Build on the Trooth API.

Authenticate with a Bearer token. Every endpoint is tenant-scoped on every request. Webhooks fire on every state change. Keys are minted in your dashboard under API Keys, shown once, and revocable at any time.

Authentication is Bearer-token based. Rate limits are counted for each IP address rather than for each tenant, and they run two fixed windows at the same time, one by the minute and one by the hour. This site's own scan route allows 5 requests a minute and 20 an hour from one address (lib/rate-limit.ts, called by app/api/network/scan/route.ts). The ceiling the Trooth API applies to the direct /scan/run call above is set in the API service rather than here, so this page does not put a number on it. Trooth is free and has no plans, so no account carries a larger allowance than another. Keys are managed in your dashboard, created in one click and revoked on the next request. Webhooks are HMAC-signed.

Trooth's public trust layer is queryable by AI agents over the Model Context Protocol. The server is read-only and needs no key: it exposes published Trust Profiles, live outside-in surface reads, token verification, and Trooth's curated knowledge base, with the same provenance labels as everywhere else. Point any MCP-capable client at the endpoint below (streamable HTTP, single JSON response per POST, protocol 2025-06-18, server trooth-mcp 1.1.0). The block below is the mcpServers entry for Claude Code, Cursor and similar; Claude.ai and Claude Desktop take the same URL under Settings, Connectors, Add custom connector, and ChatGPT has Trooth Network as a listed app.

{
  "mcpServers": {
    "trooth": {
      "type": "http",
      "url": "https://api.trooth.co/public/mcp"
    }
  }
}

Tools: trooth_public_trust_profile (witnessed standing, pillars and evidence chain for companies that publish), trooth_outside_in_read (live TLS, security headers, security.txt for any public domain), trooth_verify (re-check a Trust Ledger Token and report it valid, expired, revoked or tampered), and trooth_ask (Trooth product and methodology questions). Each takes one required string argument (company, domain, token, question) and returns structuredContent with status, provenance, subject and summary alongside the text. The server also serves three markdown resources (trooth://methodology, trooth://provenance-labels, trooth://verify-a-vendor) and three prompts (vendor_trust_check, verify_trust_token, before_you_trust). Tool calls are rate limited per IP; tenant data is never exposed. The field-level contract and the agent pattern are on Agents and MCP.