Ask before you trust.

One GET per verdict. No keys, no accounts. Responses are cache-friendly (s-maxage), rate-limited to 30 scans/min per IP, and every scan result is signed so you can verify it offline.

Building an agent? Start with the one-line agent rule. Machines that fetch this domain read /agents.md.

curl "https://<host>/api/v1/verify?target=https://mcp.context7.com/mcp"

passport is serialized with sorted keys (canonical JSON) and signed with ed25519. Verify like this — no toolproof code required:

import { verify, createPublicKey } from "node:crypto";

const res = await fetch(
  `https://<host>/api/v1/verify?target=${encodeURIComponent(target)}`
);
const { passport, signature, alg } = await res.json();

// canonical JSON: keys sorted recursively, then serialized
function canonicalize(value) {
  if (Array.isArray(value)) return value.map(canonicalize);
  if (value && typeof value === "object") {
    const out = {};
    for (const k of Object.keys(value).sort()) out[k] = canonicalize(value[k]);
    return out;
  }
  return value;
}
const canonical = JSON.stringify(canonicalize(passport));

const ok = verify(
  null,
  Buffer.from(canonical),
  createPublicKey(process.env.TOOLPROOF_PUBKEY),
  Buffer.from(signature, "base64")
);
// alg === "ed25519" && ok  →  the verdict is authentic and unmodified

The sort must be recursive — nested objects like findingCounts and scanner are part of the signed bytes. That's the entire ceremony.

-----BEGIN PUBLIC KEY-----
MCowBQYDK2VwAyEAxS90FXIcrGShrTf5yfJxVa+pX1hUf+tnwgNSjPiEbKg=
-----END PUBLIC KEY-----

keyId tpk-1 · algorithm ed25519. Rotate = new keyId.

Watch the text your model reads.

For verified MCP surfaces, every passport carries toolTextHash — a SHA-256 fingerprint of every tool description, prompt, resource and server instruction the model sees. Monitoring is diffing that hash over time; alerts are whatever notifies you (CI email, Slack webhook, a scheduled task).

# GitHub Actions — fails (and emails) when the tool's text changes
name: toolproof-watch
on:
  schedule: [{ cron: "0 */6 * * *" }]   # every 6 hours
jobs:
  watch:
    runs-on: ubuntu-latest
    steps:
      - name: Compare fingerprint
        run: |
          H=$(curl -s "${{ secrets.TOOLPROOF_URL }}/api/v1/verify?target=${{ secrets.TOOLPROOF_TARGET }}" | jq -r .passport.toolTextHash)
          if [ "$H" != "${{ secrets.TOOLPROOF_LAST_HASH }}" ]; then
            echo "::error::Tool text changed — fingerprint $H (was ${{ secrets.TOOLPROOF_LAST_HASH }})"
            exit 1
          fi

Browser-side: pin a tool from its trust card — the watchlist on the leaderboard re-checks your pins every visit.

Trap credentials that identify the thief.

GET /api/v1/canary?tool=your.host mints a unique, tool-bound canary — a decoy secret shaped like a cloud key. Plant it where the tool reads. If the string ever surfaces in an agent transcript, a log, or a paste site, it identifies the tool it was stolen from.

Declare it in your toolproof.txt with Canary: <token> — scanners then report “canary declared by owner” as a positive signal. Real-time beacon alerting (a phone-home tripwire) ships in v1.1.

• · Scans are point-in-time. A passport speaks for its scannedAt, not for the tool's next deploy.
• · Static analysis of tool text — not a sandbox. Behavioral canaries ship in v1.
• · Rate limit 30 scans/min/IP. Please cache; responses carry s-maxage.
• · v0 is best-effort: no SLA, no warranty. A passing grade is a receipt, not a guarantee.