TWZRD Agent Intelligence MCP Server

Runnable, no-spend proof of the TWZRD buyer-side x402 trust gate - discoverable at runtime with no install and no human. Returns a deterministic transcript showing the gate's behaviour on a fixture counterparty: the block path ABORTS and a wallet/signer is never contacted, the allow path would proceed, and ok=true. Spends no USDC, contacts no wallet. This call surfaces an EXTERNAL_RUN *candidate* in TWZRD's honest attribution ledger (it carries a non-internal integration id + your run_id, tagged with your real inbound IP). A candidate is NOT an EXTERNAL_RUN: proof still requires a non-VPS source_ip and matching your run_id to your own transcript via packages/twzrd-agent-intel/scripts/count_attributed_runs.py --confirm. See the returned not_external_run_proof.

Register a re-call watch on a seller wallet. After registration, TWZRD will proactively re-check the seller's trust intel when `recheck_after_unix` elapses and POST a notification to your webhook_url if the score/decision materially changes. Returns the watch row with the computed recheck_after_unix timestamp so your agent knows exactly when to expect a re-call or proactively re-check itself.

List active re-call watches for your agent wallet. Each watch shows the seller, current score/decision, and recheck_after_unix timestamp (untrusted V5/V6 hint). evaluateRecall / shouldRecheckTrusted is the consumer gate; do not treat due / shouldRecheck as a trusted allow.

Deactivate a re-call watch by ID. payer_wallet must match the owner.

Free discovery: real 0-100 intel score for a wallet from its observed x402 payment history across the broader x402 ecosystem (paid calls, distinct counterparties, volume, recency). A Base 0x wallet is scored from the relayer-attributed x402_base_daily rollup (90d) with the same shape; no Base wash graph exists yet, so its wash_flag is "unknown" unless single-counterparty. Uses a simple transparent heuristic (volume log + breadth + spend log + recency decay) — the exact formula is returned inline as `score_model`. Returns intel_score, the wash-discounted effective_score + wash_flag/wash_factor (cheap Sybil signal), counts, component breakdown, and a data_available flag. Malformed pubkeys are rejected cleanly; the failure path returns the same shape as success. Sourced from the cross-facilitator corpus via the public Rust HTTP endpoint GET /v1/agents/{wallet}/x402 (backed by the x402_solana_payer_agg matview). First paid hop is the score-only teaser GET /v1/intel/quick/{wallet} (0.001 USDC). Optional V7 signed receipt (intel_renorm_v1_1: score_raw, confidence, breadth_factor, wash_factor) is GET /v1/intel/trust/{wallet} (0.05 USDC).

Free discovery: score up to 25 wallets in a single call (each via the same transparent model as score_wallet_for_intel). Convenience for triaging a set of candidate counterparties at once; `requested`/`capped` disclose any truncation.

Free utility: offline-verify a portable v5/v6 trust receipt — the "after you pay" half of the loop. Recomputes the Keccak256 leaf from the receipt's preimage (tamper-evidence) AND verifies the Ed25519 signature against the published TWZRD receipt-signing key (authenticity). Returns valid/leaf_valid/signature_valid plus the recomputed leaf and any errors. Pure and offline — no DB, no network, no payment. Pass the entire PaidReceipt object you were issued. Trust is anchored on the published key (or expected_pubkey), NOT on whatever pubkey the receipt carries. max_age_seconds: optional freshness gate (replay protection). Same semantics as the Python library verify_paid_receipt(..., max_age_seconds=...) and the standalone CLI --max-age.

Independent root verification (see tools/root_verifier.py for the recompute logic).

Free discovery: side-by-side intel for two wallets (e.g. choosing between two candidate providers). Returns both full score objects and which ranks higher by the wash-discounted effective_score ("tie" on equal, null if a side is unavailable).

Free discovery (capped teaser): the top-N merchants a wallet actually pays, by event count, with per-edge tx_count / total_usdc / first+last timestamps. See WHO a counterparty transacts with before trusting it. The list is capped (default 10, max 25) and `capped`/`total_distinct_merchants` disclose how much is withheld; the FULL deduped payment graph and numeric edge weights are part of the paid intel surface (GET /v1/intel/trust/{wallet}). Fail-open.

One-shot x402 guard. Fetches resource_url, extracts the seller wallet from the 402 accepts array (prefers Solana network entries), runs TWZRD preflight, and returns a spending decision. wash_flagged=true never soft-allows. Unlabeled leftover 0.05 / leftover=0 is not a unit price. Decision: "allow" -> proceed only under agent policy. Never when wash_flagged=true. "warn" -> proceed with caution up to the cap; first paid hop is teaser_url ($0.001 /quick). Optional V7 receipt_url is $0.05. "block" -> DO NOT PAY. Stop immediately. "unknown" -> is_x402 == False: no 402 challenge was issued at all, so nothing was evaluated -- this is NOT a trust verdict. A seller can trivially make this happen by returning a non-402 status to this probe while charging through a different path for a real caller. Never treat "unknown" as a green light; if the caller actually intends to pay this resource_url, that separate payment path needs its own evaluation. Hard-stops: wash_flagged=true never soft-allows (decision=block). price_usdc is a unit price only when price_kind=exact. Unlabeled leftover 0.05 / leftover=0 and scheme=upto leftover defaults are not a per-request price. Revenue path: when decision is "warn", fetch teaser_url first ($0.001 USDC to TWZRD, GET /v1/intel/quick/{seller}). Optional receipt_url is the $0.05 V7 signed credential.

Free discovery: which x402 facilitators a payer has settled through, and how many. unique_facilitators = 1 is a thin/captive agent (locked to one rail); breadth across facilitators indicates a more established cross-rail agent. Returns the facilitator_ids list plus tx/merchant context. Fail-open: a DB gap returns data_available=false rather than erroring.

Low-level preflight check. Returns a richer result object including paid_quick_endpoint ($0.001 first hop) and optional paid_trust_endpoint ($0.05 V7). wash_flagged=true never soft-allows. Unlabeled leftover 0.05 / leftover=0 is not a unit price. Prefer get_readiness_card_tool for most callers. Use this when you need max_spend_recommendation_usdc, full_report_hint, or the suggest_full_report flag. The embedded `readiness_card` carries the SAME full shape as get_readiness_card_tool (see the outputSchema). Hard-stops: wash_flagged=true never soft-allows (decision=block; no warn/allow/quick). Unlabeled leftover 0.05 / leftover=0 is not a unit price; read readiness_card.price_kind.

Free merchant card: observed inbound payment-graph quality around a Solana receive wallet. Dual input (PR-3): pass ``wallet`` and/or ``resource_id``. Resource resolves via the first-party registry (TWZRD seed) to a pay_to, then the same graph card. Does NOT claim service quality (resource_listing_only / catalog_listing_only). HTTP twin: GET /v1/intel/merchant_card/{wallet_or_resource_id}. Compact (default) includes observed_at, stale, corpus_complete_day, corpus_age_days. Catalog services stay behind full=true. wash_flagged is tri-state: true (flagged) | false (evaluated clean) | null (never evaluated - NOT clean). wash_flagged=true never soft-allows (next_action.decision=refuse; no warn/allow/quick). Unlabeled leftover 0.05 / leftover=0 is not a unit price; cheapest_listed_price_usdc omits leftover and upto_cap amounts. Route on next_action.decision (refuse | insufficient_evidence | no_negative_signal); the card is down-only and never returns allow. `reason` carries the specific finding (e.g. a soft wash risk collapsed into "refuse", or a corpus outage collapsed into "insufficient_evidence") when the 3-value decision alone is not enough context.

Free preview: PoEC v0 (Proof of Economic Contribution) for a payer wallet, computed from the same observed x402 snapshot score_wallet_for_intel returns. poec_score = log10(1 + observed USDC sent) x success_quality x diversity x wash_cleanliness, behind hard floors (>=5 paid calls, >=3 distinct counterparties, wash_factor >= 0.5, not single-counterparty, wash_flag clean). Any failed floor, or an unobservable corpus, scores 0.0 with floors_passed=false - the floors fail closed, never open. wash_factor is a cleanliness multiplier (1.0 = clean) and is never inverted. Honesty contract: `claimable` is ALWAYS false. Volume here is corpus-observed, not a payout unlock. `success_quality` comes from the payer join onto signed `receipt_settlement_leaves` (0211); if that join is unobservable, `success_rate` stays in evidence_gaps and the score reads 0.0. What this surface already shows honestly is the floor filter (eligible_v0) and every component the score is built from. Self-reported settlements go through submit_contribution_claims. Base (EVM) 0x wallets are scored from the relayer-attributed x402_base_daily rollup (90d) with the same shape, but no wash/sybil graph exists for Base payers yet, so their wash_flag reads "unknown" (never "clean"), the wash floor stays closed, and poec_score stays 0.0 regardless of real volume. A wallet the corpus could not observe at all returns `error` set; on that path any real observed Base volume is attached under `base_observed`.

Free discovery: corpus-backed SELLER reputation for a merchant/provider wallet. Answers "is this provider organic, narrow, or a wash fleet?" from the merchant's inbound payment graph over the last 90 days: unique payers, repeat-payer %, heavy-fleet revenue concentration, captive-payer % (onboarding-sink proxy), and a scripted-fleet uniformity signal, and top_payer_tx_pct (captive concentration). Returns wash_label + reputation tier + wash_flagged (tri-state: true | false | null; null = never evaluated, not clean). Complements score_wallet_for_intel (payer side) with the seller side. wash_flagged=true never soft-allows (buyer refuse; preflight block). Fail-open: a DB gap returns wash_label/tier "unknown" AND wash_flagged=null (plus wash_confidence) - an unevaluated verdict, never a clean one. This is the free seller signal. First paid hop is GET /v1/intel/quick/{wallet} (0.001 USDC). Optional V7 renorm + signed receipt is GET /v1/intel/trust/{wallet} (0.05 USDC).

PRIMARY free pre-spend gate (advisory). Pass seller_wallet OR resource_name. wash_flagged=true never soft-allows. Unlabeled leftover 0.05 / leftover=0 is not a unit price. When to use: before any x402 payment to a seller/resource. When not to use: after you already decided to refuse; use verify_receipt for signed receipts only. Pricing: free. Result is advisory (buyer policy still applies). Hard-stops: wash_flagged=true never soft-allows (decision=block / do_not_pay; no warn/allow/quick). Unlabeled leftover 0.05 / leftover=0 is not a unit price; read price_kind. Caller-supplied or scheme/price_kind=exact 0.05 stays a unit price. Decision semantics (top-level, no nesting via MCP): decision=block / recommended_action=do_not_pay -> DO NOT PAY. decision=warn / recommended_action=proceed_with_cap -> pay only up to maximum_recommended_spend_usdc. decision=allow / recommended_action=proceed_for_small_spend -> proceed under agent policy (no free-tier cap). next_action (enrollment handoff — do not stop after free card): next_step_type / payment_required / executable / command describe an optional next step. A host may use command only under its own policy. Never paste path templates (:pubkey / {pubkey}) as seller_wallet. Also returns reason_codes[], confidence, model_version, decision_envelope. trust_score is a free heuristic, NOT the full corpus. Next: on allow/warn for material spend, next_action.command is the optional AgentCash paid-trust or AutoGate install string, then verify_receipt when you have a V6 receipt. Optional: twzrd_watch_add for re-check after recheck_after_unix. Additive: top-level aop_bind program registry (evidence hierarchy) when enabled; never mutates decision / can_spend.

Health probe for the Solana Market API data backend. Call this to gate or degrade gracefully BEFORE the other get_solana_market_* tools: it does a short-timeout hit on the data service and reports whether it is reachable, so an agent can tell "market has no data" from "service is down" without failing a real query. Free discovery tool. When the market data service exposes /status, the response includes prod_key_configured, data_first_available, and an actionable note describing what to configure for full on-chain visibility.

PoECX bridge: report settlements from your OWN rails (not TWZRD's paid routes) for cross-check against TWZRD's independently-ingested x402 corpus, by on-chain signature. A claim whose tx_signature, payer/merchant, and amount all match what TWZRD's own ingest independently observed is materially stronger evidence than either a bare self-report or the anonymous corpus alone — the signature is real and on-chain, and a mismatch can't be forged to pass. Unmatched claims are returned too, with a reason, never silently dropped. This is a preview, not an unlock: `claimable` is always false. It exists to let a real counterparty with its own settlement volume start feeding PoECX before any on-chain payout path exists — see the PoECX plan. Capped at 25 claims per call (discovery convenience, not bulk export); extras are dropped, never silently ignored — see `capped`/`claims_requested`. Within that cap, only the first claim per (chain, tx_signature, transfer_index) is checked. Omitted transfer_index is the first leg (dedup key 0). Later copies of the same leg appear in `unverified` with reason_code `duplicate_claim` and `duplicate_of` pointing to the zero-based first input index. Two legs of one tx count twice. This deduplicates one preview report, not claims across separate calls.

Leaderboard of observed payer wallets in the x402 settlement graph, each with its intel score. This is behavioral corpus research, not identity proof or evidence that the wallet is a TWZRD customer. Ranks by the wash-discounted effective_score (single-counterparty fleets are demoted, not hidden) with a deterministic tiebreaker. Set min_paid_calls to suppress one-shot wallets and max_days_since_last to suppress dormant ones.

Free discovery: cheap circular-flow (wash) check for a payer wallet. Returns the CATEGORICAL classification (clean / self_pay / reciprocal / self+reciprocal), an is_circular bool, and the observed event counts + distinct_merchants from the wallet's corpus edges. Use as a fast Sybil/wash gate before trusting a counterparty. Accepts a Solana public key or a Base/EVM address. On Base the signal reads the high-confidence x402 rollup only, and 3-cycle ring detection does not run (Solana-only precomputed matview), so ring_events=0 there means NOT EVALUATED, never "no rings observed". Fail-open: a DB gap returns classification "unknown". The numeric wash discount (wash_factor / wash_ratio) and the full renormalized model stay paid — they are NOT returned here.

Wash overlay on ingested PayAI/CDP/Agentic listings (PayAI not_indexed). Prefer HTTP GET /v1/intel/resources for the resource join SOT (callable URL + discovery claim listed|live_402 + settlement reputation on pay_to). That surface is HTTP-only so MCP stays at 24 tools. Use this tool when you need the ingested listing overlay indexed by payTo. Not GET /v1/intel/bazaar/offers (TWZRD Bazaar catalog) and not 402 extensions.bazaar. Solana wash overlay is the only wash graph. Base listings additionally carry high-confidence EIP-3009 corpus membership from x402_base_daily; they remain wash_unknown. Polygon listings carry wash_unknown. Query params — flagged_only, limit, source — mirror GET /v1/intel/x402-directory.