Dependency evidence
Agenstry watches MCP dependencies alongside existing A2A/paid API watches. The public comparison accepts MCP identifiers (prefix mcp: to disambiguate), exact endpoint URLs and Agenstry record URLs. /dependencies provides the watch workflow and observed changes; /account#subscriptions manages both kinds.
MCP watches
A watch captures its baseline at creation; historical changes are not replayed. Watched MCP endpoints get an hourly attempt target (15 minutes for an active Enterprise account) using a reserved quarter of the existing probe batch (capacity and provider restrictions can delay it; no SLA). The crawler continues collecting observations, and the scheduler compares watched records against their durable baseline. Events cover complete tool-list changes (including descriptions, input/output schemas, added and removed tools), endpoint/version/registry status, observed anonymous versus authentication-required access, availability observations and known lifecycle notices. OAuth grants, scopes and consent-screen changes are not measured. Schema observations are bound to the introspected endpoint: a replacement URL needs a new observation. A partial or failed introspection cannot erase a complete baseline. Probes refused by the host are not downtime evidence.
Email uses the existing mail delivery service. Pro webhooks use the existing HMAC signature scheme and re-check URL safety at delivery. Database transactions close before delivery; each accepted event cursor commits before the next network call. Delivery is at least once: event ids are stable, a failed send does not advance the cursor, and receivers should deduplicate event ids. A crash after the receiver accepts but before commit can redeliver. MCP watches and external Agent watches share one plan budget at creation AND delivery. A downgrade pauses delivery beyond the oldest allowed subjects; owned-agent email stays unlimited. MCP records currently have no domain-ownership exemption. Pausing reserves the slot; deleting releases it. Changing delivery channel does not replay old events.
Accepted baselines and policy checks
The APIs are public and rate-limited through the existing limiter:
GET /api/v1/dependencies/snapshot?kind=mcp&identifier=<indexed-name>POST /api/v1/dependencies/evaluatewith{kind,identifier,baseline,policy}GET /api/v1/dependencies/mcp-events?name=<indexed-name>
Use the dependency CLI without installing packages:
python3 scripts/dependency-check.py pin --kind mcp --identifier io.example/server
python3 scripts/dependency-check.py check --report dependency-decisions.json
Commit agents.lock.json. Pinning is explicit acceptance, never an automatic CI step. CI runs check and stores the decision JSON as an artifact. Exit 0 = allow; 1 = review/block; 2 = malformed input, API/network failure or rate limit. Set AGENSTRY_API_KEY to use the account's normal API budget. The CLI never exempts itself from rate limits. An unavailable API must never be treated as an allow decision.
Policy fields: max_age_hours (1–720, default 48), missing_evidence (review by default, or explicit block), require_legal_identity and require_signature. Changes to endpoint, owner declaration, card hash, tool schemas, access mode or version require review. An announced sunset blocks after its date. Incomplete/stale/unmeasured evidence gets the configured gap decision. Runtime freshness uses direct probe evidence, not catalogue refresh timestamps. MCP lock snapshots retain a deterministic schema-content hash and up to 100 tool names; full before/after schemas remain in change events and record pages. Tool-list ordering alone is not schema drift. Decisions include before/after snapshots and hashes of baseline, current evidence and policy plus policy version and evaluation time. These are unsigned decision records; retain them in your own audit system. A caller-accepted lock is not a signed supplier attestation, a universal trust score, execution permission or a security certification.
Opt-in task fixtures
Sign in as the verified owner of an indexed Agent domain. Publish this public manifest at https://<domain>/.well-known/agenstry-task-tests.json:
{
"allow_agenstry": true,
"environment": "sandbox",
"version": "echo-v1",
"cases": [
{
"name": "echo fixture",
"path": "/agenstry-sandbox/echo",
"request": {"text": "agenstry-test"},
"expected": {"text": "agenstry-test"}
}
]
}
POST /api/v1/dependencies/task-checks?domain=<verified-indexed-domain> with your signed-in same-origin session. The runner re-reads consent every time, allows at most five requests, accepts only same-origin /agenstry-sandbox/ paths, follows no redirects, sends no credentials/payment and bounds response size/time. The manifest and endpoint must be public, free, side-effect-free sandbox fixtures. Never include personal data or secrets. Removing consent disables subsequent runs. There is no automatic arbitrary third-party tool execution.
GET the same URL for the last 20 public runs. Each run preserves the origin actually tested, even if its agent later moves domain. The manifest hash includes that origin, so results from a different host are not silently compared. Each fixture records exact JSON correctness, latency and request/expected/actual hashes; cost stays not_observed. Regression is meaningful only against the identical manifest hash/environment/version. An operator-selected fixture tests that fixture only. It does not establish general task success, production safety or benchmark rank. These results never raise the conformance/uptime score.
Optional SealKeeper credentials
POST /api/v1/dependencies/sealkeeper/verify with { "seal": "<compact-JWS>", "subject": "<expected-raw-agent-id>" }. Verification uses only https://sealkeeper.run/.well-known/seal.json, Ed25519, exact issuer/subject, supported credential versions and a valid bounded time window. A failure or unavailable issuer key document never returns a valid credential. The signed payload is returned; an unsigned API payload is never substituted. Preserve issuer task categories: server-checked, peer-confirmed and other credited tasks are distinct.
This read-only adapter performs no registration, claim, outreach or reputation-score merging. A credential is subject-bound; domain binding remains explicitly not_checked. To associate it with a domain, independently verify the signed listing card URL and the agent's key/ownership evidence before displaying it as evidence for that domain. Signature integrity does not prove key possession, operator legal identity, safety or permission. Issuer integration guide.
Legal identity coverage
GET /api/v1/dependencies/identity-coverage separates active indexed agents, verified domain control, bound identifiers, current legal proof and distinct verified entities. Legal proof follows the shared identity_is_verified gate: bound identifier, good-standing entity/registration statuses, completed verification and provider/legal-name match. Homepage and intelligence fields use the same gate. Zero means zero qualifying proof records, never zero companies in the real world. Existing /api/registries, owner verification and registry-binding flows remain the path to improve coverage without manufacturing proof.
Smithery migration
Smithery's announcement, checked 2026-10-19, retires connection management on 2026-10-31: run.tools (including subdomains), server.smithery.ai, API/Connect/Toolbox, accounts/API keys and deprecated CLI/SDKs. The public directory remains. /smithery-migration and its JSON API inventory indexed primary endpoints by exact host boundary and show observation timestamps, source and deadline. No guessed replacement endpoints or automatic credential migration. Provider website/docs links are investigation paths, not verified replacement transports. After sunset, legacy API discovery/proxy probes stop and install examples stop proposing the retired remote. Other sources continue discovery.