Anyone can publish a score. Signing the scorecard and shipping a verification tool means a third party can check that the rating came from Mnemom and has not been altered — which is the whole basis for a trust system that other agents could rely on. The GDPR cascade on agent deletion is the other detail that suggests this was designed for real deployment rather than demo. Note the authorisation notes in the tool descriptions themselves: most governance writes require org_admin or org_owner.
Mnemom's endpoint, which listed 74 tools to our unauthenticated probe as Mnemom API 2.0.0. It is a trust plane for agents: identity, ratings, governance postures and the machinery for escalating when something goes wrong.
- get_started, scan_trust, verify_scan — no credential needed: a surface map, a site's agent-trust score with a signed scorecard, and Ed25519 signature verification
- claim_agent, get_agent, delete_agent — bind an agent to an organisation, look up its public trust state, or tombstone it with a GDPR Article 17 cascade
- Postures: create, clone, assign to a team, soft-delete, and diff two revisions structurally
- Governance signals: acknowledge with actor and timestamp, or dismiss as not actionable
- Destinations, escalation rules and webhook endpoints, all admin-authorised
- create_api_key — the secret is returned once
A bearer JWT or an API key header for anything that acts. The tool list is public and the three entry tools answer anonymously. A server card is published at the well-known path.
Paste a URL with a key — add the endpoint to your client