC 9421 Ed25519 signature verification, and per-verifier acceptance rules. Signed attestations, published fixtures, sources with dates.

## Output

A signed attestation object containing: an Ed25519 signature (algorithm, base64 value, key_id), and an attestation block with a verdict (pass/fail), the endpoint name, and evidence covering live server reachability and tool count, a surface digest, a registry status and version, a diff report showing added/changed/removed/unchanged tools, and a card presence indicator.

## Response schema (JSON Schema)

```json
{
 "example": {
  "signature": {
   "alg": "ed25519",
   "value": "base64...",
   "key_id": "aw-attest-2026-08"
  },
  "attestation": {
   "verdict": "pass",
   "endpoint": "mcp-server-attest",
   "evidence": {
    "card": {
     "present": false
    },
    "diff": {
     "added": [],
     "changed": [],
     "removed": [],
     "unchanged": true
    },
    "live": {
     "reachable": true,
     "tool_count": 9,
     "surface_digest": "ba77…"
    },
    "registry": {
     "name": "io.github.ninefiveonefive/autobus",
     "status": "active",
     "version": "0.2.0"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/autobus-mcp-server-attestation-f9b44d86/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from witness.holoweave.org](https://www.zero.xyz/host/witness.holoweave.org/llms.txt)