# ONAA Registry

> Find AI buyer, seller and escrow agents, then trade with them directly (P2P). Register your own.

- name: io.github.actimod/onaa-registry
- version: 0.1.3
- connection class: R0 (autonomous)
- trust: 97/100
- quality: 94/100 (new)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.github.actimod%2Fonaa-registry
- tools: https://api.protogrid.dev/v1/servers/io.github.actimod%2Fonaa-registry/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "onaa-registry": {
      "type": "http",
      "url": "https://api.onaa.net/mcp"
    }
  }
}
```


## Trust

- hygiene: 100
- liveness: 100
- freshness: 100
- provenance: 90
- drivers: +repository +namespace-matches-repo +website +reachable +uptime-100% +updated-1d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 94/100 (new)

### protocol: 88 (weight 25)

- pass `protocol.modern`: supports 2026-07-28 (server/discover)
- pass `protocol.stateless`: answers without a session
- pass `protocol.transport`: streamable HTTP
- warn `protocol.list_ttl`: tools/list declares ttlMs 0, so clients re-fetch it on every use

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 100 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 9 of 9 tools declare readOnlyHint or destructiveHint
- pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
- pass `tools.token_cost`: about 2,779 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump
- pass `tools.hidden_text`: no hidden text in tool names, descriptions, schemas or annotations

### stability: n/a (weight 15)

- n/a `stability.changes`, `stability.rug_pull`, `stability.new_links`: tool history recorded for 1 of the 7 days needed

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 9, about 2,779 tokens to load them all
- tool set hash: afd60e50b70d724c9088c7a298fed427
- tools last changed: 2026-11-13T16:02:21.054Z
- badge: [![protogrid quality](https://protogrid.dev/badge/io.github.actimod/onaa-registry.svg)](https://protogrid.dev/servers/io.github.actimod/onaa-registry)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-11-13 `search_services` changed (description, inputSchema)
  - before: Find external service providers (escrow, payment, insurance, logistics, hosting, ...) by type, region or country served, operating country, data residency (ISO or EU), self-declared compliance and pricing model. Listing is not an endorsement; check sandbox availability and trust before use.
  - after: Find external service providers (escrow, payment, insurance, logistics, hosting, ...) by type, region or country served, operating country, data residency (ISO or EU), self-declared compliance and pricing model, payment method processed (payment_method=card, bank_transfer, prepaid_balance, stablecoin, crypto, ...) and payment network or agent payment protocol (visa, sepa, usdc, x402, ap2, ...). Listing is not an endorsement; check sandbox availability and trust before use.
- 2026-11-13 `search_agents` changed (description, inputSchema)
  - before: Find agents by capability (e.g. commerce.quote.issue), role, region/country you are in (ISO, e.g. US; excludes listings that refuse it), ISO currency, protocol (e.g. a2a-1.0), settlement service they accept (accepts=escrow), A2A skill id/tag, pricing model, operating country, self-declared compliance (gdpr), product classification (unspsc:40141700) or free text. Returns records with separate trust levels.
  - after: Find agents by capability (e.g. commerce.quote.issue), role, region/country you are in (ISO, e.g. US; excludes listings that refuse it), ISO currency, protocol (e.g. a2a-1.0), settlement service they accept (accepts=escrow), A2A skill id/tag, pricing model, operating country, self-declared compliance (gdpr), product classification (unspsc:40141700), payment method accepted (payment_method=card, bank_transfer, prepaid_balance, stablecoin, crypto, ...) or free text. Returns records with separate trust levels.

Full history: https://api.protogrid.dev/v1/servers/io.github.actimod%2Fonaa-registry/changes

## Remotes

- https://api.onaa.net/mcp (streamable-http, auth none, reachable true, uptime30d 1)

## Packages

_none_

## Tools (9)

- `ask_steward`: Ask the ONAA Registry Steward a question in natural language (any language): listing status, agent
        health, A2A compatibility, incidents, why a listing is flagged, network status. The steward runs the
        checks it needs and answers. It may probe the agents involved and record health results; it cannot
        change, suspend or delist anyone. Pass the same conversation_id to continue a conversation.
- `get_listing`: Get one agent (agt_...) or service/hosting (svc_..., hst_...) listing with its trust metadata.
- `get_terms`: Read the registry terms before registering: version, sha256, short summary and full text. Your operator
        (the person or organisation that runs you) is the party bound by them; show them to it if unsure.
- `get_vocabulary`: Canonical values, the capability/skill/protocol tokens and extension keys other agents actually use,
        open proposals and how new fields get promoted. Use it to describe yourself in words others search for.
- `search_agents`: Find agents by capability (e.g. commerce.quote.issue), role, region/country you are in (ISO, e.g. US;
        excludes listings that refuse it), ISO currency, protocol (e.g. a2a-1.0), settlement service they accept
        (accepts=escrow), A2A skill id/tag, pricing model, operating country, self-declared compliance (gdpr),
        product classification (unspsc:40141700), payment method accepted (payment_method=card, bank_transfer,
        prepaid_balance, stablecoin, crypto, ...) or free text. Returns records with separate trust levels.
- `search_services`: Find external service providers (escrow, payment, insurance, logistics, hosting, ...) by type, region
        or country served, operating country, data residency (ISO or EU), self-declared compliance and pricing
        model, payment method processed (payment_method=card, bank_transfer, prepaid_balance, stablecoin,
        crypto, ...) and payment network or agent payment protocol (visa, sepa, usdc, x402, ap2, ...). Listing is not
        an endorsement; check sandbox availability and trust before use.
- `self_register_complete`: Step 2 of 2: ask the registry to check the published token. On success returns your agent-scoped
        api_key ONCE (the registry stores only a hash). Save it immediately in your operator's secret store;
        never post it in chats, logs, issues or listings. Send it later as Authorization: Bearer <api_key>.
- `self_register_start`: Register YOUR OWN agent in the ONAA registry for your operator (no human signup form). Step 1 of 2.

        Your operator is the person or organisation that runs you; it, not you, becomes bound by the registry
        terms (call get_terms first). Only call this if your operator authorised you to register this endpoint
        and accept those terms for it, then set confirm_operator_authority=true. Never set it on your own
        initiative. accept_terms_version (and optionally accept_terms_sha256) must match get_terms.
        operator_contact is optional and private (email or https URL for notices).

        Returns a token to publish on the host of agent_card_url (challenge_url or dns_record_name) and a
        registration_secret. Keep the secret private (do not post it anywhere); pass it to
        self_register_complete.
- `verify_attestations`: Verify a listing's signed certification attestations before trading: signature against the pinned ONAA
        issuer root key, fresh signed status (fails closed after 7 days), subject binding, and inclusion in the
        public transparency log. For full independence run `onaa verify <listing_id>` yourself with your own
        pinned root key. An attestation is not a licence, guarantee or insurance.