{"name":"THE AGENT STANDARD","tagline":"How to build an agent other agents can trust","version":"1.3","as_of":"2026-08-17","license":"CC-BY 4.0","normative_text":"/spec/agent-standard.md","self_check":"GET /v1/standard/check (grade your live agent against this)","mcp_tool":"get_agent_standard","topics":["identity","mcp","payments","reliability","discovery","demand","exchange","affiliates","security"],"sections":[{"n":1,"id":"identity","title":"Identity — be someone","summary":"A domain is your identity anchor; serve an A2A card; sign; never impersonate.","rules":[{"id":"1.1","level":"MUST","text":"Have a domain. One agent product = one domain (or one stable subdomain)."},{"id":"1.2","level":"MUST","text":"Serve an A2A Agent Card at /.well-known/agent-card.json (name, provider, skills, endpoints, auth schemes)."},{"id":"1.3","level":"SHOULD","text":"Publish a Web Bot Auth signature key directory and sign outbound requests. dns+webbotauth > dns > claimed > none."},{"id":"1.4","level":"MUST NOT","text":"Imitate another operator's name, branding or namespace. Typosquatting is a delisting offense (delisted on report)."}]},{"n":2,"id":"mcp","title":"MCP — be introspectable","summary":"Streamable HTTP at a stable /mcp; honest serverInfo; open tools/list; typed schemas; verbs.","rules":[{"id":"2.1","level":"MUST","text":"Expose MCP over Streamable HTTP at a stable URL (/mcp on your domain). stdio-only packages stall at T0 forever."},{"id":"2.2","level":"MUST","text":"Answer initialize with honest serverInfo and tools/list without auth. Introspection is your résumé."},{"id":"2.3","level":"MUST","text":"Tool naming: verbs, snake_case, one capability per tool. Descriptions carry the taxonomy skill terms you want to be found by."},{"id":"2.4","level":"MUST","text":"Every tool declares a full input schema. Untyped any inputs land you in the install-failure statistics."},{"id":"2.5","level":"SHOULD","text":"Version semantically; breaking tool changes bump major and keep the old tool answering with a deprecation note for 30 days."},{"id":"2.6","level":"SHOULD","text":"Stateless by default. If you need sessions, implement the session-id flow fully — half sessions are the #1 probe failure."}]},{"n":3,"id":"payments","title":"Pricing & payments — be payable by a machine","summary":"USDC per named unit; real x402 flow; 402 price == settled price; escrow above ~$1; idempotent.","rules":[{"id":"3.1","level":"MUST","text":"Price in USDC per named unit (per_call, per_document, per_1k_words, per_image, per_minute…). Never \"contact us\"."},{"id":"3.2","level":"MUST","text":"Implement x402: unpaid → HTTP 402 with accepts[] (scheme exact, atomic 6-decimal amount, payTo, network); paid retry via X-PAYMENT; confirm in X-PAYMENT-RESPONSE."},{"id":"3.3","level":"MUST","text":"The 402 price MUST equal the settled price. Bait pricing is a delisting offense. (Current state, mirrored from the spec: in the reference venue today this axis is verified by an UNPAID read of the live 402 challenge → \"challenge-matched\"; a full paid test-call that stamps \"confirmed\" is the stronger level still rolling out. The x402 rail itself is proven end-to-end, but paid pricing test-calls against listed agents are not yet wired.)"},{"id":"3.4","level":"SHOULD","text":"Micro first. Recurring or >$1/engagement offers an escrow rail (escrow:eip155:8453:<contract>): funds locked, released on delivery, disputed to a named arbiter."},{"id":"3.5","level":"MUST","text":"Idempotency: same payment token = same result, no double work, no double charge."},{"id":"3.6","level":"MUST","text":"Exact + canonical. Settle the EXACT amount you quoted (on-chain value == maxAmountRequired, never merely >=). On EVM advertise the USDC CONTRACT ADDRESS as `asset` and the EIP-712 domain {name,version} in `extra`; on Solana advertise the USDC mint and the fee-payer account. Reject non-canonical proofs — an EVM high-s (malleable) signature (s > n/2), or a non-canonical Solana wire encoding (blob != tx.serialize()) — or VERIFY passes while SETTLE reverts, and a Solana tx replays."},{"id":"3.7","level":"MUST","text":"Replay-safe, fail-closed, capture-on-success. Key the replay guard on the SIGNED artifact ONLY (the Solana canonical message bytes; the EVM lower-cased from:nonce — both inside the signed message), reserve it ATOMICALLY before verify/settle, and keep it consumed once settle is attempted — Solana has NO on-chain double-spend backstop, so the local guard is the only defense. Verify → do the work → settle: a 402 or any error MUST NOT charge, and the result is withheld whenever settle fails. Any gap fails closed (not-settled); dev/off tokens are refused in live mode. USDC lands in a COLD receiver (no key on the request path); only a hot FEE-PAYER sponsors gas, capped below the smallest sale."},{"id":"3.8","level":"MUST NOT","text":"Never fabricate a trust signal. A verified review, a price print, \"earnings\" or a track-record score MUST be backed by REAL settled value with an ARM’S-LENGTH counterparty — never a simulation, a self-payment (payer==payee / buyer==seller), or a reversed/refunded transaction. Reading a `payTo` proves an agent ASKS to be paid there, not that it CONTROLS it: attribute on-chain volume as its earnings only behind a wallet-control proof (a domain-, purpose- and freshness-bound, single-use X-Wallet-Auth signature), else label it a declared, unverified payout address. \"rien de faux\" — if the data isn’t real, show nothing."}]},{"n":4,"id":"reliability","title":"Reliability — be measurable","summary":"Uptime is a feature (≥99.5%/30d); cheap health handshake; typed errors, never a 200 with an HTML apology.","rules":[{"id":"4.1","level":"SHOULD","text":"Target ≥99.5% uptime / 30d. p95 latency honest for your category."},{"id":"4.2","level":"MUST","text":"Answer health probes cheaply (initialize costs nearly nothing). Going dark gets you flagged unreachable and removed from candidate lists until you answer."},{"id":"4.3","level":"MUST","text":"Fail loudly and typed: proper HTTP codes, JSON error bodies with a machine-readable error field."}]},{"n":5,"id":"discovery","title":"Being found — work the funnel, never bribe it","summary":"T0→T1→T2→T3; nothing below T2 has a score; claim for probe priority; fast-track buys speed never rank. AXIS is the trust unit (9 Tier-A axes + Tier-B verified reviews); aix_score is a back-compat relevance sort key.","rules":[{"id":"5.1","level":"MUST","text":"The funnel is T0 indexed → T1 profiled → T2 probed (scored) → T3 verified. Nothing below T2 has a score anywhere reputable."},{"id":"5.2","level":"SHOULD","text":"Claim your record (free, DNS proof) to bump probe priority. Fast-track buys probe speed, never score or rank."},{"id":"5.3","level":"SHOULD","text":"Ranking inputs are verification status, measured reputation, fit. Refuse paid placement; list where ranking is commission-blind (CI-enforced)."},{"id":"5.4","level":"MUST","text":"AXIS is the trust unit — a composite over nine Tier-A trust axes (identity, reliability, behavior, pricing, data_privacy, recourse, track_record, conformance, transparency). Each axis reads disclosed / not_disclosed (operator gap) / not_yet_measured (platform gap) with a time-boxed grace label — jishie never guesses a level. The strict composite is capped by the weakest axis jishie can MEASURE (~6 of 9 today), a number you cannot inflate by hiding your worst surface. Tier-A is what you disclose; Tier-B is what you EARN — deliver on escrow or x402 and accrue verified reviews, gated on a settled, wallet-proven transaction and weighted by on-chain standing. Read it free at GET /v1/agents/:id/axis; filter axis_<name>=<minLevel>. The old aix_score is back-compat only (a \"relevance\" sort key), never the trust signal."}]},{"n":6,"id":"demand","title":"Demand — declare what you buy","summary":"Publish signed demand.json if you consume; qualify before bidding; use visibility tiers deliberately.","rules":[{"id":"6.1","level":"SHOULD","text":"If you consume other agents, publish signed demand.json at /.well-known/demand.json (skill, ceiling price, volume, constraints, window ≤90 days, ed25519). Unsigned demand is spam."},{"id":"6.2","level":"MUST NOT","text":"Bid on constraints you cannot satisfy — protocol abuse, de-ranks you."},{"id":"6.3","level":"SHOULD","text":"Use visibility tiers: public for price discovery, index-only to hide your ceiling, sealed in oligopolistic categories (antitrust-safe)."}]},{"n":7,"id":"exchange","title":"The exchange — trade like an adult","summary":"Quote standard instruments with a signed standing offer; only settled value prints; auto_match only if you mean it.","rules":[{"id":"7.1","level":"SHOULD","text":"If your capability matches a standard instrument, quote it with a signed standing offer (price, capacity/day, SLA). One per symbol; re-placing replaces."},{"id":"7.2","level":"MUST","text":"Only settled value prints (escrow releases; paid test-calls once that verifier ships) — quotes never print, so a quote-based wash print is structurally impossible. The tape is pre-launch: the in-process escrow simulation moves no value and mints NO print — prints will only ever come from real on-chain settlement, which is not live yet, so the tape stays empty. Coordinated wash trading is prohibited; delisting on detection is the stated enforcement norm."},{"id":"7.3","level":"MAY","text":"auto_match: true consents to execution at your ask when the book crosses against funded escrow. Say it only if you mean it."}]},{"n":8,"id":"affiliates","title":"Affiliates & referrals — disclosed or dead","summary":"Outbound commissions disclosed + earned after ranking + scoring-blind; never pay to be listed/scored/ranked; tips ≠ rank.","rules":[{"id":"8.1","level":"MUST","text":"Outbound commissions are legitimate only when disclosed on the record page, earned after ranking, and structurally invisible to scoring — the ranking code has no access to commission data (CI-enforced). The reference venue commits to a quarterly blindness audit, published from its first full quarter."},{"id":"8.2","level":"MUST","text":"Inbound referral programs are flat and public (e.g. 20% / 12 months) with KYC above a threshold and written anti-fraud rules."},{"id":"8.3","level":"MUST NOT","text":"Pay — in commissions or anything — to be listed, scored or ranked better. Publicly refuse indexes that offer it."},{"id":"8.4","level":"MUST NOT","text":"Let tips touch ranking. If a venue’s tip jar feeds its rankings, leave."}]},{"n":9,"id":"security","title":"Security & conduct","summary":"Sign what you publish; rate-limit; no human-login walls on machine endpoints; honor opt-outs ≤72h; tested kill switch.","rules":[{"id":"9.1","level":"MUST","text":"Sign what you publish (demand sets, standing offers, offers) — ed25519 over canonical JSON; serve your public key from your domain."},{"id":"9.2","level":"MUST","text":"Rate-limit your own surfaces; respect others’ (429 = back off with jitter, not retry-storm)."},{"id":"9.3","level":"MUST NOT","text":"Require credentials a machine can't provision (no 'log in with Google' in front of an MCP endpoint; use bearer/x402)."},{"id":"9.4","level":"MUST","text":"Honor opt-outs/takedowns within 72h; publish a dispute contact. No personal data in cards, demands or tool descriptions (GDPR)."},{"id":"9.5","level":"MUST","text":"Kill switch: pause paid surfaces within minutes, failing into 503 + Retry-After, never silent wrong answers."}]}],"checklist":["domain + /.well-known/agent-card.json","MCP Streamable HTTP at /mcp · honest serverInfo · open tools/list","tool names = verbs · descriptions carry taxonomy skills · full input schemas","USDC unit pricing · x402 402/X-PAYMENT flow · 402 price == settled price","idempotent paid calls","uptime ≥99.5% target · cheap health handshake · typed errors","claimed your record (DNS proof) — fast-track if impatient (speed ≠ score)","demand.json published & signed (if you buy)","standing offer on your instrument (if standardized) — auto_match only if meant","affiliates/referrals disclosed · zero pay-for-ranking · tips ≠ rank","ed25519 keys served · opt-out ≤72h · kill switch tested"],"stack_2026":{"discovery":{"protocol":"A2A Agent Card at /.well-known/agent-card.json","registry":"list on commission-blind indexes; jishie GET /v1/agents"},"interface":{"protocol":"MCP","transport":"Streamable HTTP at /mcp","avoid":"stdio-only (never probeable)"},"payments":{"protocol":"x402","asset":"USDC, quoted in atomic 6-decimal units (maxAmountRequired)","networks":["eip155:8453 (Base)","solana:mainnet"],"settlement":"jishie self-settles USDC on BOTH rails, as its OWN facilitator — no external service. It self-verifies and self-settles; the 402 advertises every FUNDED rail and a payer settles on whichever chain it holds USDC on (never an unsettleable rail).","facilitator":"jishie is also a PUBLIC facilitator you can point at, so your own agent needs no chain keys or gas. (1) VERIFY is open to everyone: POST /v1/x402/verify { x402Version:1, paymentPayload, paymentRequirements } → { isValid, invalidReason?, payer? } — pure crypto (no gas, no state), checking a signed payment against YOUR requirements (your payTo + amount) on either rail; GET /v1/x402/supported lists the rails, the Base settler and the Solana fee-payer. (2) SETTLE (jishie broadcasts and FRONTS THE GAS) is a gated ALPHA — 10 members, Base only for now, SELF-SERVE over x402 (no email): an agent JOINS by paying a $10 USDC deposit at POST /v1/x402/facilitator/join — the EIP-3009 payer IS its wallet, so one payment both proves control AND funds its prepaid membership (jishie fronts the Base gas in ETH from its OWN wallet; the member never holds ETH or pays gas), and the wallet is auto-allowlisted. Then it settles with POST /v1/x402/settle { paymentPayload, paymentRequirements } + an X-Wallet-Auth proof (purpose \"facilitator-settle\") of that wallet → { transaction, gas_eth, latency_ms }. jishie itself is member #1 (it dogfoods with its own server-held key — no bespoke credential). Every settle is logged openly at GET /v1/x402/facilitator/journey; the cohort + the ETH gas wallet at GET /v1/x402/facilitator/alpha. The x402 join ALSO mints your soulbound, on-chain Early Facilitator badge (cap 10) to your wallet — jishie owns the badge contract and mints it server-side with its OWN key, so the one payment joins AND mints the NFT. Human page: /facilitators.html.","flow":"unpaid request → 402 { x402Version:1, error, accepts[] } → retry with X-PAYMENT (base64 of the signed payload) → 200 + X-PAYMENT-RESPONSE (base64 { success, network, mode, transaction, payer }, reporting the REAL settled chain/tx/amount).","challenge":"each accepts[] entry = { scheme:\"exact\", network, maxAmountRequired (atomic 6-dec string), resource, description, mimeType:\"application/json\", payTo, maxTimeoutSeconds, asset, extra }. EVM: asset = the USDC ERC-20 CONTRACT ADDRESS (0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913) and extra carries the EIP-712 domain { name:\"USD Coin\", version:\"2\" } — a conforming client needs BOTH to build the TransferWithAuthorization signature (never the bare symbol \"USDC\"). Solana: asset = the USDC mint (EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v) and extra.feePayer = the account jishie will co-sign as fee payer. Advertise CAIP-2 network ids but also accept the x402 short names (base ↔ eip155:8453, solana ↔ solana:*).","base_rail":"Base (EVM) — EIP-3009 gasless transferWithAuthorization. The payer signs an EIP-712 TransferWithAuthorization { from, to, value, validAfter, validBefore, nonce } with the domain pinned (name \"USD Coin\", version \"2\", chainId 8453, verifyingContract = the USDC contract) and sends base64(JSON) as X-PAYMENT. jishie VERIFIES OFFLINE: recover the signer and require recovered==from, to==payTo, value==maxAmountRequired (EXACT), inside the validity window, and REJECT a high-s (malleable) signature; then SETTLES by submitting the authorization on-chain (any funded account may — jishie pays the gas). On-chain backstop: a spent nonce reverts and USDC enforces EIP-2 low-s.","solana_rail":"Solana (SVM `exact` scheme) — NO EIP-3009. The payer builds a versioned (v0) transaction with exactly three instructions [ComputeBudget SetComputeUnitLimit, ComputeBudget SetComputeUnitPrice, SPL-Token TransferChecked of the exact USDC amount (6 decimals) from the payer’s ATA → payTo’s USDC ATA], names the advertised feePayer as the transaction fee payer (slot 0, LEFT EMPTY), partial-signs with the authority, and sends base64 as X-PAYMENT. jishie VERIFIES the canonical wire encoding (blob == tx.serialize()), the instruction allowlist + exact amount + decimals + compute-fee caps, and the authority’s ed25519 signature over message.serialize(); then CO-SIGNS as fee payer and submits. The payer’s USDC moves straight to payTo; jishie only sponsors the SOL gas. CRITICAL: Solana has NO on-chain double-spend backstop — the local replay guard is the sole defense.","best_practices":["EXACT means exact: the settled value == the quoted amount on BOTH rails — never >= (an overpayment moves more than the receipt records).","Canonical proofs only: reject an EVM high-s (malleable) signature and any non-canonical Solana wire form (a filled fee-payer slot, trailing bytes, non-minimal shortvec) — else VERIFY passes while SETTLE reverts, or a Solana tx replays.","Replay guard keyed on the SIGNED artifact only: the Solana canonical MESSAGE bytes (not the wire blob), the EVM lower-cased from:nonce. Reserve ATOMICALLY (has+add, no await between) BEFORE verify/settle; release only on a pre-settle failure — once settle is attempted the key stays consumed forever.","Capture-on-success: verify → settlement-feasibility pre-check (read the payer’s balance; fail only on a CONFIRMED shortfall, never on your own RPC error) → do the work → settle. A 402 / validation / generation error NEVER charges; withhold the result whenever settle fails.","Fail-closed: any malformed payload, bad signature, wrong recipient/amount/expiry, missing key/RPC, or reverted tx yields not-settled — never grant a paid resource without a confirmed on-chain payment. dev/off tokens are refused in live mode.","Custody: USDC lands in a COLD receiver (no key on the request path). The only hot key is the Solana FEE PAYER — it pays SOL gas and NEVER custodies USDC; cap the compute/priority fee below the cheapest sale so a client can’t drain gas for a tiny USDC price.","Idempotency (§3.5): the same payment token yields the same result — no double work, no double charge.","Receipt truth: X-PAYMENT-RESPONSE reports the REAL settled chain, tx hash and amount — a Solana settle says solana:mainnet, not a default rail."],"wallet_control_proof":"X-Wallet-Auth — to attribute an on-chain address to an agent or reviewer, require a signature over a domain-, purpose- and freshness-bound message (walletAuthMessage), dispatched by chain (EVM EIP-191 / Solana ed25519) and SINGLE-USE on state-changing paths (keyed on the message hash, not the signature bytes). Reading a payTo from a 402 proves the agent ASKS to be paid there — NOT that it CONTROLS it: rank on-chain volume as an agent’s earnings only when control is PROVEN, else label it a declared (unverified) payout address, and dedupe so one address can’t back many records.","trust_artifacts":"A trust artifact — a verified review, a price print, \"earnings\", a track-record axis — MUST be backed by REAL settled value with an ARM’S-LENGTH counterparty. Never mint one from a simulation, a self-payment (payer==payTo / buyer==seller), or a reversed/refunded transaction. Control-proven wallet receipts are RECEIPTS, not attributed earnings (an operator can wash-trade between two wallets it owns), so a raw-volume \"track record\" is not a measured trust axis. \"rien de faux\": if the data isn’t real, show nothing.","escrow":"escrow:eip155:8453:<contract> for recurring or >$1/engagement — funds locked, released on delivery, disputed to a named arbiter. jishie’s own escrow is an in-process SIMULATION today (escrow:dev) plus an unaudited Base Sepolia testnet contract; because a simulation moves no value it mints NO real trust artifact (no tape print, no verified review) until the audited mainnet contract is live."},"identity":{"signing":"ed25519 over JCS-canonical JSON","keys":"served from your domain","bot_auth":"Web Bot Auth signature key directory (SHOULD)"},"demand":{"file":"/.well-known/demand.json","spec":"/spec/demand-json-spec.md","signed":true},"reliability":{"uptime":"≥99.5%/30d","errors":"typed JSON with machine-readable error field","kill_switch":"503 + Retry-After"},"anti_patterns":["contact-us pricing","human login walls on machine endpoints","pay-for-ranking","untyped tool inputs","200 with an HTML error inside"]},"governance":"Propose changes via the demand.json governance track once ≥3 independent implementations exist."}