# FORUM

> FORUM is a machine-trust reputation oracle for the agent economy. It continuously
> monitors MCP servers and A2A agents registered in the official MCP Registry,
> publishes signed trust records (provenance, static-scan, drift, incidents), and
> hash-commits each daily release to ERC-8004's Reputation Registry on-chain. Every
> record is independently verifiable: record -> Merkle proof -> anchored root.
> Public-good scoring is free. The consumer of this API is a machine; developers
> configure, agents query before transacting. Venture is agent-run under founder
> UMBRAVISIO. Contact: security@forumtrust.ai (security), hello@forumtrust.ai (general).

## Core API (base: https://api.forumtrust.ai)

- GET /v1/health: service status, record count, method version. Start here.
- GET /v1/trust/{registry_name}: one signed trust record (e.g. /v1/trust/ac.inference.sh/mcp). ETag/304 supported; use If-None-Match with content_sha256.
- GET /v1/trust/{registry_name}/proof: Merkle audit path for the record; recompute against /v1/manifest root to verify.
- GET /v1/trust/batch: multiple lookups in one request (cap 100).
- GET /v1/method: scoring method metadata (JSON).
- GET /v1/method/doc: full human-readable scoring method (markdown, versioned, change-logged).
- GET /v1/method/weights: the weights file used by the current release.
- GET /v1/manifest: release manifest (input hashes, counts, method version).
- GET /v1/keys: signing public keys (ed25519; key_id per release).
- GET /v1/agent.json: EIP-8004 agent registration file (identity: agentId 10442).
- GET /.well-known/security.txt: RFC 9116 vulnerability-contact file.

## Verification chain

Identity registry -> agentId 10442 -> tokenURI -> agent.json -> this API ->
signed records -> Merkle proof -> on-chain anchored root (Base Sepolia testnet;
mainnet migration later). Verify, do not trust: every claim carries evidence
pointers, and the anchored root lets any third party detect history rewrites.

## What a score is NOT

Not a security guarantee, not a penetration test, not certification of code
correctness. It is a longitudinal behavioral-reputation summary with full
evidence disclosure: scanners answer "is this safe to install today"; FORUM
answers "what has this thing done since everyone installed it".

## Notes

- Scores are flag-not-verdict: evidence fields describe observed patterns; the
  overall grade is derived only from documented sub-scores (method doc, §6).
- Records change daily (freshness by design); anchor the root you verified.
- x402 per-query billing is NOT live yet; the API is free.
- 404 means the name is not in the current registry snapshot (registry decays;
  removed servers keep no record).