# Sigil (remote · mcp.sigil.tunnelmind.ai)

Programmatic-advertising supply verification: ads.txt, schain, ATAP receipts, cross_lens_verify.

- Trust score: 56/100 (low)
- Change this week: +2
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `mcp.sigil.tunnelmind.ai`: 56/100 (this document), [markdown](https://verifymcp.io/servers/ai-tunnelmind-sigil/mcp.md), [page](https://verifymcp.io/servers/ai-tunnelmind-sigil/mcp)

## Channel facts

- Endpoint: `https://mcp.sigil.tunnelmind.ai/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `0.2.1`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Endpoint Security**: 46/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not fully verified: no authorisation is required to call this server, and 12 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.
  - HTTPS not yet verified: we couldn't determine whether a plaintext access path exists.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 72/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 2837 tokens (~236/item across 12 items; 12 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 73/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 18% of tool parameters carry a description.
- **Capabilities**: 40/100
  - Spec-recency check failed: implements MCP spec 2025-03-26; the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add --transport http ai-tunnelmind-sigil https://mcp.sigil.tunnelmind.ai/mcp
```

### Codex

```toml
[mcp_servers.ai-tunnelmind-sigil]
url = "https://mcp.sigil.tunnelmind.ai/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "ai-tunnelmind-sigil": {
      "type": "remote",
      "url": "https://mcp.sigil.tunnelmind.ai/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add ai-tunnelmind-sigil --url https://mcp.sigil.tunnelmind.ai/mcp --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  ai-tunnelmind-sigil:
    url: "https://mcp.sigil.tunnelmind.ai/mcp"
```

### Other

```json
{
  "mcpServers": {
    "ai-tunnelmind-sigil": {
      "type": "http",
      "url": "https://mcp.sigil.tunnelmind.ai/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 56, +1)

No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-31 (score 55, 0)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 55, 0)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-29 (score 55, +1)

No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-27 (score 54, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-26 (score 53)

First indexed and scored.

## MCP tools (12)

### `cross_lens_verify` (~474 tokens)

A2 — the cross-lens join. Fuse TunnelMind's two lenses (Scry attacker
intelligence + Sigil supply graph) into ONE verdict on a single node key.
This is the moat: no siloed competitor owns both halves of the graph, so
the fused `cross_lens` block carries information neither lens can supply
alone.

Use this tool when:
\- An agent must decide whether to transact with an IP, domain, ASN, or
  entity_slug, and a one-lens answer is not enough.
\- You want a single composite trust verdict instead of running
  Scry + Sigil calls separately and reconciling them by hand.

Inputs:
\- `node` (required): an IPv4 address, a domain, an ASN (e.g. `AS64500`),
  or an entity_slug. Type is auto-detected.
\- `weights` (optional): per-component weight overrides.
\- `thresholds` (optional): `{ pass, fail }` verdict cutoffs (defaults 0.7 / 0.3).
\- `ait` (optional): an ATAP AIT id. When present, the verdict is chained
  onto the AIT as a witness-tier `cross_lens:verified` event signed by
  Sigil (witness OAI-2026-0000201) — replayable evidence, not just JSON.

Returns: per-lens `scry` + `sigil` blocks (transparency), a fused
\`cross_lens` block with `verdict` / `trust_score` / `confidence` /
\`signals` / `recommendations`, a 5-minute signed `sigil_token`, and a
\`witnessed_event` block when an AIT was supplied.

Failure semantics: each lens fails independently. Single-lens answers
still return 200 with a `confidence` of 0.55. Returns 503 only when BOTH
lenses are unavailable.

Input parameters:

- `ait` (string): Optional ATAP AIT id to witness this verification under.
- `node` (string, required): The node to verify. IPv4, domain, ASN (AS-prefixed or numeric), or entity_slug.
- `thresholds` (object)
- `weights` (object)

### `sigil_verify_supply_path` (~281 tokens)

The core pre-bid check. Verify the trustworthiness of one programmatic ad
supply path and get back a composite trust verdict plus a signed proof token.
Sigil composes ads.txt authorization, datacenter-IP classification, Scry
fraud-corpus lookup, and app-bundle checks into one score.

Use this tool when:
\- An ad-buying agent is about to bid and must confirm the supply is genuine.
\- You want one call instead of running ads.txt / IP / bundle checks separately.

Inputs:
\- `supply_path` (required): { publisher_domain, exchange, seller_id, and
  optionally ip_address, app_bundle:{bundle_id,platform} }.
\- `ait` (optional): an ATAP AIT id — when present, Sigil records this
  verification as a witnessed attestation event and binds the token to it.

Returns: `trust_score` (0-1), `verdict` (pass/warn/fail/unknown), per-check
results, `recommendations`, and a signed `sigil_token` (5-min) to attach to
the bid as proof. The submitted IP is used for lookup only — never stored.

Input parameters:

- `ait` (string): Optional ATAP AIT id to witness this verification under.
- `supply_path` (object, required)

### `sigil_verify_ads_txt` (~216 tokens)

Check whether an exchange/SSP is authorized to sell a publisher's inventory,
per the publisher's ads.txt file. Fast cached lookup against Sigil's daily
crawl of the top ~10k publisher domains.

Use this tool when:
\- You need a single, narrow authorization check (not a full supply-path score).
\- You are validating a (publisher, exchange, seller_id) triple from a bid request.

Inputs:
\- `publisher_domain`, `exchange_domain`, `seller_id` (all required).
\- `resolve_chain` (optional): when true and the entry is RESELLER, Sigil walks
  one hop into the exchange's sellers.json to identify the upstream seller.

Returns: `verified` (true/false/null), `confidence`, the matched ads.txt entry,
and any `warnings` (e.g. seller_type mismatch).

Input parameters:

- `exchange_domain` (string, required)
- `publisher_domain` (string, required)
- `resolve_chain` (boolean)
- `seller_id` (string, required)

### `sigil_verify_ip_type` (~115 tokens)

Classify an IPv4 address as datacenter, residential, mobile, or unknown.
Detects datacenter traffic posing as real user devices. Stateless — the IP
is never logged or stored.

Use this tool when:
\- You need to know whether bid-request traffic originates from a datacenter.

Inputs:
\- `ip` (required): an IPv4 address.

Returns: `ip_type`, `confidence` (high/medium/low), and the ASN + AS-org name.

Input parameters:

- `ip` (string, required)

### `sigil_verify_app_bundle` (~157 tokens)

Verify that a mobile/CTV app bundle ID actually exists in its app store and,
optionally, that the listed developer matches. Detects bundle-ID spoofing in
bid requests.

Use this tool when:
\- A bid request names an app bundle and you must confirm the app is real.

Inputs:
\- `bundle_id` (required), `platform` (required: ios | android | ctv_* | web),
\- `claimed_developer` (optional): developer name to match against the listing.

Returns: `verified` (true/false/null), the store listing, and `developer_match`.

Input parameters:

- `bundle_id` (string, required)
- `claimed_developer` (string)
- `platform` (string, required)

### `sigil_verify_supply_chain` (~214 tokens)

Verify a full OpenRTB SupplyChain (schain) object — every node, end to end.
Per node Sigil checks the seller against the exchange sellers.json and the
origin ads.txt, then returns a per-node and aggregate verdict plus a signed
token.

Use this tool when:
\- A bid request carries an OpenRTB `schain` and you want it verified verbatim.

Inputs:
\- `schain` (required): an OpenRTB SupplyChain object ({ ver, complete,
  nodes:[{asi,sid,hp}] }).
\- `site_domain` or `app_bundle` (optional): the inventory origin, checked
  against node[0] via ads.txt / OWNERDOMAIN.

Returns: per-node `nodes` results, an aggregate `verdict`, `recommendations`,
and a signed `sigil_token`.

Input parameters:

- `app_bundle` (string)
- `schain` (object, required): OpenRTB SupplyChain object.
- `site_domain` (string)

### `sigil_traverse_supply_chain` (~395 tokens)

Walk the supply graph for a publisher domain and get back the ITEMIZED
sell paths — distinct from sigil_verify_supply_chain (which verifies a
schain you BRING) and from the dark-pool-risk signal (which only returns
counts). Here Sigil reconstructs the paths from its own crawl: every SSP
the publisher declares it sells through, joined to that SSP's identity and
classified two-sided against the SSP's sellers.json.

Use this tool when:
\- You have a publisher domain but no schain, and want to SEE its real
  authorized supply paths and where the opacity is.
\- dark-pool-risk flagged a publisher and you need the specific contradicted
  paths driving the risk, not just the aggregate.

Inputs:
\- `domain` (required): the publisher domain, e.g. `cnn.com`.
\- `limit` (optional): max paths returned (default 200, cap 500). The list
  is ordered riskiest-first (contradicted, then reseller) so a truncated
  page is still the most useful; the `supply_paths` counts are always over
  the FULL set.

Returns: `supply_paths` aggregate counts (total / direct / reseller /
corroborated / contradicted / unchecked) and `paths[]`, each with the SSP
identity, `seller_id`, `seller_type`, `klass` (corroborated = seat present;
contradicted = SSP crawled but seller_id absent → real risk; unchecked =
SSP not yet crawled → not risk), and `resells_to` (one level of downstream
reseller expansion). Returns in_supply_graph:false if the domain is not in
the crawled corpus.

Input parameters:

- `domain` (string, required): Publisher domain to traverse.
- `limit` (integer): Max paths returned (default 200, cap 500).

### `sigil_score_entity` (~149 tokens)

Get the pre-computed trust score for one supply-chain entity (a publisher or
an SSP). Scores are recomputed daily from ads.txt health, supply-chain
directness, reach, and stability — deterministic, no ML black box.

Use this tool when:
\- You want a fast standing trust signal for an entity without running checks.

Inputs:
\- `entity_id` (required): `{type}:{domain}` — e.g. `publisher:nytimes.com` or
  \`ssp:pubmatic.com`.

Returns: `trust_score` (0-1), `score_components`, the 14-day `trend`, and
\`warnings`.

Input parameters:

- `entity_id` (string, required)

### `sigil_score_batch` (~144 tokens)

Pre-computed trust scores for up to 200 entities in one call — built for an
agent evaluating many supply sources during campaign setup.

Use this tool when:
\- You have a list of publishers/SSPs to grade at once.

Inputs:
\- `entity_ids` (required): array of `{type}:{domain}` ids, up to 200.
\- `weights` (optional): custom component weights to re-score with.

Returns: `count`, `scored_count`, and a per-entity `results` array (invalid
ids are reported inline, never failing the batch).

Input parameters:

- `entity_ids` (array, required)
- `weights` (object)

### `sigil_atap_register_ait` (~278 tokens)

Register an ATAP v0.1 Agent Identity Token for a media-buying agent. Sigil
validates the capabilities + constraints against the `sigil:media_buyer:v1`
profile, signs the AIT as the witness, and returns it. Do this once per agent
campaign before witnessing any events.

Inputs:
\- `profile` (required): must be `sigil:media_buyer:v1`.
\- `operator` (required): the agent operator's canonical OAI.
\- `capabilities` (required): array from the profile vocabulary.
\- `constraints` (required): { currency, max_bid_cpm, supply_trust_minimum,
  budget_total_cap, allowed_channels, ... }.
\- `attestation_policy` (required): { witness_granularity, block_interval_seconds
  (60-3600), receipt_generation }.
\- `expires_at` (required): ISO date-time, <= 365 days out.

Returns: the signed AIT (note its `id` for subsequent witness calls).

Input parameters:

- `agent_type` (string)
- `attestation_policy` (object, required)
- `capabilities` (array, required)
- `constraints` (object, required)
- `expires_at` (string, required)
- `operator` (string, required)
- `profile` (string, required)

### `sigil_atap_witness` (~242 tokens)

Witness one agent-reported bid or budget event into an AIT's hash-chained
attestation log. Sigil validates the payload (rejecting any PII), classifies
the evidence tier — `anchored` if a bid cites a valid Sigil token, else
\`asserted` — derives constraint violations, and signs the event.

Use this tool when:
\- An ATAP-enrolled media-buyer agent submits a bid, win, loss, or budget
  decrement and you want it on the attestation record.

Inputs:
\- `ait` (required): the AIT id.
\- `event_type` (required): bid:submitted | bid:won | bid:lost | budget:decremented.
\- `payload` (required): the event payload (see the sigil:media_buyer:v1 profile).

Returns: the signed witness event(s), the assigned `tier`, and any derived
constraint violations. (supply:verified events come from verify_supply_path,
not this tool.)

Input parameters:

- `ait` (string, required)
- `event_type` (string, required)
- `payload` (object, required)

### `sigil_generate_receipt` (~172 tokens)

Generate the ATAP v0.1 compliance Receipt for an AIT — the portable, signed
artifact a media buyer hands its principal. The receipt grades every event
witnessed / anchored / asserted and is verifiable offline with the bundled
verify.sh.

Use this tool when:
\- A reporting period closes and you need a compliance export for the AIT.

Inputs:
\- `ait` (required): the AIT id.
\- `format` (optional): `full` (default) or `summary`.

Returns: JSON with `receipt_id` and `zip_base64` — base64-decode `zip_base64`
to a .zip, unpack it, and run verify.sh to verify the chain independently.

Input parameters:

- `ait` (string, required)
- `format` (string)

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/ai-tunnelmind-sigil/mcp#diagnostics

## Score history

- 2026-08-03: 56
- 2026-08-02: 56
- 2026-08-01: 55
- 2026-07-31: 55
- 2026-07-30: 55
- 2026-07-29: 55
- 2026-07-28: 54
- 2026-07-27: 54
- 2026-07-26: 53

## Links

- Remote endpoint: https://mcp.sigil.tunnelmind.ai/mcp
- Website: https://tunnelmind.ai/
- Changelog RSS feed: https://verifymcp.io/servers/ai-tunnelmind-sigil/mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/ai-tunnelmind-sigil/mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/ai-tunnelmind-sigil/mcp