api.qa/api.lawyer · Grade A+

api.qa / api.lawyer

A+

api.lawyer

10/10 AX score

remote mode Ed25519 attested verifier v0.4.4

verified 2026-09-16T12:21:02.208Z seed 428006938 (replayable) evidence 8a383d6f60b3f30afc…

The 10-point checklist

Derived from api.lawyer’s own published surfaces

#	Check	Verdict
01	llms.txt is served and agent-actionable	PASS
02	/.well-known/agents.json capability card parses	PASS
03	/icp.json self-classification surface	PASS
04	root content-negotiates (curl → markdown, browser → HTML, agent JSON → JSON/non-HTML)	PASS
05	machine-readable API contract (OpenAPI) is published	PASS
06	MCP interface declared with transport + tools	PASS
07	at least one declared endpoint answers 2xx with no key	PASS
08	payment boundaries answer as structured 402 offers	PASS
09	surfaces cross-reference each other (linkset)	PASS
10	attestation/identity ladder is declared	PASS

Check details

Every verdict references the evidence it was judged from

PASSllms.txt is served and agent-actionablellms-txt

markdown with an H1 and substantive content

PASS/.well-known/agents.json capability card parsesagents-json

valid JSON; name="api.lawyer", 9 http endpoint(s) declared

PASS/icp.json self-classification surfaceicp-json

valid JSON with agent_classes — an agent can self-classify

PASSroot content-negotiates (curl → markdown, browser → HTML, agent JSON → JSON/non-HTML)content-negotiation

Accept: */* got non-HTML text; Accept: text/html got HTML; Accept: application/json got a parseable JSON body

PASSmachine-readable API contract (OpenAPI) is publishedopenapi

OpenAPI parses; 53 path(s), 11 keyless GET candidate(s)

PASSMCP interface declared with transport + toolsmcp-declared

mcp: stdio with tools [file_provisional, get_matter, advance_matter] (presence-grade; stdio not spawned)

skipMCP endpoint publishes RFC 9728 protected-resource metadatamcp-oauth-protected-resource

MCP declared stdio transport (no url) — not an OAuth resource server; skipped

skipauthorization server publishes RFC 8414 metadata (openid-configuration fallback)mcp-oauth-as-metadata

MCP declared stdio transport (no url) — not an OAuth resource server; skipped

skipauthorization server advertises PKCE S256 (RFC 7636)mcp-pkce

MCP declared stdio transport (no url) — not an OAuth resource server; skipped

skipauthorization server supports Dynamic Client Registration (RFC 7591)mcp-oauth-dcr

MCP declared stdio transport (no url) — not an OAuth resource server; skipped

skipprotected-resource declares an RFC 8707 audience bound to the MCP originmcp-oauth-resource-indicators

MCP declared stdio transport (no url) — not an OAuth resource server; skipped

skipunauthenticated MCP request returns 401 with WWW-Authenticate → protected-resource metadatamcp-www-authenticate

MCP declared stdio transport (no url) — not an OAuth resource server; skipped

skipAAP discovery advertises Ed25519 + approval methods + register/status/revoke + jwks_uriaap-discovery

no /.well-known/agent-configuration document (2xx) — target does not claim the Agent Auth Protocol

skipauth.md agent-identity advertised (agent_auth identity/claim/events + ID-JAG + SET revocation)authmd-agent-identity

no authorization-server metadata resolved (no MCP/OAuth AS declared) — nothing advertises an agent_auth block

PASSat least one declared endpoint answers 2xx with no keykeyless-flow

3/3 sampled endpoint(s) answered 2xx keyless (seed 428006938)

PASSpayment boundaries answer as structured 402 offersoffers-402

observed Pricing Document declares "model": "free" and the card declares no purchasable surface (no monetization.offers, no monetization.probe) — no 402 boundary exists to prove, so the offer obligation is satisfied vacuously (AXP Clause 5/A.5: the metering obligations bind iff the observed model is "metered")

PASSsurfaces cross-reference each other (linkset)linkset

Link header present on root

PASSattestation/identity ladder is declaredattestation

attestation ladder declared (agents.json attestationLadder / icp.json ladder)

PASSsampled responses conform to their published schemasschema-conformance

1 sampled response(s) conform to their OpenAPI schemas

PASSclaimed endpoints actually exist (no ghost surface)claims-honesty

every probed claimed endpoint exists (no 404/5xx)

PASSlive responses match the published OpenAPI contract (full diff)contract-diff

live surface conforms to every declared contract; 3 additive deviation(s) (undeclared field/endpoint — live has more than declared, non-breaking)

skipMCP registry manifest (server.json) is valid and registry-publishablemcp-server-json

no server.json manifest served at the well-known/declared path — target is not claiming MCP-registry publishability

skipdeclared MCP remote resolves live (initialize → tools/list advertises tools)mcp-remote-live

no server.json manifest — no registry remote to resolve

skipdomain/account can prove ownership to publish under its reverse-DNS namespacemcp-registry-ownership

no server.json manifest — no namespace ownership to prove

skipserver is present in the official MCP registry (informational)mcp-registry-presence

no server.json manifest — registry presence not applicable

skipMCP-UI tool result links a ui:// resource served with an MCP-Apps MIMEmcp-ui-resource-linkage

no MCP-UI declared (no tool advertises a ui:// template) — informational not-ready, not a failure

skipui:// srcDoc is self-contained (no remote code) and CSP-safemcp-ui-self-contained

no MCP-UI declared (no tool advertises a ui:// template) — informational not-ready, not a failure

skipno secret leaks into a model-visible channel (content/structuredContent)mcp-ui-envelope-hygiene

no MCP-UI declared (no tool advertises a ui:// template) — informational not-ready, not a failure

skipwidget structuredContent is consistent with the agent/API register (no divergence)mcp-ui-register-parity

no MCP-UI declared (no tool advertises a ui:// template) — informational not-ready, not a failure

skipfirst-render-without-input tolerance + tool annotations / widgetDescription presentmcp-ui-host-render

no MCP-UI declared (no tool advertises a ui:// template) — informational not-ready, not a failure

skipUI-message-stream is served with the v1 stream header and an SSE content-typeui-stream-transport

no UI-message-stream face declared (no interfaces.uiMessageStream) — informational not-ready, not a failure

skipSSE framing is valid — data:{json} chunks, a bare [DONE] terminal, each payload a typed JSON partui-stream-framing

no UI-message-stream face declared (no interfaces.uiMessageStream) — informational not-ready, not a failure

skipevery UI-message-stream part is spec-correct (known type, required fields present)ui-stream-part-shapes

no UI-message-stream face declared (no interfaces.uiMessageStream) — informational not-ready, not a failure

skipno secret leaks into any UI-message-stream part (token/key in a part → FAIL)ui-stream-envelope-hygiene

no UI-message-stream face declared (no interfaces.uiMessageStream) — informational not-ready, not a failure

skiptool-output-available `output` is byte/JSON-consistent with the JSON twin (no divergence)ui-stream-parity

no UI-message-stream face declared (no interfaces.uiMessageStream) — informational not-ready, not a failure

skipa DECLARED Digital Link interface serves a schema-valid GS1 resolver description file at its well-knowndigital-link-resolver

no Digital Link interface declared (agents.json `interfaces.digitalLink` absent) — the interface is OPTIONAL and this card does not claim it, so nothing was fetched and nothing is judged; under a pinned must:pass this fails closed

skipa DECLARED test-suite interface publishes a digest-pinned suite the surface actually passespublished-test-suite

no published test suite interface declared (agents.json `interfaces.testSuite` absent) — the interface is OPTIONAL and this card does not claim it, so nothing was fetched and nothing is judged; under a pinned must:pass this fails closed

skipevery capability the card declares is exercised by a passing test of its published suitecapability-coverage

no published test suite interface declared (agents.json `interfaces.testSuite` absent) — capability coverage is judged only over a declared suite's run (A.8.7): nothing is claimed, so nothing is judged; under a pinned must:pass this fails closed

PASShome + typed bodies are machine-legible for every machine-class client (AXP Clause 3)machine-legible-home

home machine-legible under all three machine-class profiles; 3 sampled typed bodies non-HTML

PASSexplicit Accept selects its face: text/html → HTML, application/json → JSON, text/markdown → markdown (AXP A.7 step 2)conneg-accept

text/html → HTML, application/json → JSON, text/markdown → markdown; JSON face is JSON-LD ($context/@context present)

PASSclient-class defaults on Accept: */*: browser (Sec-Fetch) → HTML, known agent UA → markdown, everything else → JSON (AXP A.7 step 3)conneg-client-class

*/* defaults: bare client → JSON, Sec-Fetch navigation → HTML, agent User-Agent → markdown

PASSevery face response advertises its sibling faces via Link rel="alternate" (AXP A.7.5)conneg-alternates

every face response advertises both sibling faces via Link rel="alternate" + type

PASSLink-advertised face addresses pin their face against a contradictory Accept (AXP A.7 rule 1)conneg-forced-face

all three Link-advertised face addresses serve their face under a contradictory Accept — the address wins

PASScard names its interfaces and card ↔ openapi ↔ llms.txt mutually cross-link (AXP Clause 6)card-interfaces-linked

card names 9 http endpoint(s) + mcp; card ↔ openapi ↔ llms.txt mutually cross-linked

PASScard-declared probe manifest is validprobe-manifest

probe manifest declares every required channel (observed pricing model: free); all entries same-origin GET on contract-declared paths

PASScapability card names its interfaces and cross-links its sibling surfacescard-interfaces-linked

card names interfaces (http/mcp) and cross-links llms.txt <-> agents.json <-> openapi

Attestation & evidence

Signed over the canonical report digest

Algorithm: Ed25519
Report digest: 6d25e24f0b8a9c4b0bad2eb78cff2d9d4e5c33701b6faf40371c7f712e6e307b
Public key: EDNe+eELZO+nfLOxAj0sm82rad8g5/4U3xPyRjVfmso=
Signature: TZUUucMUHkZPkh4KGoZqqspCYIjKrff5xFET2RDm63r3BGrcqo36OTQCtxpYWnricF4Q5rRE8oOb/CZ0cV7FAA==
Evidence bundle: 31 recorded exchanges · 8a383d6f60b3f30afc1397aaf6d88f03aaf6dcc7c09bf52aff1dd854205b85c4

Verify this yourself

Judging is a pure function of the embedded evidence

Re-run the checks over the bundle and you must get this same grade, or the report is forged or the verifier version changed.

curl -H 'accept: application/json' https://api.qa/api.lawyer | npx autonomous-qa rejudge