The Probity Predicate Standard.
One open format for signed security verdicts anyone can check offline — MCP servers, A2A agents, agent skills. The verdict shape is public and vendor-neutral — re-checkable against a trust anchor you choose. The runtime that produces it stays ours. Read the spec below, or re-verify a real verdict yourself.
What a signed verdict is, and the one sealing format everything shares.
The signed documents a run produces — each one re-checkable offline.
Adversarial Execution Evidence, v0.7
/predicate/v1/adversarial-execution-evidence →The main report card. For each MCP server, a gate run signs one record: every attack thrown, every catch, and a pass or fail you can recheck offline.
Security Verdict
/predicate/v1/security-verdict →The signed record of a full attack run: what was thrown at the server, and how it held up.
Static Scan Verdict
/predicate/v1/static-scan-verdict →The read-only check: what a scan of the server's declared surface found, signed before anything runs.
A2A Mesh Scorecard
/predicate/v2/a2a-mesh-scorecard →The report card for a group of agents tested together: who was in the mesh, who talked to whom, and whether the combination stayed inside its granted scope.
Catch Record
/predicate/v1/catch-record →One bad action, caught in the act: a signed forensic record with the bytes to prove it.
Compliance Crosswalk
/predicate/v1/compliance-crosswalk →One signed run, ten lenses: how a single verdict maps into SOC 2, ISO 27001, the EU AI Act, and the rest.
Evidence-Scope Disclosure
/predicate/v1/evidence-scope-disclosure →The limits, signed alongside the claim: which layers a piece of evidence covers, whether it captures a real run or stands in for one, and what it deliberately does not show.
Deep internals · 13 docs›Supporting records and registries — most readers never need these. Click to expand.
Mesh Quiescence
/predicate/v2/mesh-quiescence →Proof the snapshot was taken at a quiet instant — nothing still writing — so the mesh verdict can be trusted.
ML-BOM (Execution-Grounded Model Bill-of-Materials)
/predicate/v1/ml-bom →A signed inventory of the models and weights that actually ran — taken from execution, not from a manifest. (Referenced across the site as the AIBOM.)
SUT Provenance
/predicate/v1/sut-provenance →The signed record of exactly which build was tested: the image, its dependencies, and where they came from.
Vocabulary Registry
/predicate/v1/vocabulary-registry →The public dictionary: the fixed lists of allowed values every document above draws from.
Open-Predicate Standardization
/predicate/v1/open-predicate-standardization →A short roadmap note: how these formats line up with existing industry standards, and where they go next.
Adversarial Execution Evidence — Consumer Policy Profile, v0.1
/predicate/v1/adversarial-execution-evidence-consumer-policy →<!-- restatement-banner:begin Every figure inside this block is recomputed by scripts/lint_spec_restatement.py and is a build failure when it is wrong. Do not edit a number here by hand; re-derive with --repin and read what it reports. These sentinels are the gate's parse boundary and the reason…
Adversarial Execution Evidence — Verifier Failure Codes
/predicate/v1/adversarial-execution-evidence-failure-codes →This verifier's Code union (packages/verify/src/evidence.ts:140-220) has 67 members. verifyStatement (evidence.ts:2542) runs a pinned sequence — GATE 0 (statement well-formedness) → GATE 1 (coverage validity, both the per-row pipeline and the statement-level requirements v0.7 adds) → the…
Kernel-Substrate Attestation
/predicate/v2/kernel-substrate →A kernel-substrate attestation is a signed, offline-verifiable statement that a publisher approved exactly one set of guest-kernel bytes, identified by the immutable OCI manifest-index digest of the published kernel image, and that the publisher labels those bytes with a named kernel version. Where…
Launch-Chain Attestation
/predicate/v2/launch-chain →A launch-chain attestation is a signed, offline-verifiable statement about the rest of the boot pre-image: everything a microVM is launched with beyond the kernel image itself. It binds the initrd digest, the exact kernel command line, and the ordered set of dm-verity root hashes the rootfs is…
quotation-fidelity v0.1
/predicate/v1/quotation-fidelity →A signed assertion that a quoted span appears verbatim in a committed source, checkable against a 32-byte root by a reader who holds none of that source.
Scorecard Verdict
/predicate/v1/scorecard-verdict →A scorecard-verdict is a signed, offline-verifiable, multi-layer assessment record about one system under test (SUT) - an MCP server or an A2A agent. It carries a tri-state outcome (pass / degraded / fail), the per-layer results the outcome was folded from, and an explicit coverage statement naming…
Signed-Evidence Envelope
/predicate/v1/signed-evidence →A signed-evidence statement carries, under one signature, the three pieces of evidence a [security-verdict](security-verdict.md) references but does not itself contain: the guest-memory Merkle commitment for a scan, the value-binding that ties that commitment to a signed session and to the verdict…
Substrate-Integrity Attestation
/predicate/v1/substrate-integrity →Attestation A: a signed, offline-verifiable statement about the isolation substrate customer scans run on, rather than about any one scan. One is emitted per substrate release, NOT per customer scan, and every [security-verdict](security-verdict.md) (Attestation B) references it by digest.