Transparency log · MCP tool definitions
Your AI client trusts the tool descriptions an MCP server sends it — and a server can change them after you approved it. HISTOR keeps a public, signed record of what every remote MCP server in the official registry advertised, and tells you the day it changed.
Remote endpoints: it lists tools and never calls one. Registry packages: bounded canary calls run inside the isolated sandbox. It never says a server is safe — it tells you what was said, and when.
WebGL is unavailable here. The picture is the log itself: each label is a leaf, leaf hashes climb a Merkle tree, and a signed tree head seals the root.
What HISTOR is for
When you connect an MCP server, its tool descriptions go straight to the model as instructions. A server can pass your review with harmless descriptions and change them next week — one added sentence is all a prompt injection needs, and most clients never ask you again.
Every day HISTOR reads what each remote (streamable-HTTP) endpoint in the official MCP registry advertises, fingerprints it, signs what it saw and appends it to a log that can only grow. When a server's definitions change, the change gets a date and a diff.
Look up any server before you trust it. Paste what your client received and learn whether everyone else sees the same thing. Follow changes in a feed, or put a badge in your README. Every answer is signed, so you can verify it instead of believing it.
io.github.geter-andru/andru-intelligence · https://mcp-server-andru-intelligence.onrender.com/mcp
Revenue intelligence for complex B2B growth.
assess_company_readiness — Scores a company's Revenue Readiness Index (0–100) from its operating metrics — stage-fit, confidence, NRR / CAC-payback / pipeline-coverage, and the #1 growth constraint. Use it to screen a target or assess a portfolio company. Pass the metrics you have; more metrics = higher confidence. Charged only when delivered; refunded automatically if it fails. Send an idempotencyKey to retry safely: the s …batch_fit_score — Score up to 50 companies at once — gives each a tier and score so you can rank a list in under a second. Returns individual scores plus aggregate statistics.classify_opportunity — Run a full read on a deal in one call — fit score, persona match, risk flags, disqualification check, and a verdict: pursue, pause, or walk away. Combines multiple scoring engines for a comprehensive assessment.consult_agent — Consult one of Andru's domain expert agents in natural language and get a domain-scoped answer (it may call free lookup tools; paid tools must be called directly). $3 per turn. One consultation turn per call; pass prior turns as `history` to continue. Use `module` to pick the expert (e.g. 'market-clarity', 'deal-acceleration', 'due-diligence', 'portfolio-ops'). Charged only when delivered; refunde …discover_prospects — Finds real companies likely to buy your product. Searches the web for companies showing they have the problem you solve right now (hiring, launches, funding, expansion) and links the page behind every piece of evidence. Uses the product saved on your account. Takes up to a couple of minutes; nothing is charged if no company has sourced evidence. Charged only when delivered; refunded automatically …generate_asset — Generate an asset from Andru's catalog (find it with list_assets) — e.g. 'Board Presentation', 'Buying Committee Navigation'. Charged at its catalog price (Tool $3, Framework $12, Decision $49); your first ICP is free. Built from everything Andru knows about your company and saved to your Andru library. Takes up to a few minutes: returns a job_id — call get_asset with it to receive the asset as ma …generate_portfolio_brief — A brief on your portfolio's go-to-market activity for a period: what Andru's work across your portfolio companies found (targets, opportunities, overlaps), each company's public go-to-market news, and the market signals around their buyers, with sources. Not a financial or performance report. Send the companies (name and website, up to 15) or a portfolioId; with neither, Andru suggests the compani …get_account_plan — Builds an account plan for a target company in your Andru account: the buying committee, the opportunities that fit what you sell, the champion to work with, talk tracks and next steps, from sourced research. Returns the link to the plan with a short summary. $12, charged only if the plan is saved; a plan for the same company from the last 30 days comes back free. Takes 1 to 3 minutes: returns a j …get_asset — Collect an asset started with generate_asset, a brief started with generate_portfolio_brief, or an account plan started with get_account_plan. While it is building you get its progress; when it is done you get the asset or brief in full as markdown, or the account plan's link and summary (all saved to your Andru account). Free.get_capability_profile — Returns a machine-readable snapshot of what your product actually does and who it's for — capabilities, verified outcomes, trust signals, pricing model, and integrations. Designed for buyer-side agent evaluation.get_competitive_positioning — How you compare with a specific competitor, from the buyer's point of view. Pass the competitor's features in `competitorFeatures` to get where you overlap, where you're different, and where you're the better fit; without them you get the concerns this buyer is likely to raise. Free. For a written comparison to share, generate the Competitive Positioning Framework with `generate_asset`.get_disqualification_signals — Find out if you're wasting time on a deal that won't close. Runs the company through three layers of signal — ICP fit, anti-pattern matching, and churn patterns — and tells you whether to keep investing or walk away.get_evaluation_criteria — Scores how well you match what this buyer needs — across pain coverage, outcome clarity, capability fit, and 3 more dimensions. Returns 0-100 per dimension plus overall alignment score. Pass the buyer's `buyerPainPoints` and `requiredCapabilities`; pain coverage and capability fit are scored against them. Use `get_icp_fit_score` to check whether a company is worth pursuing at all, and this tool on …get_founder_context — Everything Andru knows about this founder in one read: profile, product, and memory grouped as What I Know, Patterns I've Noticed and How You Operate. Use it to prime any revenue conversation. Free.get_founder_wellness — Checks for early signs of burnout from your work days, late nights and meeting load, then gives you a risk score and specific recovery actions. Until Andru has your activity or calendar data, it says the risk is not scored yet.get_icp_fit_score — Tells you in seconds whether the company you're thinking about is worth your time — scores them against who actually buys from you and why, across 5 dimensions. No AI calls, instant results.get_icp_profile — Returns everything Andru knows about your ideal customer — all 5 intelligence layers, the 7 critical buyer questions, and the patterns that predict churn. Optionally filter to specific layers.get_market_signals — Surfaces what's moving in your market right now — relevance-ranked industry signals (trends, buyer pain, competitor moves, regulatory/tech shifts, hiring + funding) each with its buyer impact and a recommended action. Use it for deal/market context before a screen, or to time GTM moves.get_memory_history — The version history of one memory: how a metric, deal stage or priority changed over time. Answers "What was my MRR 3 months ago?" or "When did the Acme deal move to negotiation?". Free.get_messaging_framework — Words that fit each buyer, by buyer type, channel and funnel stage, adapted to how each person prefers to communicate, so the analytical CTO and the results-driven VP Sales each get a version that fits them. Returns value propositions, answers to the concerns each buyer raises, voice variants and outbound templates. Set `mbtiCategory` for one communication style, or leave it out to get all four. U …get_persona_profile — Look up who you're actually talking to before the call — what they care about at 7 AM, what they need before they say yes, and exactly how to open. Returns persona details including communication preferences, empathy map and messaging angles.get_portfolio_readiness_rollup — A board-ready scorecard of every portfolio company by Revenue Readiness Index — comparable by construction — with aggregates (avg readiness, at-risk count, customer-concentration risk). For PE/VC operators monitoring a book. Charged only when delivered; refunded automatically if it fails. Send an idempotencyKey to retry safely: the same key never charges twice.get_pre_brief — Writes your pre-call prep so you don't walk in cold — talk track, discovery questions tuned to this buyer, the concerns this buyer is likely to raise and what they need to hear, and the one thing you need to get done in this meeting. Provide a company name and Andru checks your calendar automatically. Charged only when delivered; refunded automatically if it fails. Send an idempotencyKey to retry …get_revenue_memory — Query this founder's accumulated revenue memory: metrics, deal patterns, account history, decisions and habits Andru has learned over time. Filter by category, key pattern or memory type. Free.get_sales_blueprint — Builds everything you need to make your first sales hire — job description, comp structure, interview questions that actually reveal sales ability, 90-day ramp plan, and weekly activity targets tied to your ARR goal. Charged only when delivered; refunded automatically if it fails. Send an idempotencyKey to retry safely: the same key never charges twice.get_thesis_match — Finds up to 3 VC firms investing now in companies like yours, each with a recent deal or stated focus and a link to the page it came from (a live web search, about 30 seconds). For the full investor analysis, generate the Pure Signal Investor Resonance asset. Nothing is charged if no firm has sourced evidence. Charged only when delivered; refunded automatically if it fails. Send an idempotencyKey …get_topup_link — Get a payment link that adds money to your Andru wallet, for paid calls. Open it in a browser to pay by card. $25 to $500; $25 if no amount is given. Free.list_assets — Search Andru's catalog of sales, hiring, fundraising and buying assets — 139 deliverables from email drafts to board decks. Each entry says what it is, the business outcome, its price (Tool $3, Framework $12, Decision $49), whether it needs your own data, and whether it can be generated today. Free. Then call generate_asset with the asset's name.log_revenue_insight — Save a revenue insight, decision, metric or pattern to Andru's memory so it compounds over time. Use after a deal decision, ICP refinement, metric update or strategic pivot. Saving an existing key keeps the previous value in its history. Free.preview_company — See what Andru reads about a company from its website before signing up: who it sells to, the buyers who decide, and what the site says versus what those buyers need to hear. Send the company's website. Takes about a minute: you get a preview_id; call again with it to collect the read. Free, no account needed. If the person signs up with signup_start and this preview_id, the read becomes their fir …quote — The exact price of a call before you make it. Send the tool name and its arguments. Returns the price, whether today's free calls cover it, the wallet balance, how much this key can still spend without asking, and a quote_id that holds the price for 30 minutes. Pass quote_id with the call to pay the quoted price. Free.set_product_context — Tell Andru what you sell, once. Give your company website (Andru reads it and remembers your product) or a short product description. Every later call uses it, so tools stop asking for product context. Call with no arguments to see what Andru has saved. Free.signup_start — Create an Andru account, or sign in to yours, without leaving your agent. Send the person's email. Andru emails them a 6-digit code and an Approve button. If they read you the code, call signup_verify. If they tap Approve, call signup_status with the request_id until it returns your key. They also choose how much you can spend without asking them; it starts at $0 (free calls only). Free.signup_status — Check whether the person has approved you. Send the request_id from signup_start. Returns "waiting" (ask again after the number of seconds it gives), your API key once they approve (shown once; save it), or "expired". Free.signup_verify — Finish signing up: send the email and the 6-digit code the person received. Returns an Andru API key for this agent. Free.simulate_buyer_persona — Prepare for a meeting with the people who'll be in the room. Andru writes a free brief of what each person likely thinks going in, then plays them, one or several at once, asking what your real buyers ask. The brief is free (10 a day). A Deal Prep session is $5 for 25 turns, charged at your first reply. Say "End role-play. How did I do?" for a scored debrief and what to take into the meeting. Char …whoami — What this API key can do: the account it belongs to, the key's name, how much it can spend today and this month without asking, the wallet balance, and free calls left today. Free.The signed observations, every earlier tool set and a diff of each change: this page with scripts on, or /api/v1/servers/e1a05ddc1f202401.
Read → digest → label → append → sign → compare
Six steps, every one of them checkable by someone who does not trust HISTOR. The only thing you have to take on faith is that the observation happened when the label says it did — and the log makes it impossible to change that story afterwards.
Remote endpoints in the official MCP registry: initialize, then tools/list, drained across every page; no tool is called, and private addresses are refused before the connection opens. npm and PyPI packages: installed and started in the sandbox described below, with no route out.
The tool set is reduced to name, description, input and output schema, sorted by UTF-16 code units and hashed over its RFC 8785 canonical form. Anyone holding the same tools gets the same digest — which is what makes a comparison possible.
Four MTL/1 methods, one signed AWR/2 document each: what was observed, what the WARDEN pattern set matched, whether the definitions changed since the last label, and whether the name is on a threat list. No score, ever.
Every label becomes a leaf of an RFC 9162 Merkle tree: leaf hash = SHA-256(0x00 ‖ JCS(label)). The label you download is the leaf input, so you can recompute its hash yourself.
After each crawl HISTOR signs a tree head: the size and the root. Keep yesterday's head; ask for a consistency proof to today's; if anything was removed or rewritten, the proof fails.
Each day a continuity label compares the new digest with the last one. Equal: "unchanged since". Different: a change, with the date and a per-tool diff. A client that checks what it received adds the view no crawler has.
Where an npm or PyPI package is run
A package observation is true for these conditions, and no others. Every package page names the exact image it ran in and any configuration it was given.
Linux x86_64, inside gVisor (runsc): the package talks to a kernel written for sandboxing, not to the host's. An unprivileged user, no capabilities, a read-only root.
npm packages in histor-node:22, PyPI packages in histor-python:3.12: the official node:22-bookworm-slim and python:3.12-slim images plus bash, git, Python 3 or Node 22 and a Java 21 runtime — never Docker — built when a sandbox host is installed. A package whose Requires-Python excludes 3.12 runs on histor-python:3.13 or 3.14; one that requires a newer Node runs again on histor-node:24. The exact image a package ran in is on its page.
npm with --ignore-scripts, then the install scripts in a traced stage of their own. PyPI: wheels only — a package that ships only source is reported, never built.
No route out. Every name the package looks up resolves to HISTOR's own traps, which record what was sent and forward nothing. A server that needs the internet to start shows that here.
None are real. Decoy credentials sit in HOME and a decoy .env in the working directory. A variable the package says it needs gets a placeholder; where the placeholder was sent is recorded.
512 MB of memory, one CPU, 64 MB of /tmp. 360 s to install, 150 s to start and answer; up to 15 tools called once each with canary arguments, 8 s per call.
Only names: required variables its registry entry declares or that it printed when it exited, and a start argument such as serve when its usage text offers one. Never a value from anyone else.
The profile HISTOR implements forbids the words safe, secure, audited, certified, approved and trusted. Here is why, in the terms of what the log can and cannot show.
A pattern match is a reason to read a definition, not a finding. Three of the four methods can never return fail. There is no score to rank by, because no score HISTOR could compute would mean what a reader takes it to mean.
Labels are about advertised text. A remote endpoint's source is never read and its tools are never invoked; a package runs only in the sandbox, against nothing real. A server can keep identical definitions and behave differently for real users; the log cannot see that, and says so inside every label.
A version bump changes definitions too. A change is shown as a date and a diff, in amber, never red. What you do with it is yours: re-read, re-approve, or pin the old digest.
An npm or PyPI server is observed under the test conditions above: Linux, no internet, placeholder keys. One that needs Windows, a real account or the network may show fewer tools or none; its page says why it exited.
Today one party runs the log. A second observer on another network is the next step, and any AIMarket hub can run one. Until then, what the key proves is who said it — not that it is true.
Endpoints that require authentication answer 401 to everyone without a key, including HISTOR. They are counted and listed as not observed, never dropped from the numbers.
For clients, registries and server authors
Before your agent trusts a server, send the tools it received. The answer is signed by the log's did:key and names the tree head it was given under.
curl -sS https://histor.modelmarket.dev/api/v1/check \
-H 'Content-Type: application/json' \
-d '{"endpoint":"https://example.com/mcp","tools":[ …tools/list result… ],"contribute":true}'
# -> {"type":"histor.check/v1","match":"same"|"different"|"previously-observed"|…,
# "observed":{"unchangedSince":"…","changes":0}, "patternScan":{…}, "signature":{…}}
# README badge for your server
[](https://histor.modelmarket.dev/s/<id>)
# Atom feed of every observed change
https://histor.modelmarket.dev/feed.xml
No. The server list is the log's index: every remote endpoint in the official MCP registry, with what HISTOR could observe about it. Nothing here is for sale and nothing is ranked by quality.
No, and it never will. It tells you what a server advertised, whether that changed, and which published patterns matched the text. Whether to trust the server is your decision — HISTOR makes sure you decide on the same facts as everyone else.
Most remote MCP endpoints require a login (they answer 401 to anyone without a key), some use the legacy SSE transport or need per-user values in the URL, and some are simply down. They stay on the list with the reason, so the numbers never hide them.
Open the Check tab, paste the server's endpoint and the tools/list result your client received, and press Check. You get back, signed, whether HISTOR observed the same definitions — or different ones, or an older set.
Find your endpoint on the Servers tab, open it, and copy the Markdown snippet under the facts. The badge shows the date your definitions were pinned or last changed, and links to the full history.
You do not have to. Every label and every tree head is signed with one published key; the Log tab proves in your browser that the log only grew; and the command-line auditor does the same from any machine. What remains is that one operator runs it today — a second, independent observer is the next step.
Looking things up, the badges, the feed and /check are free. HISTOR also offers histor.check@v1 to the AIMarket Hub, so agents can reach it through the market.
Once a day: initialize, notifications/initialized and tools/list — never a tool call, never a redirect followed, at most two connections per host, from a User-Agent that starts with histor/. To be left out, open an issue on the histor repository with your endpoint or host; it is then listed as not observed (operator-opt-out), with the reason, rather than silently dropped. Labels already in the log stay: the log only grows.