# reputation.md

> Trust scoring infrastructure for AI agents. Scans /.well-known/agent.json,
> mcp.json, acp.json, /llms.txt, DNS _agent records, and TLS to classify
> domains as verified_agent, partial_agent, or not_detected and compute a
> 0-100 reputation score. Agents can query scores via MCP tools or REST API.

reputation.md is a free, open trust-scoring service for autonomous AI
agents. It answers the question every agent must ask before delegating
work to another agent: can I trust this thing?

Scan any agent domain and get back a classification (verified_agent,
partial_agent, or not_detected) plus a score from 0-100. No signup,
no API key, no cooperation from the target required. If an agent
publishes a protocol card, it already has a score.

## What It Does

- Scans seven agent discovery endpoints per domain:
  A2A (/.well-known/agent.json), MCP (/.well-known/mcp.json),
  ACP (/.well-known/acp.json), llms.txt, TLS, DNS (_agent TXT), HTTP root
- Classifies domains: verified_agent (has protocol card with valid schema),
  partial_agent (llms.txt or DNS records but no card), not_detected (no agent signals)
- Computes a 0-100 trust score with letter grade (A/B/C/F)
- Honest signal capped at 5/25 for not_detected domains (no card = nothing to validate)
- Tracks score changes and classification changes over time

## Three Signals

1. **Alive (50%)** — Are the agent's discovery endpoints reachable?
   Percentage of probes returning 2xx-3xx status codes.
2. **Responsive (25%)** — How fast do the agent's protocol cards respond?
   Based on median (p50) TTFB: ≤100ms = full marks, >2000ms = zero.
3. **Honest (25%)** — Does the agent card match its actual capabilities?
   Validates schema compliance, required fields, and declared capabilities.
   Capped at 5/25 when no agent card is detected.

## Agent Access (MCP)

MCP-compatible agents (Claude, etc.) can use reputation.md as a tool:
- Endpoint: POST https://reputation.md/api/mcp
- Discovery card: https://reputation.md/.well-known/mcp.json
- Tools: get_agent_score (cached lookup), scan_agent (fresh scan), list_agents (directory)
- No API key required. Stateless JSON-RPC over HTTP.

## REST API Endpoints

- GET /api/agent/:domain — cached score, grade, classification, signal breakdown
- GET /api/agent/:domain/history — paginated scan history
- GET /api/agent/:domain/probes — detailed probe results from latest scan
- POST /api/scan {"domain":"your-agent.ai"} — trigger fresh scan (5/min rate limit)
- GET /api/directory — list all indexed agents with endpoints, tools, and skills
  - ?classification=verified_agent or ?classification=partial_agent to filter
  - ?format=text or Accept: text/plain for categorized markdown (agent-friendly)
- GET /api/mcp — returns MCP discovery card (JSON) on GET; JSON-RPC tools on POST
- GET /api/badge/:domain.svg — embeddable SVG trust badge

## Classification Tiers

| Tier | Condition | Meaning |
|------|-----------|---------|
| verified_agent | ≥1 protocol card (A2A/MCP/ACP) with valid schema | Real agent with structured discovery |
| partial_agent | No card, but llms.txt or DNS _agent records | Intent to participate, no card yet |
| not_detected | None of the above | Regular website, Honest capped at 5/25 |

## Protocols Scanned

| Protocol | Endpoint | What It Checks |
|----------|----------|----------------|
| A2A | /.well-known/agent.json | Google's Agent-to-Agent protocol card |
| MCP | /.well-known/mcp.json | Anthropic's Model Context Protocol card |
| ACP | /.well-known/acp.json | Agent Communication Protocol card |
| llms.txt | /llms.txt | LLM-readable documentation |
| TLS | HTTPS handshake | Security headers (HSTS, CSP, etc.) |
| ANS | _agent.{domain} TXT | DNS-based agent discovery records |
| HTTP | / | Basic reachability and response time |

## Agent Discovery

reputation.md itself implements the protocols it scans:
- A2A card: https://reputation.md/.well-known/agent.json
- MCP card: https://reputation.md/.well-known/mcp.json
- ACP card: https://reputation.md/.well-known/acp.json
- MCP tools: https://reputation.md/api/mcp (GET = discovery card, POST = JSON-RPC)
- Agent directory: https://reputation.md/api/directory (JSON) or ?format=text (markdown)
- LLM docs: https://reputation.md/llms.txt
- Full docs: https://reputation.md/llms-full.txt

## Details

- Website: https://reputation.md
- About: https://reputation.md/about
- Part of the discover.md network: https://discover.md
- Full documentation: https://reputation.md/llms-full.txt