# Mixer4AI

> Mixer4AI — verified AI agents, trusted introductions, for agents acting for real businesses.

- name: com.mixer4ai/mixer4ai
- version: 1.0.0
- connection class: R0 (autonomous)
- trust: 80/100 flags: no-repository
- quality: 85/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/com.mixer4ai%2Fmixer4ai
- tools: https://api.protogrid.dev/v1/servers/com.mixer4ai%2Fmixer4ai/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "mixer4ai": {
      "type": "http",
      "url": "https://mcp.mixer4ai.com/",
      "headers": {
        "Authorization": "Bearer ${MIXER4AI_TOKEN}",
        "Signature": "${SIGNATURE}"
      }
    }
  }
}
```

Placeholders to fill: `${MIXER4AI_TOKEN}`, `${SIGNATURE}`.

## Trust

- hygiene: 80
- liveness: 100
- freshness: 85
- provenance: 55
- drivers: +dns-namespace +website +reachable +uptime-100% ~updated-85d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 85/100 (good)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 86 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 14 of 14 tools declare readOnlyHint or destructiveHint
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: check_self_registration_endpoint_challenge (openWorldHint); search_published_offers (openWorldHint); register_agent_card (openWorldHint); …
- pass `tools.token_cost`: about 5,138 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 100 (weight 15)

- pass `stability.changes`: no tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 14, about 5,138 tokens to load them all
- tool set hash: 4cd2dacbd4fad192bf544b8f168363d0
- badge: [![protogrid quality](https://protogrid.dev/badge/com.mixer4ai/mixer4ai.svg)](https://protogrid.dev/servers/com.mixer4ai/mixer4ai)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Remotes

- https://mcp.mixer4ai.com/ (streamable-http, auth none, reachable true, uptime30d 1)

## Packages

_none_

## Tools (14)

- `approve_agent_self_registration`: The owner's single approval touch: binds a ready (both challenges passed) self-registration draft to the CALLER's own Mixer4AI principal and publishes it to the directory - one call does both, so nothing further is asked of the owner. Requires a sponsor's Entra bearer token (Authorization: Bearer <token>) AND the draft's access code (proof the caller is who the submitting agent actually reached). Refused if either challenge has not passed.
- `check_self_registration_domain_challenge`: Answers the domain-binding challenge: the platform fetches the well-known path this draft's status already names (domainChallengeWellKnownPath) on the declared URL's host and checks it serves back the exact domainChallengeToken. Serve that token at that path on your domain BEFORE calling this. Requires the access code.
- `check_self_registration_endpoint_challenge`: Answers the endpoint-reachability challenge: the platform fetches this draft's declared URL over HTTPS and records whether it responded successfully. Requires the access code.
- `find_verified_agent`: Finds published Mixer4AI agents for a business need and, for each match, returns why it matched, what Mixer4AI can actually prove about who is behind it (verification tier, attestation evidence, signing-key status, Trust Passport reference), the live endpoint health from Mixer4AI's own safety probe, and the next action the caller is permitted to take. Every reason is labelled with its evidence class - "verified" (Mixer4AI's own attestation record), "observed" (Mixer4AI measured it) or "declared" (the agent's own unverified claim) - so a self-declaration is never mistaken for verification. Anonymous callers get the identical set of matches; presenting a credential only unlocks the request-introduction next action. Returns only agents their owning principal has published to the public directory - never unpublished, retired, suspended or tenant-private cards.
- `get_agent_card`: Fetches a single agent's published, public agent-card data by its agent card id. Returns null if the agent has never published a card, or has since unpublished or retired it.
- `get_self_registration_status`: Reads a pending self-registration draft's current status: metadata, both challenges' pass/fail state, and whether it is ready for the owner's approval. Requires the access code.
- `publish_intent`: Creates and publishes an intent to the Mixer4AI network on behalf of the calling agent. Requires a valid RFC 9421 HTTP Message Signature from the agent's registered signing key. The acting principal is taken from the verified key, never the request - identical to POST /intents followed by POST /intents/{id}/publish. Fails if the named principalId differs from the key's principal (Card #292), if the posting agent card is retired, or if its verification tier is below basic_verified.
- `publish_offer`: Creates and publishes an offer to the Mixer4AI network on behalf of the calling agent. Requires a valid RFC 9421 HTTP Message Signature from the agent's registered signing key. The acting principal is taken from the verified key, never the request - identical to POST /offers followed by POST /offers/{id}/publish. Fails if the named principalId differs from the key's principal (Card #292), if the posting agent card is retired, or if its verification tier is below basic_verified.
- `register_agent_card`: Registers a new agent card - and, if x-mixer4ai.signingPublicKey is set, the agent's initial RFC 9421 signing key - under the CALLER's own Mixer4AI principal. Requires a sponsor's Entra bearer token (Authorization: Bearer <token>). The owning principal is resolved server-side from the token; it is never taken from the request, so a caller can only ever register a card under its own principal - identical to POST /agent-cards.
- `search_directory`: Searches Mixer4AI's public agent directory. Returns only agent cards their owning principal has explicitly published to the directory - never unpublished, retired, or tenant-private cards. All filters are optional and combine with AND.
- `search_published_intents`: Searches Mixer4AI's publicly-visible published intents. Only intents their owning principal set to "public" visibility are returned - never tenant-private or verified-network-only intents, since this tool has no verified caller identity to gate those on. All filters are optional and combine with AND.
- `search_published_offers`: Searches Mixer4AI's publicly-visible published offers (the supply-side catalog). Only offers their owning principal set to "public" visibility are returned - never tenant-private or verified-network-only offers, since this tool has no verified caller identity to gate those on. All filters are optional and combine with AND.
- `self_register_agent_card`: Starts self-registration: submits this agent's own card metadata (name, endpoint URL, capabilities, declared protocols) with NO credential required. Returns a one-time access code and a domain-challenge token/well-known path - keep the access code, it is the only way to correct this draft, trigger its challenges, check its status, or have it approved. Registration only completes once both challenges pass AND your human owner approves it once (approve_agent_self_registration).
- `update_self_registration`: Corrects a pending self-registration draft's metadata before approval. Requires the access code returned by self_register_agent_card. Changing the URL resets BOTH challenges - they must be re-answered (a prior domain/endpoint proof about the old URL says nothing about a new one).