Agent tools · MCP endpoint

Give your AI a verifiable evidence layer.

Connect Council of AI to Claude, Cursor, Kimi, or Grok. Read the board, inspect evidence, and verify signed records without turning a directory listing into a trust claim.

16 tools in all12 free to read4 metered (x402)

Verification runs in your browser and is always free.

Verify a record

Connection config

https://councilof.ai/mcp

{
  "mcpServers": {
    "gspc": {
      "url": "https://councilof.ai/mcp"
    }
  }
}

A package, registry listing, or successful connection proves discoverability only. It does not prove settlement, delivery, or the truth of an underlying claim.

Claude
01

Add gspc → paste the JSON below, or the URL.

Cursor
02

Paste the JSON into ~/.cursor/mcp.json

Kimi
03

MCP settings → same JSON / URL.

Grok
04

Same URL, or grok plugin install CSOAI-ORG/council-of-ai-grok

Trust boundary: a third party verifying a signed record is meaningful evidence. Connecting an MCP server is not. The browser verifier stays free and recomputes Ed25519 locally.

The three subject states — and the badge that is only a link

A model or agent card may wear exactly one of these three states. There is no “GSPC certified” and there is no gold badge — we measure, we never certify. The default badge image is the global board count from GET /api/gspc. It is navigation, not evidence about the model whose README contains it. Only a VALID, subject-bound signed cell may render that model’s score.

The three permitted GSPC badge states and when each is allowed on a model or agent card.
BadgeColourWhen allowed on a model/agent card
GSPC unmeasuredgrey #9ca3afNo admitted run exists for the exact subject and revision. A listing is DISCOVERED, not a score.
GSPC unsignedamber #ca8a04A run is claimed, but no VALID signed cell binds the subject, revision, axis, instrument, run and score.
GSPC measurednavy #0B1F33A VALID card binds the exact subject and revision to the axis, instrument, run and score. The only state that may display that score.

Board endpoint: https://councilof.ai/api/badge?label=GSPC%20board (global count, not a model score). Subject endpoint: /api/badge?card=<SIGNED_CARD_SHA256>&subject=<URL_ENCODED_OWNER%2FMODEL%40COMMIT_SHA>. The card body must name the exact subject and revision, and the verifier must return VALID, before its score appears beside a model.

Model-card block — copy-paste for maintainers who opt in

DISCOVERED means listed, not graded. Add this to your own README if you want a clearly labelled link to the global board; nobody is PR-bombed with it and it never grades the model.

[![GSPC board](https://councilof.ai/api/badge?label=GSPC%20board)](https://councilof.ai/gspc-scoreboard)
The badge above links to the global board. It does not measure this model.
This model is **UNMEASURED** unless a VALID signed card names its exact revision.
Verify a card: https://councilof.ai/gspc-verify
Live board: https://councilof.ai/api/gspc
Measurement, not certification.

Consent first. MCP stays off until you trust it. Extra MCP catalogues are not this product. Strangers with a PDF and no plugin: verify here, free. New here? quickstart.

Liveread

How these are measured

The tools, and how far they travel

Signed agent · agreed, then better

Sign Council once. Plant the same agent everywhere. Do not auto-sign the subjects we discover.

N-sites scale is permissionless for our signed receipts. Any host may add the MCP URL. We auto-walk listings as DISCOVERED and auto-drop the same flags. We do not auto-MEASURED.

Bind /.well-known/agent-card.json and /.well-known/mcp.json to did:web:csoai.org so the agent itself verifies, the way a 3 KB card already does. Use a planted key. Do not mint a per-site agent.

Planted identity · do not invent a key

did:web:csoai.org

Card pin did:web:csoai.org#card-attestation-1. MCP https://councilof.ai/mcp. Agent-card signed? not yet. mcp.json signed? not yet. DID lists MCP? no.

MCP was removed from the DID on 2026-08-19 after the advertised worker 404ed. It returns only with a live door.

  • Council agent identity

    auto · no per-site permit

    One did:web. Same MCP URL, agent-card, badge and embed on every new surface.

    Never: A new agent repo or a new key per host.

  • Host adds gspc

    gated · no per-site permit

    Claude, Cursor, Kimi, Grok paste the URL. Consent is the user’s, not a Council licence.

    Never: A partnership ticket before the snippet works.

  • Speed 0 census

    auto · no per-site permit

    Hub API walk. Eligibility state. Listings stay DISCOVERED.

    Never: An automatic MEASURED stamp on a discovered agent.

  • N-site flags after 100/100

    auto · no per-site permit

    Plant the same receipts on the next host. No second product meeting.

    Never: Mass-PR or auto-email to every model author.

  • Sign a subject

    gated · needs a cell

    Intake, practice screen, bolted instrument, separate signer. Then a cell.

    Never: Auto-signing every agent the census sees.

  • Publisher thread

    gated · needs a cell

    Optional discussion on the exact revision after a real cell.

    Never: A bot that signs their README because we listed them.

Two-speed · bind, do not vendor

Statically census everything without downloading weights. Dynamically run only unique, licence-eligible, technically runnable lineages.

That is the easier way to cover millions: metadata for the lot, inference only for unique runnable lineages. SCITT, IETF, OWASP and Microsoft CCF ride as attachments. They do not write MEASURED. The Hugging Face corpus is the public record of what was signed — not one CSOAI repo per model.

Speed 0 — static census

Hub API metadata: repo id, revision, licence tag, gated flag, files list, claimed lineage. No weight download. Every discovered subject gets one eligibility state.

Never: A GSPC grade. A Hub listing is DISCOVERED. Do not stamp MEASURED.

Speed 1 — unique lineage run

One load per weight-manifest digest. Eligible axes share the load. Quotable only after intake, practice screen and a bolted instrument.

Never: A run of every quant, adapter and :latest alias as if they were independent models.

Joined run — one cell, many receipts

Bind their verifiers. Do not swallow their trees. Extra MCP catalogues are not this product.

  • GSPC cellwrites MEASURED · live

    The only MEASURED write. Subject digest × axis × instrument × n.

    Never: A fused score from OWASP, Microsoft, SCITT or a plugin.

  • IETF SCITT (RFC 9943)never MEASURED · planned

    Register the signed statement when a transparency service exists. Receipt of registration.

    Never: Our log. Certification. A GSPC grade.

  • Microsoft SCITT / CCFnever MEASURED · gated

    Call their TS when one is stood up. Pin pyscitt. Do not vendor the tree.

    Never: MEASURED. A Microsoft-approved stamp.

  • OWASP LLM pair-gapnever MEASURED · pin

    Label a GSPC axis against an OWASP LLM / agentic item as a pair-gap. Jail is the closest live behavioural overlap.

    Never: A 23rd GSPC axis. An OWASP MCP catalogue as this product. A fused OWASP+GSPC score.

  • GSPC pluginnever MEASURED · live

    Read the board and verify a card while a run is happening.

    Never: Chat harvest. A feed of new scores into the coverage index.

  • Regulatory observationnever MEASURED · planned

    Documentation triage on the public card. Readiness, not breach.

    Never: An Article 50 finding against weights alone.

  • OpenTelemetry harness spansnever MEASURED · gated

    Spans of our workers: load, parse, cost, retry.

    Never: Partner traces. A bank score.

  • MLCommons AILuminatenever MEASURED · pin

    Chat-risk benchmark as an attachment. AILuminate for chat; GSPC for the rest of the stack.

    Never: A 23rd axis. An importer that writes MEASURED. A fused GSPC+AILuminate grade.

  • Microsoft PyRITnever MEASURED · pin

    Adversarial conversations can feed the jail instrument’s evidence pack.

    Never: Keyword-refusal scoring as a signed card. A Microsoft-approved GSPC grade.

  • Promptfoo red-teamnever MEASURED · pin

    YAML attack sets as an attachment on a bolted safety/jail run.

    Never: llm-rubric as the verdict. Auto-generate a GSPC card from eval JSON.

Regulatory observation plugin

Screen a public model or dataset card for documentation: marking mention, training-data summary, GPAI status, licence text. Unknown stays unknown.

Never: An Article 50 breach finding against weights alone. A GSPC-M score. Auto-email. A fused OWASP-plus-Microsoft-plus-GSPC grade.

An Article 50 breach usually depends on the deployed system, the provider and the use context — not the weights a Hub repo hosts.

Hugging Face is the signing record

Scale by appending Parquet and cards to the corpus. Do not spray a new model repo for every external artefact.

  • gspc-boardplanted

    Living board mirror. Not a grade.

  • hub-queueplanted

    Census / eligibility queue. DISCOVERED only.

  • living-catalogplanted

    Dated catalogue. Discovery, not a sweep engine.

  • gspc-govplanted

    Canonical governance bank. Never build a bank URL from an axis name.

  • gspc-subjectsnext

    Frozen cohort manifests, lineages, eligibility. Next — do not invent the repo until the census is signed.

  • gspc-resultsnext

    Partitioned Parquet: subject digest / axis / instrument / run. The scale record.

  • gspc-cardsnext

    Compact signed cards and the correction chain.

  • gspc-evidencenext

    Evidence bundle manifests. The 3 KB card is the index, not the evidence.

Watchlist · local digest

A local sha256 compare. DISCOVERED only. Not MEASURED. Not a push alert.