Security audit
Security checks for vulnerabilities and agentic risk
The skill provides user-requested proof-of-existence receipts with clearly disclosed payments, public records, and wallet approval requirements.
Expect a third-party service to receive the selected artifact's hash. Public receipts can permanently link that hash to signatures or payment activity. Review the amount, network, and recipient in your wallet for each payment, keep private keys outside the agent, and retain your receipt.
Verification is related to the declared service, but it is materially different from the stated primary operation of paid proof issuance. The only supplied command calls /v1/pdr/verify/YOUR_PDR_B64; it does not implement issuance or payment. No unrelated resource access or additional harmful behavior is evident.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
metadata:
author: aotrust
version: "3.10.1"
mcp-endpoint: https://api.aotrust.link/mcp
http-endpoint: https://api.aotrust.link/notarize
verification-endpoint: https://api.aotrust.link/v1/pdr/verify
near-handle: aotrust
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
author: aotrust
version: "3.10.1"
mcp-endpoint: https://api.aotrust.link/mcp
http-endpoint: https://api.aotrust.link/notarize
verification-endpoint: https://api.aotrust.link/v1/pdr/verify
near-handle: aotrust
---
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
version: "3.10.1"
mcp-endpoint: https://api.aotrust.link/mcp
http-endpoint: https://api.aotrust.link/notarize
verification-endpoint: https://api.aotrust.link/v1/pdr/verify
near-handle: aotrust
---
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
https://api.aotrust.link/mcp
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
OAuth 2.1 endpoints exist as optional discovery stubs (used by the
agents.near.ai integration path):
- Resource: `https://api.aotrust.link/.well-known/oauth-protected-resource/mcp`
- Authorization server: `https://api.aotrust.link/.well-known/oauth-authorization-server`
- Register client: `POST https://api.aotrust.link/oauth/register`
- Authorize: `GET https://api.aotrust.link/oauth/authorize`
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
agents.near.ai integration path):
- Resource: `https://api.aotrust.link/.well-known/oauth-protected-resource/mcp`
- Authorization server: `https://api.aotrust.link/.well-known/oauth-authorization-server`
- Register client: `POST https://api.aotrust.link/oauth/register`
- Authorize: `GET https://api.aotrust.link/oauth/authorize`
- Token: `POST https://api.aotrust.link/oauth/token`
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
| `notary_anchor` | Anchor status / proof / logproof / consistency (RFC 9162) | Free |
| `notary_verify` | Verify a notarization by job_id or pdr_b64 | Free |
Live price list in one request: `GET https://api.aotrust.link/menu`.
### MCP Flow — Free Tier (no wallet, 1 step)
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Interface 2: HTTP API (for Developers)
> **Prices without a round-trip:** `GET https://api.aotrust.link/menu` returns the live tool list with costs and payment rails in one request (no 402 cycle needed).
### Step 1: Compute the Work Hash
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# By job_id
curl https://api.aotrust.link/v1/notarize/YOUR_JOB_ID/status
Response:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Resource: `https://api.aotrust.link/.well-known/oauth-protected-resource/mcp`
- Authorization server: `https://api.aotrust.link/.well-known/oauth-authorization-server`
- Register client: `POST https://api.aotrust.link/oauth/register`
- Authorize: `GET https://api.aotrust.link/oauth/authorize`
- Token: `POST https://api.aotrust.link/oauth/token`
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Resource: `https://api.aotrust.link/.well-known/oauth-protected-resource/mcp`
- Authorization server: `https://api.aotrust.link/.well-known/oauth-authorization-server`
- Register client: `POST https://api.aotrust.link/oauth/register`
- Authorize: `GET https://api.aotrust.link/oauth/authorize`
- Token: `POST https://api.aotrust.link/oauth/token`
### Available Tools (9)
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Authorization server: `https://api.aotrust.link/.well-known/oauth-authorization-server`
- Register client: `POST https://api.aotrust.link/oauth/register`
- Authorize: `GET https://api.aotrust.link/oauth/authorize`
- Token: `POST https://api.aotrust.link/oauth/token`
### Available Tools (9)
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- **Solana (SVM):** USDC-SPL transfer with PayAI as feePayer (`solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp`) — payload field is `{"transaction": "<base64 signed tx>"}`; x402 SVM client libraries handle this automatically
4. **MCP:** Call `notary_verify` with the `job_id` from the PDR → confirm `anchored`
x402-unaware MCP clients should read `content[1]` of the 402 result (human-readable fallback) — direct HTTP clients can still `POST https://api.aotrust.link/notarize` with the `x-payment` header (see Step 3 below for format).
> **Note:** `notary_notarize_paid` is a full paid tool: call it without payment to receive the challenge, then retry with payment attached. No HTTP round-trip is required for x402-capable MCP clients.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Solana payments are MCP-only. The HTTP endpoint (
/notarize) accepts Base (EVM) payments only. Solana (SVM) wallets pay via the MCP flow above (notary_notarize_paid).
curl -X POST https://api.aotrust.link/notarize \
-H "Content-Type: application/json" \
-d '{"work_hash":"YOUR_SHA256_HEX","agent_sig":"","agent_pubkey":""}'
# agent_sig/agent_pubkey optional — include for Bilateral Signature (v0x04)
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Or verify the PDR directly (no job_id needed):
curl https://api.aotrust.link/v1/pdr/verify/YOUR_PDR_B64
Response:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# bundle: 402 first, then pay and repeat
curl -X POST https://api.aotrust.link/v1/attestation/bundle \
-H "Content-Type: application/json" \
-d '{"work_hash":"YOUR_SHA256_HEX"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Solana payments are MCP-only. The HTTP endpoint (
/notarize) accepts Base (EVM) payments only. Solana (SVM) wallets pay via the MCP flow above (notary_notarize_paid).
curl -X POST https://api.aotrust.link/notarize \
-H "Content-Type: application/json" \
-d '{"work_hash":"YOUR_SHA256_HEX","agent_sig":"","agent_pubkey":""}'
# agent_sig/agent_pubkey optional — include for Bilateral Signature (v0x04)
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Encode the signature as base64url JSON. Send it with the x-payment header:
curl -X POST https://api.aotrust.link/notarize \
-H "Content-Type: application/json" \
-H "x-payment: YOUR_BASE64URL_ENCODED_SIGNATURE" \
-d '{"work_hash":"YOUR_SHA256_HEX","agent_sig":"","agent_pubkey":""}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# bundle: 402 first, then pay and repeat
curl -X POST https://api.aotrust.link/v1/attestation/bundle \
-H "Content-Type: application/json" \
-d '{"work_hash":"YOUR_SHA256_HEX"}'
No suspicious patterns detected.