{
  "gate": "MCP Verification Gate",
  "version": "0.2.4",
  "gate_commit": "b237ce0675ec",
  "what_this_verifies": [
    "The server actually exists and speaks MCP",
    "The server publishes an A2A agent card",
    "The server declares who pays it",
    "Identical input returns identical output",
    "This gate's own verdict can be recomputed by anyone"
  ],
  "what_this_does_not_verify": [
    "Whether prices or figures returned by the server are correct",
    "Whether the declared compensation structure is truthful (it is published and recorded; false declarations are grounds for revocation)",
    "Quality, competence, or fitness of the underlying business"
  ],
  "conditions": {
    "mcp_endpoint": "POST /mcp responds to initialize (with a result, not an error) and tools/list with at least one well-formed tool: a non-empty string name and an inputSchema object. Hollow tools are not counted, duplicate names fail, and a tools value that is not an array fails (0.2.2).",
    "agent_card": "GET /.well-known/agent-card.json returns a JSON object whose name and description are non-empty strings. Redirects are followed only within the same origin; a redirect to another origin is not a card at this origin (0.2.2).",
    "compensation_disclosure": {
      "location": "agent-card, top-level key 'compensation'",
      "shape": {
        "paid_by": [
          "buyer",
          "seller",
          "referral",
          "advertising",
          "subscription",
          "public",
          "other"
        ],
        "referral_fee": "boolean, required",
        "listing_fee": "boolean, required",
        "success_fee_pct": "number between 0 and 100, optional; declared with any other type or range, the condition fails (0.2.2)",
        "disclosure_url": "string, optional; declared with any other type, the condition fails (0.2.2)"
      },
      "note": "Content is not judged. Only the absence of disclosure disqualifies. A self-contradicting declaration (paid_by referral with referral_fee false) still passes and is published with a consistency_note (0.2.2)."
    },
    "determinism": "Calling the same tool with the same arguments returns identical content across runs. NOT measured by default: doing so requires executing a tool on the checked server, which this gate will not do without the owner's consent. Send allow_tool_call true to measure it. An error response (JSON-RPC error or result.isError) is not a measurement: up to 3 tools are tried in the server's own order, and the verdict discloses which tool was measured, which were tried, and how many were not measured (0.2.2).",
    "self_verification": "Every verdict carries a SHA-256 that any third party can recompute"
  },
  "reachability": "Any HTTP status, or a non-JSON body, is an answer from the server: reachable stays true and the row goes pending, not held. Only gateway-shaped statuses (502-504, 52x) and transport failures mean held. Redirects to another origin are treated as answered, not followed (0.2.2).",
  "consent": "allow_tool_call on /check is asserted by the requester and is not proof of ownership; every verdict states its consent_basis and consent_source. Rows in the public register are measured with tool calls only with proven consent: the operator's published consent list (0.2.2) or a consent file on the endpoint's own origin (0.2.4).",
  "well_known_consent": {
    "since": "0.2.4",
    "path": "/.well-known/mcp-conduct.json",
    "shape": {
      "allow_tool_call": "boolean true, required; nothing else counts",
      "endpoints": "optional array of exact endpoint URLs; when present, only those endpoints are consented"
    },
    "why": "Only the owner of an origin can place a file under its /.well-known/. So the file is proof of consent, where a request field is only an assertion. The gate reads it with the same same-origin rules as the agent card, executes nothing from it, and records in the verdict where and when it read it.",
    "effect": "Determinism is measured on /check without asserting allow_tool_call, and on every scheduled measurement of the public register. The verdict of a check without consent names this path under consent_lookup.how_to_consent."
  },
  "red_team": "test/redteam_gate.mjs in the public repository attacks this gate with adversarial mock servers (hollow tools, error echoes, cross-origin redirects, malformed cards and disclosures, misclassified reachability). Fail-closed and deterministic. v0.2.1 scored 17 of 48; v0.2.2 scores 48 of 48. Known residual: determinism is measured on one tool the server lists first, which the verdict discloses rather than hides.",
  "also_measured_no_verdict": {
    "absence_vs_failure": {
      "condition": "06",
      "question": "Can a consumer tell 'the lookup failed' from 'the lookup found nothing'?",
      "source": "Federico Blanco Sanchez-Llanos, \"The Mould, Not the Letter\", 2026-08-20",
      "method": "Structural, name-independent: does a tool's declared outputSchema contain a boolean, or an enum with 2+ values, where a read-succeeded / read-failed / nothing-matched state could live. Read from tools/list; nothing is executed.",
      "verdict": "none. A disclosed number, not a pass or fail. Nearly all of the field cannot do this, so a threshold would only condemn; and a schema is a declaration, not behaviour. Reported per verdict under the top-level key absence_vs_failure, with the field names that produced each pass so a reader can check the false positives.",
      "self_applied": "This gate's own get_conditions tool fails the test ,  it takes no arguments and has no read that can fail ,  and that is left standing rather than papered over."
    },
    "canonicalization": {
      "condition": "07",
      "question": "Can an independent party recompute the fingerprint of this server's declared surface, byte for byte, without us?",
      "method": "RFC 8785 (JCS) over the tool manifest from tools/list. Nothing is executed and no content is judged. A surface that cannot be canonicalized has no fingerprint a third party can reproduce, so a silent change to it can only be caught by whoever made it.",
      "verdict": "none. A disclosed measurement, not a pass or fail, and it never turns a row red. That promise was published on 2026-08-23, before this condition was implemented.",
      "self_applied": "Measured before it was applied to anyone else. This gate's own canonicalizer matched 11 of 12 vectors against an independent RFC 8785 implementation on first measurement; the vector it failed produced a hash over a value it had silently altered. Fixed, and 13 vectors are now pinned as a permanent regression test.",
      "unsafe_integers": "Integer literals outside the IEEE-754 safe range are detected from the response source text, not from the parsed number, and a surface carrying one has its fingerprint withheld. RFC 7493, the profile RFC 8785 builds on, excludes them, and a runtime with arbitrary-precision integers would read them as different values, so no cross-language hash over them is reproducible.",
      "retracted_limitation": "On the morning of 2026-08-23 this gate published that the case was undetectable in JavaScript. That was wrong, and wrong in the direction that excused us. JSON.parse exposes the source text of each literal to a reviver. Detection was implemented the same day. The false claim is kept on the record rather than deleted.",
      "vectors": "https://shield.the-horizons-innovation.com/verify-directory/conformance/"
    }
  },
  "tiers": {
    "verified": "Free. Conformance and disclosure verified. No price validation.",
    "verified_plus_data": "Paid. Figures traced to a third-party obtainable primary source.",
    "yakumo_partner": "Paid. Dedicated MCP server, operations, audit log."
  },
  "operator": "The HORIZONs Co., Ltd. / HORIZON SHIELD",
  "self_applied": "This gate is itself subject to these conditions."
}