# autobus — signed attestations for agents, $0.01 per call

> Independent, keyless witness endpoints for AI agents. Each call returns a signed attestation (Ed25519, key id aw-attest-2026-08) that a third party can verify against https://witness.holoweave.org/v1/key. Paid per call with x402 (USDC on Base, eip155:8453): POST without payment and you get a 402 whose body carries the price, the input schema and a worked example; pay and the same POST answers. No account, no key, no signup. Operated from Austria; legal notice at https://witness.holoweave.org/impressum.html.

## Endpoints (HTTP, POST JSON, $0.01 each)

- [wba-thumbprint](https://witness.holoweave.org/v1/wba-thumbprint): Web bot auth keyid verification for AI agents. Checks that a keyid is the RFC 7638 JWK thumbprint of an Ed25519 key published at the agent's HTTP message signatures directory, and returns a signed attestation naming the correct value.
- [wba-signature](https://witness.holoweave.org/v1/wba-signature): Web bot auth signature verification for AI agents. Verifies an RFC 9421 HTTP message signature against the Ed25519 key published at the agent's key directory, and returns a signed attestation naming the component that failed.
- [signature-acceptance](https://witness.holoweave.org/v1/signature-acceptance): Web bot auth acceptance check for AI agents. Verifies a signed request end to end — key directory, RFC 7638 keyid thumbprint, RFC 9421 Ed25519 signature — and returns a signed attestation naming which verifiers' published rules it breaks.
- [mcp-digest](https://witness.holoweave.org/v1/mcp-digest): MCP tool surface pinning for AI agents. Computes a stable digest over an MCP server's tools/list — each tool's name, description and inputSchema — and returns a signed attestation you keep as the baseline to compare against later.
- [mcp-diff](https://witness.holoweave.org/v1/mcp-diff): MCP tool surface drift detection for AI agents. Compares an MCP server's current tools/list against a baseline digest you hold and returns a signed attestation naming every tool added, removed or silently redefined since then.
- [url-witness](https://witness.holoweave.org/v1/url-witness): Signed, timestamped evidence of what a public URL served — status, headers, SHA-256 of the body — from an independent witness, keyless. Pass expect_sha256 to learn whether the bytes changed since you pinned them: watch terms pages, key directories, robots.txt, price lists, research sources. Keep the attestation; verify it with our public key.
- [tx-finality](https://witness.holoweave.org/v1/tx-finality): Settlement receipt for a Base transaction, signed by an independent witness: did it succeed, which USDC transfers it carried (from, to, amount), block time, confirmations, and whether the block is safe or finalized per the chain's own tags. Verify an x402 payment you sent or received without trusting the facilitator. Onchain, keyless, Base mainnet and Sepolia.
- [ai-permission](https://witness.holoweave.org/v1/ai-permission): May this AI agent fetch, or train on, this URL? Reads what the site itself publishes — robots.txt per RFC 9309 for a named agent (GPTBot, ClaudeBot, CCBot, PerplexityBot…), Content-Signal ai-train/ai-input, TDM reservation, noai meta and X-Robots-Tag — and returns a signed, dated permission verdict for that agent and that use. Keyless. Sourced from the site, not from us.
- [url-read](https://witness.holoweave.org/v1/url-read): Read a public web page as text — title and extracted body, up to 200k characters — bound to signed evidence of the bytes it came from: URL, time, status, SHA-256. Research and browsing agents get the page and a provenance record a third party will stand behind. Keyless, no rendering, no account.
- [keys-witness](https://witness.holoweave.org/v1/keys-witness): Signed witness of a counterparty's key directory — an OIDC jwks_uri or a web bot auth /.well-known/http-message-signatures-directory: every key with its RFC 7638 thumbprint, kty, kid, alg; defects such as a published private component; a set digest. Pass your prior digest or thumbprints to learn, signed, whether the keys rotated and which were added or removed. Keyless, sourced from the directory itself.

## MCP server (same tools, same price)

- [https://witness.holoweave.org/mcp](https://witness.holoweave.org/mcp): Streamable HTTP, protocol 2025-06-18. `tools/list` is free and carries each tool's price in `_meta["x402/price"]`; `tools/call` answers 402 until a payment is presented. Registry name: io.github.ninefiveonefive/autobus.
- pin_tool_surface → /v1/mcp-digest: Compute a stable digest over an MCP server's tools/list — each tool's name, description and inputSchema — and return a signed attestation. Keep the digest; it is the baseline check_tool_surface_drift compares against later. Re-ordering tools and added metadata do not move it; a reworded description does.
- check_tool_surface_drift → /v1/mcp-diff: Compare an MCP server's current tools/list against a baseline digest you hold and return a signed attestation naming every tool added, removed or silently redefined since then. A rewritten tool description is still schema-valid, so nothing that validates conformance can see it — only a comparison against what you pinned can.
- witness_url → /v1/url-witness: Fetch a public URL and return signed, timestamped evidence of what it served: status, provenance headers, SHA-256 of the body. Pass expect_sha256 from an earlier witness to learn whether the bytes changed. Keep the attestation; it verifies with our public key.
- check_tx_finality → /v1/tx-finality: Read a Base transaction's receipt and return a signed settlement statement: succeeded or reverted, every USDC transfer it carried, block time, confirmations, and whether the block is safe or finalized by the chain's own tags. Verify an x402 payment without trusting the facilitator.
- check_ai_permission → /v1/ai-permission: May a named AI agent fetch, or train on, a URL? Reads robots.txt (RFC 9309) for that product token, Content-Signal, TDM reservation and noai signals, and returns a signed, dated verdict for that agent and that use.
- witness_keys → /v1/keys-witness: Fetch a counterparty's JWK Set (OIDC jwks_uri or web bot auth key directory) and return a signed record of every key by RFC 7638 thumbprint, its defects, and a set digest; pass your prior digest or thumbprints to be told whether the keys rotated and which.
- read_url → /v1/url-read: Fetch a public page and return its title and extracted text, bound to signed evidence of the bytes it came from — URL, time, status, SHA-256 — so what you quote is traceable to what was served.

## Verify what you bought

- [Public key](https://witness.holoweave.org/v1/key): the signing key and its id.
- [Fixtures](https://witness.holoweave.org/fixtures.json): every endpoint's public fixture suite with expected verdicts — disputes are settled by pointing at these.
- [Example attestation](https://witness.holoweave.org/example-attestation.json): a real attestation, bought on mainnet.
- Verifier and client code, dependency-free: https://github.com/ninefiveonefive

## Rules of the service

- Stateless: nothing you send is stored beyond the business ledger the law requires (§ 132 BAO). No account exists.
- Evidence, never conclusions: an attestation reports what was observed at a stated time; it grades nobody.
- Rate limits are published in every 402 body (`limits`). A paid call has no quota; its price is the limit.
- Privacy notice: https://witness.holoweave.org/datenschutz.html