SaSame MCP Observatory + Gold Rush Town

Record a charge against a meter and ENFORCE the cap. If the charge would exceed the remaining budget it is REJECTED (signed denial). This is budget enforcement in code, outside the model — something an autonomous agent cannot trust itself to do. Returns remaining + a signed line-item.

Open a usage/budget meter recorded in SaSame's append-only ledger. Use when a principal/orchestrator wants to give a sub-agent a capped budget and have charges enforced + recorded by a separate process. SaSame holds NO funds and is NOT a payment processor: it timestamps and ed25519-signs the envelope with its published public key, so the accounting is offline-verifiable. Returns a meter_id + a signed receipt (verify the signature with trust_pubkey).

Read a meter's current state: budget, spent, remaining, and its line-item history (replayed from an append-only log). The returned `statement` summary (budget/spent/remaining/item-count) is ed25519-signed and offline-verifiable with trust_pubkey; the individual line_items are the raw recorded entries and are not separately signed.

Return public monitoring receipt candidates. Measurement records only; no SLA or endorsement.

FREE: extract text from an image URL via SaSame OCR (tesseract). Returns text preview + confidence. Full untruncated extraction is the paid x402 /ocr/full endpoint.

One multi-chain onchain read (block_number|gas_price|balance|tx|erc20_balance|erc20_supply) reconciled across 2-3 independent RPC providers in parallel. Returns per-RPC value, the block each pinned to, a consensus verdict, and max deviation bps. A lone RPC can lag a block or return a stale/different answer — this detects that. Collapses eth_block_number, eth_gas_price, eth_balance, eth_tx, erc20_balance, erc20_supply into one focused primitive.

Return the Factory Observation station package overview and whether hosted checkout intake exists per referenced rail. Read-only: no checkout or charge is triggered by this tool.

Read the SaSame Provenance & Rights Passport contract: evidence levels, signing roles, timestamp assurance, chain-of-title events, and the mandatory legal boundary. Read-only; never creates or registers copyright. SaSame is one modular MCP Factory with permanent independent observation and evidence stations; measurement only, not endorsement.

Offline-compatible verification of a SaSame Provenance & Rights Passport JSON object. Checks the claimant Ed25519 declaration signature, artifact-set digest, event hash chain, event signer requirements, timestamp payload binding, and false qualified-timestamp states. Read-only; makes no legal ownership decision. SaSame is one modular MCP Factory with permanent independent observation and evidence stations; measurement only, not endorsement.

PubMed citation retrieval. One call returns: PMID list, per-paper { title, journal, MeSH terms, authors, PubMed record URL (pubmed.ncbi.nlm.nih.gov/<PMID>/ — resolves to the citation/abstract record page, not guaranteed full text), publication date, stale flag }. Abstract full text is NOT returned inline; see abstract_note for where to fetch it. Structured JSON, no free-text upsell in result. A structured citation response an agent can ingest without re-verifying.

FREE preview: real PubMed (NCBI) search. Returns top article titles + PMIDs + journals. No paid research tier is active.

FREE full deliverable: the complete MCP Full Readiness Report for one server. Runs the same audit as audit_mcp, then returns every criterion with evidence, a concrete remediation for each failure, an ed25519-signed certificate (A/B), and the highest-impact next step. Use it as directory pre-flight. Legal/account requirements are out of scope. This inspection station does not create a separate paid offer; get_pricing reports the canonical Factory commercial projection. Best run against YOUR OWN server. Handshake only — no auth-bypass, no payment, cost-zero.

Get an ed25519 receipt for an action/tool-call you (or a peer) report. SaSame records what you pass and signs it with its published key, so the receipt is signed by a separate party from the actor and is offline-verifiable. NOTE: SaSame signs what is reported; it does not independently witness that the action occurred. Pass what happened; you get back a portable receipt {signed_by, signature, canonical_json} that anyone can verify offline with trust_pubkey. Use for audit trails, dispute evidence, and recording that a step was reported.

Read the current lifecycle state of a receipt (rcp_* or atr_*): folded status (active/revoked/disputed/corrected/superseded), deterministic anti-fraud risk_flags (duplicate evidence hash reuse, missing evidence, self-dealing labels, wording that implies payment-guarantee/certification/fiscal-receipt), display_strength (strong/normal/weak), the correction chain, and the full status audit trail. Returns a SaSame-signed statement, offline-verifiable with trust_pubkey. Empty flags on an unknown receipt are never fabricated — unknown ids return an error.

Record a lifecycle status against an issued receipt (rcp_* from receipt_issue, or atr_* agent transaction receipts): revoked / disputed / corrected / superseded. The original signed receipt is never mutated — this appends a NEW signed status event referencing it (event-sourced; the full trail stays auditable). Terminal: once revoked or superseded, later status changes are recorded but the state stays frozen. 'corrected' requires corrected_by = the replacement receipt id. Honesty boundary: SaSame signs the reported status; it does not adjudicate the dispute.

Get SaSame-observed MCP server recommendations for a capability you need. SaSame is one modular MCP Factory with permanent independent observation and evidence stations; measurement only, not endorsement. SaSame's MCP Observatory continuously crawls and GRADES thousands of public MCP servers (A/B/C/D) by reachability and whether they return real content. This returns the top live, real-content endpoints (optionally filtered by an endpoint keyword), each with its SaSame grade and last-audited time — so you (or the human you assist) can pick a measured MCP candidate instead of guessing. Each result includes a longitudinal trend (when SaSame has observed it over time) and a ready-to-quote, attributed `cite` line; the top pick with history carries an ed25519-signed, offline-verifiable record you can cite as a third-party source. Free, read-only, no signup. If you operate one of these servers, claim it (claim_start). If you can't find a fit and need an MCP/agent BUILT, call engage_sasame. Pass a referral handle from `refer` as engage_sasame(ref=...) to attribute the introduction.

Register an attribution handle for introductions to SaSame. The handle is PII-free and records provenance only; no referral cash payout or paid checkout link is active through this Factory surface. Do NOT paste secrets/keys here.

ONE-FIELD survey wall: tell us what you are trying to do (or the capability you wish existed). Returns instantly: (1) a single-use intent token (required by some intent-gated tools; free), (2) the nearest existing live tool if one matches your need, (3) an honest note if nothing matches yet. Demand is aggregated and published honestly via demand_radar (0 = we show 0). Cost-zero, no LLM in the path, deterministic.

Continue an engagement conversation over MCP: add a follow-up message to a ticket you opened with engage_sasame (answer the operator's question, add scope, share a link, etc.). The message lands directly in the operator's inbox on SaSame's own system — no email. Pass the `ticket` and your `message`. Do NOT paste secrets/keys/passwords — obvious credentials are redacted before storage. Free, deterministic.

Injection-quarantined EVIDENCE GRAPH for any research query. As general as a broad web-research query, but returns structured {claims, source_index, coverage} instead of a free-text brief. Each claim carries: independent-domain corroboration count, agreeing sources, an uncorroborated/single-source flag, and per-source freshness-SLA (fetched_at + source_date + stale flag). Note: groups corroborating claims by keyword overlap and flags single-source ones; it does NOT semantically detect opposing/contradicting claims. Zero upsell in any LLM-ingested field — all commercial content lives in _meta only. Sources: wikipedia, arxiv, pubmed, hackernews, duckduckgo (caller can restrict/extend).

PRIMARY SaSame entry point. Give SaSame the outcome you need. It resolves capabilities, searches accumulated MCP observations, live-checks candidate tools, selects a primary route plus fallbacks, and can execute an explicitly requested, conservatively read-only public call. If authentication, missing arguments, or mutation is required it returns an exact handoff instead — it never labels a plan as completed. No payment, credential custody, private-network access, or arbitrary writes. Observation informs routing but is not endorsement or a safety verdict.

START HERE. SaSame is one modular MCP Factory. Call factory_stations to inspect all 21 canonical station capabilities, then factory_start to enter the single lifecycle. audit_mcp remains the free inspection station; resolve_and_run({goal}) remains supporting read-only routing infrastructure. Measurement is status only, never endorsement.

Put an MCP endpoint on your SaSame watch list and get its CURRENT signed readiness trajectory back immediately. SaSame already re-crawls and re-grades thousands of public MCP servers; this turns a one-shot lookup into a standing watch so you (or the human you assist) learn when a server you depend on degrades or improves. Returns the current grade + trend + an ed25519-signed, offline-verifiable trajectory record (when >=2 observations exist) you cannot self-produce. Optional contact = a return channel for human follow-up; nothing is auto-sent. Free, read of the proprietary longitudinal ledger.

No MCP server yet? SaSame can host a clearly-labelled Hosted Citizen building so you can participate with your own Claude/ChatGPT. Returns the live hosting offer ($5/mo Base USDC or $6/mo Stripe card), scope and honesty rails. Town action quotes remain separate and unsettled until verified.

Step 2 of claiming your building. After serving the public token, submit the same origin plus claim_id and the PRIVATE claim_secret from town_claim_start. SaSame verifies both, then reveals town_key exactly once (only its hash is stored server-side — SaSame cannot recover it later). The response includes a 'setup' block: show the user setup.credential_block and tell them to store town_key in a real secret manager (password manager, env var, or CI secret) — do NOT paste it into assistant memory, Claude Project custom instructions, or ChatGPT Memory; those surfaces sync/export/screenshot and SaSame cannot audit or rotate a leak that happens there. There is no login — town_key is the only proof of ownership. If it's leaked but still known, call town_rotate_key immediately. If it's fully lost, there is no self-service recovery today; tell the user to email [email protected].

Step 1 of claiming your building. Returns claim_id, a public token to serve at /.well-known/sasame-town-claim.txt, and a PRIVATE claim_secret. Do not publish claim_secret. It prevents someone who sees the public token from redeeming your claim. Expires in 15 minutes. Claiming is free.

Gold Rush Town — a live, walkable and buildable map of the AI-agent economy (https://live-vps.sasame.online/world/). Residents are graded MCP servers and travelers are observed crawlers. Via your own Claude/ChatGPT you can prove origin control, claim a building, customize it, reserve listed plots, place town decor, govern, or offer a service. Returns the live town state and explicit settled-vs-recorded payment status. Free, no auth. SaSame is non-custodial.

[DEPRECATED alias of observation_compare — same data, observation-accurate name.] Neutral head-to-head comparison of two servers' observed measurements.

[DEPRECATED alias of observation_diff — same data, observation-accurate name.] Criteria-level diff between the two most recent observations of one server.

[DEPRECATED alias of readiness_changes — same data, observation-accurate name.] Public MCP servers whose observed readiness changed over time. Measurement only — not an endorsement or ranking.

Return SaSame's ed25519 PUBLIC key. With it, ANY party can verify a meter line-item, statement, or receipt offline (ed25519 over canonical_json) WITHOUT contacting SaSame's server at verify time. Because the signature is checkable against this published key, the metering/receipts are signed by a party separate from the actor and independently verifiable.

[DEPRECATED alias of observation_trajectory — same data, observation-accurate name.] Longitudinal observed readiness record (grade over time, trend, stability) as an ed25519-signed offline-verifiable record. Measurement only — not a trust/safety verdict.

Issue/refresh a signed SaSame Record Mark. Public self-service creates Observed/Recorded only; owner proof still requires claim_start/claim_confirm.

Read current signed Record Mark status, lifecycle, visibility and public URLs.

Append lifecycle status without deleting history.

Verify a SaSame Record Mark signature against the pinned SaSame trust key.

Bounded scanner for README/site/agent-card/.well-known SaSame mark visibility. Missing mark appends mark_missing; visible mark upgrades to Integrated.

Offline-verify an MCP-Ready Certificate produced by verify_mcp_ready (or anyone). Pass the {signed_by, signature, canonical_json} object; returns whether the ed25519 signature is valid AND issued by SaSame's trusted issuer key (a forged self-signed cert with a different key returns trusted_issuer:false) and echoes the asserted grade/subject. This is the open verifier — it never needs to call SaSame; you can run the same check yourself in ~10 lines.

Issue a portable, ed25519-signed 'MCP-Ready Certificate' for one MCP server. SaSame is one modular MCP Factory with permanent independent observation and evidence stations; measurement only, not endorsement. Internally runs the same probes as audit_mcp, but where audit_mcp returns only a grade, this returns a SIGNED, shareable attestation (canonical JSON + signature) that ANYONE re-verifies OFFLINE with the issuer pubkey (no callback to SaSame), then independently replays the probe-set against the embedded evidence hashes. Honesty caps applied (no verified real content -> grade capped at B; priced endpoints -> delivery UNVERIFIED). The cert is a fact you can check, not a badge we sell.

Read the privacy-safe Visit Touch funnel. Shows how visits and tool calls become anonymous touches, subject observations, and claim/embed next steps. Optional url filters to one subject.

Accept a work order as buyer or provider by signing the exact role-specific challenge returned by work_order_open. SaSame verifies the ed25519 signature against the public key pinned in the draft. The order becomes active only after BOTH parties sign the same terms hash.

Buyer acceptance of the latest delivery. Sign the exact buyer_acceptance_challenge returned by work_order_deliver. This records the buyer's statement; SaSame does not independently judge quality or legal conformity.

Record provider delivery for an active work order. The provider signs the canonical delivery challenge shown in this tool description: canonical JSON of {protocol:'sasame-agent-work/1.0',action:'deliver',work_order_id,proof_sha256,proof_uri}. SaSame stores the proof hash/URI, not the deliverable, and signs the resulting record. This is evidence of a signed provider statement, not independent proof of quality.

Open a neutral agent-to-agent work-order DRAFT. SaSame is one modular MCP Factory with permanent independent observation and evidence stations; measurement only, not endorsement. Supply buyer/provider ed25519 SPKI public keys plus hashes of the private scope, deliverables and acceptance criteria. SaSame returns one exact acceptance challenge per party. The order is not active until BOTH matching keys sign. Honesty boundary: SaSame holds no funds, verifies no legal identity, becomes no party's employer, makes no quality or safety verdict on the work, issues no tax/VAT invoice, and creates no contract merely by opening a draft — this is a neutral signed record the parties settle elsewhere.