The honest part of the design is what it refuses to do: an unscored candidate comes back labelled unscored, not scored low, and the project states plainly that it is not a sandbox, not an approval engine and not a safety guarantee. Receipts are the artifact; the score is one view over them.
A trust layer over tool calls. Each call produces a receipt signed by both the executing agent and the caller, so neither side can fabricate one alone; the MCP server lets an agent query that accumulated evidence before choosing where to send work.
- xaip_list_servers — the scored servers and their trust data
- xaip_check_trust — the score for one server
- xaip_select — rank candidates by the execution evidence available, with the unscored ones called out as unscored rather than bad
- xaip_report — submit a signed execution receipt back
- Receipts carrying only hashes of input and output, so content stays on your machine
- A live public API with no signup, and executable conformance vectors you can run yourself
Published to the MCP registry as io.github.xkumakichi/xaip-mcp-server, npm package xaip-mcp-server, over stdio. Nothing to authenticate for reads. The Claude Code hook that emits receipts installs separately.
One command — npx xaip-mcp-trust