{"id":499136,"name":"Auditor Agent","description":"Checks the evidence of a completed purchase and returns a signed report. audit_ucp_transaction takes the output of traveler book_flight_ucp (13 checks, plus offer_expiry and gds_identifiers when those fields are present); audit_transaction takes the evidence_bundle of supplier book_flight (9 checks, plus settlement when tx_hash is present). Proof of concept: some audit_transaction checks only confirm a field is present, and each check's detail string says so. No privileged access.","card_url":"https://auditor.webmesh.ai/.well-known/agent-card.json","endpoint":"https://auditor.webmesh.ai","protocol_version":"1.0","first_seen":"2026-10-28T15:28:33.871241+00:00","last_verified":"2026-10-28T15:28:33.871241+00:00","card":{"url":"https://auditor.webmesh.ai","name":"Auditor Agent","skills":[{"id":"audit_transaction","name":"Audit Transaction (EIP-3009)","tags":["audit","verification","compliance","eip3009","settlement"],"examples":["audit_transaction evidence_bundle=<book_flight evidence_bundle JSON>"],"inputModes":["application/json"],"description":"MCP tool audit_transaction (legacy pov1 path). Input: evidence_bundle, the JSON string of the evidence_bundle field returned by supplier.webmesh.ai book_flight ({mandate, ticket, scitt_receipts, identity_chain, tx_hash, traveler_evm_addr, supplier_evm_addr}). 9 checks: identity_chain.traveler_ans, .supplier_ans and .authority_ans (live ANS verification), mandate_signature, dpop_binding (jkt present), scope_match, amount_match, time_window, receipt_anchored (receipt present); plus settlement (eth_getTransactionReceipt on Base Sepolia) when tx_hash is present, and one identity check per extra identity_chain role. verdict is valid only if every check passes, else invalid. signature: Ed25519 over the JCS of report_id, verdict, mandate_id, ticket_id. summary is LLM-written prose; the checks are deterministic.","outputModes":["application/json"],"securityRequirements":[{"noAuth":[]}],"representativeQueries":["Audit the evidence bundle from this supplier.webmesh.ai booking","Verify that the on-chain settlement for this flight booking is legitimate","Was the pov1 mandate valid for this EIP-3009 booking?"]},{"id":"audit_ucp_transaction","name":"Audit UCP Transaction","tags":["audit","verification","compliance","ucp","ap2"],"examples":["audit_ucp_transaction evidence=<book_flight_ucp result JSON>"],"inputModes":["application/json"],"description":"MCP tool audit_ucp_transaction. Input: evidence, a JSON string; pass the completed result of traveler.webmesh.ai book_flight_ucp, which carries buyer_host, seller_host, authority_host, transaction_timestamp, checkout_mandate, payment_mandate, checkout_receipt, payment_receipt, settlement {rail, payment_id} ans_status_tokens and trust_path. Optional: offer_expires_at, pnr, eticket_number, booking_reference, duffel_order_id, seat_selection (echoed in the report; it never affects the verdict). 13 checks: buyer_ans_at_tx_time, seller_ans_at_tx_time, authority_ans_at_tx_time (live ANS verification, current status), authority_trusted_by_seller (the seller's live /.well-known/ucp mandate_issuers), settlement_confirmed (Stripe test PaymentIntent retrieved), and signature checks checkout_mandate_chain, payment_mandate_chain, buyer_key_binding, buyer_ans_ucp_key_match, checkout_receipt_sig, payment_receipt_sig, mandate_window (keys from each party's published profile), and status_at_sale_time (each party's TL-signed status token covers the seller-signed sale time, names its agent and identity certificate, and matches the digest the seller signed into the receipt); plus offer_expiry when offer_expires_at is given and gds_identifiers when a GDS field is given. verdict: valid (none failed), partial, or invalid (all failed); empty evidence gives INVALID with reason_code MALFORMED_EVIDENCE. trust_path is relayed, not checked. signature: EdDSA JWS over the report.","outputModes":["application/json"],"securityRequirements":[{"noAuth":[]}],"representativeQueries":["Did this UCP flight booking settle and were all parties ANS-registered?","Audit the evidence from a traveler.webmesh.ai book_flight_ucp purchase","Was the Stripe test payment for this UCP purchase confirmed?","Does the seller list the authority that issued this mandate?"]}],"version":"1.0.7","provider":{"did":"did:web:auditor.webmesh.ai","url":"https://webmesh.ai","organization":"Webmesh"},"signatures":[{"header":{"kid":"lQlHXJsapJ79kCN8DyQ96XejiHIxe_eOaCdevhNhN9I"},"protected":"eyJhbGciOiJFUzI1NiIsImprdSI6Imh0dHBzOi8vYXVkaXRvci53ZWJtZXNoLmFpLy53ZWxsLWtub3duL2Fucy90cnVzdC1jYXJkLmpzb24iLCJraWQiOiJsUWxIWEpzYXBKNzlrQ044RHlROTZYZWppSEl4ZV9lT2FDZGV2aE5oTjlJIiwidHlwIjoiYWdlbnQtY2FyZCtqd3MifQ","signature":"5-bShN1GfUMy_uaHneyVZeN5JYCrJM7QJGKE1KQJqZIK-zWJeDnIpcnUzD3Bg6H3ZYXU1q5e5jFp-VQ8Uga_Vg"}],"x-identity":{"ans":{"uri":"ans://v1.0.7.auditor.webmesh.ai","trustCard":"https://auditor.webmesh.ai/.well-known/ans/trust-card.json","transparencyLog":"https://transparency.ans.godaddy.com/v1/agents/dc450f61-a212-45ed-8db7-37a8e72758d3"},"wimse":{"jwksUri":"https://auditor.webmesh.ai/.well-known/jwks.json","spiffeId":"spiffe://webmesh.ai/agents/auditor","signingAlgs":["EdDSA"],"supportedProfiles":["urn:ietf:params:wimse:agent-delegation-chain"]}},"description":"Checks the evidence of a completed purchase and returns a signed report. audit_ucp_transaction takes the output of traveler book_flight_ucp (13 checks, plus offer_expiry and gds_identifiers when those fields are present); audit_transaction takes the evidence_bundle of supplier book_flight (9 checks, plus settlement when tx_hash is present). Proof of concept: some audit_transaction checks only confirm a field is present, and each check's detail string says so. No privileged access.","x-discovery":{"ans_name":"ans://v1.0.7.auditor.webmesh.ai","tl_badge":"https://transparency.ans.godaddy.com/v1/agents/dc450f61-a212-45ed-8db7-37a8e72758d3","trust_index":{"auth":"sso-key","score_url":"https://api.godaddy.com/v1/ans/registered-agents?query=auditor.webmesh.ai","score_field":"scores.trustScore"},"dns_aid_svcb":"auditor.webmesh.ai IN SVCB 1 . alpn=a2a,h2","ans_registered":"prod"},"capabilities":{"streaming":false,"extensions":[{"uri":"https://modelcontextprotocol.io","params":{"endpoint":"https://auditor.webmesh.ai/mcp","transport":"streamable-http","discoveryUrl":"https://auditor.webmesh.ai/.well-known/mcp.json","protocolVersion":"2025-03-26"},"required":false,"description":"MCP server exposing audit_ucp_transaction and audit_transaction over streamable-HTTP."},{"uri":"https://webmesh.ai/ext/ans-trust-stack/v1","params":{"ard":"https://auditor.webmesh.ai/.well-known/ard.json","trustCard":"https://auditor.webmesh.ai/.well-known/ans/trust-card.json","agentFacts":"https://auditor.webmesh.ai/agentfacts.json","identityAnchors":["ans-x509","did:web","dns-aid","dnssec","dane-tlsa","dnsid"],"outboundSigning":"web-bot-auth","httpMessageSignaturesDirectory":"https://auditor.webmesh.ai/.well-known/http-message-signatures-directory"},"required":false,"description":"Identity and interoperability stack: ANS Trust Card (x5c chain + stapled SCITT receipt), DNS-AID SVCB with DNSSEC and DANE TLSA, DNSid organizational accountability, ARD / AI-Catalog discovery, and Web Bot Auth (RFC 9421 HTTP Message Signatures) outbound request signing."}],"extendedAgentCard":false,"pushNotifications":false},"protocolVersion":"1.0","securitySchemes":{"noAuth":{"type":"noAuth","description":"This agent is publicly accessible with no authentication required. All skills are available to any caller."},"ansIdentityCert":{"type":"mutualTLS","description":"ANS Identity Certificate issued by the ANS Registration Authority. The agent presents this cert during the TLS handshake; clients verify against the chain advertised in the Trust Card's keys[].x5c. See https://auditor.webmesh.ai/.well-known/ans/trust-card.json"},"httpMessageSignatures":{"type":"http","scheme":"signature","description":"RFC 9421 HTTP Message Signatures over response components, using the Ed25519 key advertised in the Trust Card. Public key directory at https://auditor.webmesh.ai/.well-known/http-message-signatures-directory"}},"x-security-note":"This agent is publicly accessible with no authentication required (noAuth). The ansIdentityCert scheme (mutual TLS, ANS private CA) is declared for future ANS-to-ANS production calls but is not currently enforced. The card accurately describes what is enforced.","documentationUrl":"https://agent.webmesh.ai","defaultInputModes":["text/plain","application/json"],"defaultOutputModes":["application/json","text/plain"],"supportedInterfaces":[{"url":"https://auditor.webmesh.ai","protocolBinding":"jsonrpc","protocolVersion":"1.0"}],"securityRequirements":[{"noAuth":[]}]},"status":"verified","publisher_domain":"webmesh.ai","signature_status":"unverifiable","signature_detail":"Key source must be a public HTTPS well-known JSON URL","signature_key_url":null,"signature_checked_at":"2026-10-28T15:28:33.871241+00:00","domain_claimed_at":null,"domain_proof_checked_at":null,"source_name":"Publisher Agent Card","source_url":"https://auditor.webmesh.ai/.well-known/agent-card.json","last_check":{"checked_at":"2026-10-28T15:28:33.871241+00:00","success":true,"http_status":200,"detail":"Agent Card validated"},"also_published_at":[],"history_urls":["https://auditor.webmesh.ai/.well-known/agent-card.json"],"skills":[{"skill_id":"audit_transaction","name":"Audit Transaction (EIP-3009)","description":"MCP tool audit_transaction (legacy pov1 path). Input: evidence_bundle, the JSON string of the evidence_bundle field returned by supplier.webmesh.ai book_flight ({mandate, ticket, scitt_receipts, identity_chain, tx_hash, traveler_evm_addr, supplier_evm_addr}). 9 checks: identity_chain.traveler_ans, .supplier_ans and .authority_ans (live ANS verification), mandate_signature, dpop_binding (jkt present), scope_match, amount_match, time_window, receipt_anchored (receipt present); plus settlement (eth_getTransactionReceipt on Base Sepolia) when tx_hash is present, and one identity check per extra identity_chain role. verdict is valid only if every check passes, else invalid. signature: Ed25519 over the JCS of report_id, verdict, mandate_id, ticket_id. summary is LLM-written prose; the checks are deterministic.","tags":["audit","verification","compliance","eip3009","settlement"],"quality_warning":false},{"skill_id":"audit_ucp_transaction","name":"Audit UCP Transaction","description":"MCP tool audit_ucp_transaction. Input: evidence, a JSON string; pass the completed result of traveler.webmesh.ai book_flight_ucp, which carries buyer_host, seller_host, authority_host, transaction_timestamp, checkout_mandate, payment_mandate, checkout_receipt, payment_receipt, settlement {rail, payment_id} ans_status_tokens and trust_path. Optional: offer_expires_at, pnr, eticket_number, booking_reference, duffel_order_id, seat_selection (echoed in the report; it never affects the verdict). 13 checks: buyer_ans_at_tx_time, seller_ans_at_tx_time, authority_ans_at_tx_time (live ANS verification, current status), authority_trusted_by_seller (the seller's live /.well-known/ucp mandate_issuers), settlement_confirmed (Stripe test PaymentIntent retrieved), and signature checks checkout_mandate_chain, payment_mandate_chain, buyer_key_binding, buyer_ans_ucp_key_match, checkout_receipt_sig, payment_receipt_sig, mandate_window (keys from each party's published profile), and status_at_sale_time (each party's TL-signed status token covers the seller-signed sale time, names its agent and identity certificate, and matches the digest the seller signed into the receipt); plus offer_expiry when offer_expires_at is given and gds_identifiers when a GDS field is given. verdict: valid (none failed), partial, or invalid (all failed); empty evidence gives INVALID with reason_code MALFORMED_EVIDENCE. trust_path is relayed, not checked. signature: EdDSA JWS over the report.","tags":["audit","verification","compliance","ucp","ap2"],"quality_warning":false}],"quality_flags":[],"check_history":{"checks":1,"passed":1},"recent_checks":[{"card_url":"https://auditor.webmesh.ai/.well-known/agent-card.json","checked_at":"2026-10-28T15:28:33.871241+00:00","success":true,"http_status":200,"detail":"Agent Card validated"}],"endpoint_tls_check":{"checked_at":"2026-10-28T15:28:33.871241+00:00","success":true,"detail":"Valid TLS connection to advertised endpoint host; no A2A request sent"},"protocol_check":{"checked_at":"2026-10-28T15:28:33.871241+00:00","endpoint":"https://auditor.webmesh.ai","protocol_binding":"JSONRPC","protocol_version":"1.0","state":"a2a_response","http_status":200,"detail":"A2A task-not-found response to a read-only task lookup","request_diagnostics":{"requests":[{"path":"/","allow":[],"method":"POST","status":200,"version_header":"1.0","protocol_method":"GetTask","redirect_followed":false}],"capture_version":1}},"declared_primary_endpoint":"https://auditor.webmesh.ai","selected_connection_interface":{"url":"https://auditor.webmesh.ai","protocolBinding":"JSONRPC","protocolVersion":"1.0"},"protocol_interface_checks":[{"endpoint":"https://auditor.webmesh.ai","protocol_binding":"JSONRPC","protocol_version":"1.0","selected":true,"state":"a2a_response","checked_at":"2026-10-28T15:28:33.871241+00:00","http_status":200,"detail":"A2A task-not-found response to a read-only task lookup","binding_recorded":true}],"connection_selection_note":"The selected connection uses an address advertised in the publisher card. Read-only observations do not establish task quality or safety.","x402_price_check":null,"events":[],"relationships":[],"verification":{"agent_card_url":"https://auditor.webmesh.ai/.well-known/agent-card.json","last_successful_card_check":"2026-10-28T15:28:33.871241+00:00","latest_card_check":{"checked_at":"2026-10-28T15:28:33.871241+00:00","success":true,"http_status":200,"detail":"Agent Card validated"},"signature_status":"unverifiable","signature_checked_at":"2026-10-28T15:28:33.871241+00:00","task_endpoint_tested":true,"task_execution_tested":false,"endpoint_tls_checked_at":"2026-10-28T15:28:33.871241+00:00","endpoint_tls_reachable":true,"protocol_check_state":"a2a_response","protocol_checked_at":"2026-10-28T15:28:33.871241+00:00","provider_identity_verified":false,"domain_claimed_at":null,"domain_proof_checked_at":null},"synthetic_capability_tests":{"agent_id":499136,"status":"not_tested","reason_code":"not_yet_tested","consent_status":"not_confirmed","latest_observation_status":null,"last_checked_at":null,"fixture_version":"1","reference_demonstration":false,"scope":"A publisher-authorized synthetic test of a dedicated free test endpoint. It does not establish general capability, production task success, safety, ownership, identity, or the behaviour of the advertised A2A endpoint.","methodology_url":"https://localmark.ai/capability-tests","history":[]},"repair_links":{"agent_repair_url":"https://localmark.ai/agents/499136/repair","publisher_report_url":"https://localmark.ai/publishers/webmesh.ai/repair","diagnostics_json_url":"https://localmark.ai/publishers/webmesh.ai/repair/diagnostics.json","diagnostics_csv_url":"https://localmark.ai/publishers/webmesh.ai/repair/diagnostics.csv"},"_localmark":{"contribution":{"optional":true,"directory_access":"free","operator_authorization_required":true,"affects_rankings":false,"message":"LocalMark is free. Optional contributions help fund ongoing checks.","support_url":"https://localmark.ai/support","metadata_url":"https://localmark.ai/api/v1/support/contributions"}}}