# PHION Agent Trust Infrastructure (remote · phion.systems)

118 agent services with free discovery, intent, x402 terms and signed verification.

- Trust score: 66/100 (medium)
- Change this week: +4
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-25

## Components

- remote · `phion.systems`: 66/100 (this document), [markdown](https://verifymcp.io/servers/systems-phion-evidence-engine/phion.md), [page](https://verifymcp.io/servers/systems-phion-evidence-engine/phion)

## Channel facts

- Endpoint: `https://phion.systems/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.49.5`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-25.

- **Endpoint Security**: 63/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not fully verified: no authorisation is required to call this server, and 52 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 58/100
  - AI-judged instruction clarity (fair).
  - Tool/resource definitions use about 5964 tokens (~48/item across 124 items; 124 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 47/100
  - Stability observed for 14 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 72/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 2% of tool parameters carry a description.
  - Structured output schemas are declared (58% of tools); any adoption earns full credit.
- **Tool Safety**: 88/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - 1 of 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "duplicate_charge_detector" implies "charge" and declares readOnlyHint instead, contradicting what its own name says it does.
  - An AI judge read all 124 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 60/100
  - Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28.

## Install

### How do I install the PHION Agent Trust Infrastructure MCP server?

PHION Agent Trust Infrastructure is a hosted endpoint at https://phion.systems/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http systems-phion-evidence-engine 'https://phion.systems/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "systems-phion-evidence-engine": {
      "url": "https://phion.systems/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "systems-phion-evidence-engine": {
      "type": "http",
      "url": "https://phion.systems/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.systems-phion-evidence-engine]
url = "https://phion.systems/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "systems-phion-evidence-engine": {
      "type": "remote",
      "url": "https://phion.systems/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add systems-phion-evidence-engine --url 'https://phion.systems/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  systems-phion-evidence-engine:
    url: "https://phion.systems/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "systems-phion-evidence-engine": {
      "Transport": "http",
      "Url": "https://phion.systems/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add systems-phion-evidence-engine -t streamable-http -u 'https://phion.systems/mcp'
```

### Other

```json
{
  "mcpServers": {
    "systems-phion-evidence-engine": {
      "type": "http",
      "url": "https://phion.systems/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-25 (score 66, −1)

- [functional regression] MCP protocol: pass → fail
- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server
- [functional] Server version: 1.49.4 → 1.49.6
- [functional] Server version: 1.49.3 → 1.49.4
- [functional] Server version: 1.49.0 → 1.49.3

### 2026-09-24 (score 67, +1)

- [functional] Server version: 1.46.2 → 1.46.4

### 2026-09-23 (score 66, 0)

- [functional] Server version: 1.46.1 → 1.46.2
- [functional] Server version: 1.46.0 → 1.46.1
- [functional] Server version: 1.45.0 → 1.46.0

### 2026-09-22 (score 66, +1)

- [functional regression] Schema quality: 4804 → 5964
- [functional improvement] Tool coverage: 45% → 58%
- [functional improvement] Tool coverage: 45% → 50%
- [functional] Server version: 1.44.0 → 1.45.0
- [functional] Server version: 1.39.0 → 1.44.0
- [functional] Server version: 1.37.0 → 1.39.0
- [functional] New tool “a2a_transaction_bridge”
- [functional] New tool “agent_economic_graph”
- [functional] New tool “ap2_mandate_bridge”
- [functional] New tool “automated_dispute_bundle”
- [functional] New tool “autonomous_procurement”
- [functional] New tool “cross_protocol_receipt”
- [functional] New tool “delegated_spend_policy”
- [functional] New tool “dynamic_service_pricing”
- [functional] New tool “erc8004_identity_evidence”
- [functional] New tool “erc8004_reputation_intelligence”
- [functional] New tool “market_demand_predictor”
- [functional] New tool “mcp_transaction_gateway”
- [functional] New tool “multi_agent_escrow”
- [functional] New tool “price_discovery_engine”
- [functional] New tool “proof_of_service”
- [functional] New tool “reputation_update_receipt”
- [functional] New tool “service_gap_detector”
- [functional] New tool “sla_risk_predictor”
- [functional] New tool “transaction_recovery_v2”
- [functional] New tool “agent_behavior_fingerprint”
- [functional] New tool “capability_benchmark”
- [functional] New tool “capability_verification”
- [functional] New tool “economic_loop_detector”
- [functional] New tool “payment_optimizer”
- [functional] New tool “provider_quality_predictor”
- [functional] New tool “sybil_reputation_guard”
- [functional] New tool “transaction_risk_score”
- [functional] New tool “trust_anomaly_detector”
- [functional] New tool “x402_v2_router”

### 2026-09-21 (score 65, +2)

- [functional improvement] Schema quality: 57 → 50
- [functional improvement] Tool coverage: 31% → 45%
- [functional improvement] Tool coverage: 31% → 39%
- [functional improvement] MCP protocol: fail → pass
- [functional] MCP protocol version: 2025-06-18 → 2026-07-28
- [functional] Server version: 1.35.0 → 1.37.0
- [functional] Server version: 1.33.0 → 1.35.0
- [functional] Server version: 1.32.2 → 1.33.0
- [functional] Server version: 1.32.3 → 1.32.2
- [functional] New tool “tool_result_schema_validator”
- [functional] New tool “agent_memory_provenance”
- [functional] New tool “agent_rate_limit_negotiator”
- [functional] New tool “agent_session_continuity”
- [functional] New tool “cross_agent_receipt_bundle”
- [functional] New tool “delegated_credential_guard”
- [functional] New tool “execution_cost_estimator”
- [functional] New tool “payment_delivery_atomicity”
- [functional] New tool “service_failover_selector”
- [functional] New tool “task_lease_guard”
- [functional] New tool “agent_approval_relay”
- [functional] New tool “capability_negotiation_preflight”
- [functional] New tool “durable_agent_task”
- [functional] New tool “mcp_2026_compatibility_gateway”
- [functional] New tool “mcp_a2a_task_bridge”
- [functional] New tool “mcp_catalog_cache_guard”
- [functional] New tool “oauth_issuer_binding_evidence”
- [functional] New tool “quote_freshness_guard”
- [functional] New tool “task_cancel_assurance”
- [functional] New tool “task_checkpoint_evidence”

### 2026-09-20 (score 63, 0)

- [functional] Server version: 1.32.0 → 1.32.3

### 2026-09-19 (score 63, +1)

- [security] Tool “company_enrichment_evidence” rewrote its description, which is the text the model reads
- [security] Tool “contact_enrichment_evidence” rewrote its description, which is the text the model reads
- [security] Tool “person_enrichment_evidence” rewrote its description, which is the text the model reads
- [functional regression] Schema quality: 50 → 57
- [functional] Server version: 1.31.1 → 1.32.0
- [cosmetic] “company_enrichment_evidence” added an optional parameter “birth_date”
- [cosmetic] “company_enrichment_evidence” added an optional parameter “contact”
- [cosmetic] “company_enrichment_evidence” added an optional parameter “country”
- [cosmetic] “company_enrichment_evidence” added an optional parameter “email”
- [cosmetic] “company_enrichment_evidence” added an optional parameter “email_hash”
- [cosmetic] “company_enrichment_evidence” added an optional parameter “entity”
- [cosmetic] “company_enrichment_evidence” added an optional parameter “first_name”
- [cosmetic] “company_enrichment_evidence” added an optional parameter “identifier”
- [cosmetic] “company_enrichment_evidence” added an optional parameter “input”
- [cosmetic] “company_enrichment_evidence” added an optional parameter “last_name”
- [cosmetic] “company_enrichment_evidence” added an optional parameter “lid”
- [cosmetic] “company_enrichment_evidence” added an optional parameter “locality”
- [cosmetic] “company_enrichment_evidence” added an optional parameter “minimum_likelihood”
- [cosmetic] “company_enrichment_evidence” added an optional parameter “pdl_id”
- [cosmetic] “company_enrichment_evidence” added an optional parameter “person”
- [cosmetic] “company_enrichment_evidence” added an optional parameter “phone”
- [cosmetic] “company_enrichment_evidence” added an optional parameter “postal_code”
- [cosmetic] “company_enrichment_evidence” added an optional parameter “query”
- [cosmetic] “company_enrichment_evidence” added an optional parameter “region”
- [cosmetic] “company_enrichment_evidence” added an optional parameter “school”
- [cosmetic] “company_enrichment_evidence” added an optional parameter “street_address”
- [cosmetic] “company_enrichment_evidence” added an optional parameter “subject”
- [cosmetic] “contact_enrichment_evidence” added an optional parameter “birth_date”
- [cosmetic] “contact_enrichment_evidence” added an optional parameter “contact”
- [cosmetic] “contact_enrichment_evidence” added an optional parameter “country”
- [cosmetic] “contact_enrichment_evidence” added an optional parameter “email_hash”
- [cosmetic] “contact_enrichment_evidence” added an optional parameter “entity”
- [cosmetic] “contact_enrichment_evidence” added an optional parameter “first_name”
- [cosmetic] “contact_enrichment_evidence” added an optional parameter “identifier”
- [cosmetic] “contact_enrichment_evidence” added an optional parameter “input”
- [cosmetic] “contact_enrichment_evidence” added an optional parameter “last_name”
- [cosmetic] “contact_enrichment_evidence” added an optional parameter “lid”
- [cosmetic] “contact_enrichment_evidence” added an optional parameter “locality”
- [cosmetic] “contact_enrichment_evidence” added an optional parameter “pdl_id”
- [cosmetic] “contact_enrichment_evidence” added an optional parameter “person”
- [cosmetic] “contact_enrichment_evidence” added an optional parameter “phone”
- [cosmetic] “contact_enrichment_evidence” added an optional parameter “postal_code”
- [cosmetic] “contact_enrichment_evidence” added an optional parameter “query”
- [cosmetic] “contact_enrichment_evidence” added an optional parameter “region”
- [cosmetic] “contact_enrichment_evidence” added an optional parameter “school”
- [cosmetic] “contact_enrichment_evidence” added an optional parameter “street_address”
- [cosmetic] “contact_enrichment_evidence” added an optional parameter “subject”
- [cosmetic] “contact_enrichment_evidence” added an optional parameter “ticker”
- [cosmetic] “contact_enrichment_evidence” added an optional parameter “website”
- [cosmetic] “person_enrichment_evidence” added an optional parameter “birth_date”
- [cosmetic] “person_enrichment_evidence” added an optional parameter “contact”
- [cosmetic] “person_enrichment_evidence” added an optional parameter “country”
- [cosmetic] “person_enrichment_evidence” added an optional parameter “email_hash”
- [cosmetic] “person_enrichment_evidence” added an optional parameter “entity”
- [cosmetic] “person_enrichment_evidence” added an optional parameter “first_name”
- [cosmetic] “person_enrichment_evidence” added an optional parameter “identifier”
- [cosmetic] “person_enrichment_evidence” added an optional parameter “input”
- [cosmetic] “person_enrichment_evidence” added an optional parameter “last_name”
- [cosmetic] “person_enrichment_evidence” added an optional parameter “lid”
- [cosmetic] “person_enrichment_evidence” added an optional parameter “locality”
- [cosmetic] “person_enrichment_evidence” added an optional parameter “pdl_id”
- [cosmetic] “person_enrichment_evidence” added an optional parameter “person”
- [cosmetic] “person_enrichment_evidence” added an optional parameter “phone”
- [cosmetic] “person_enrichment_evidence” added an optional parameter “postal_code”
- [cosmetic] “person_enrichment_evidence” added an optional parameter “query”
- [cosmetic] “person_enrichment_evidence” added an optional parameter “region”
- [cosmetic] “person_enrichment_evidence” added an optional parameter “school”
- [cosmetic] “person_enrichment_evidence” added an optional parameter “street_address”
- [cosmetic] “person_enrichment_evidence” added an optional parameter “subject”
- [cosmetic] “person_enrichment_evidence” added an optional parameter “ticker”
- [cosmetic] “person_enrichment_evidence” added an optional parameter “website”
- [cosmetic] “company_enrichment_evidence” reworded the description of “company”
- [cosmetic] “contact_enrichment_evidence” reworded the description of “company”
- [cosmetic] “person_enrichment_evidence” reworded the description of “company”

### 2026-09-17 (score 62, +1)

No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.

## MCP tools (124)

### `phion_execute` (~110 tokens)

Universal PHION execution gateway: enforce a budget and persistent idempotency, execute one selected PHION service, evaluate acceptance criteria, and return a signed completion envelope. No gateway surcharge; the selected service price applies.

Input parameters:

- `acceptance_criteria` (array)
- `dry_run` (boolean)
- `idempotency_key` (string, required)
- `input` (object, required)
- `max_budget_atomic` (string, required)
- `objective` (string, required)
- `target_service` (string, required)

### `index_feed` (~53 tokens)

PHION Index Feed

Canonical catalog snapshot or digest-based delta with exact HTTP/MCP records, PHION Execute templates and signed evidence; 0.005 USDC.

Input parameters:

- `mode` (required)
- `since_snapshot_sha256` (string)

### `preflight` (~23 tokens)

Free URL safety and reachability check.

Input parameters:

- `url` (string, required)

### `try_service` (~35 tokens)

Free representative preview, exact price and upgrade instructions for any PHION paid service; no wallet required.

Input parameters:

- `service` (string, required)

### `schema_normalize_free` (~46 tokens)

Free, rate-limited payload validation and safe key normalization before payment. Payment-critical values are never changed.

Input parameters:

- `payload` (object, required)
- `target_service` (string, required)

### `payment_diagnose` (~87 tokens)

Free diagnosis of the exact payment-funnel stage and machine-readable recovery actions for any PHION service.

Input parameters:

- `body_valid` (boolean)
- `error_code` (string)
- `has_payment_signature` (boolean)
- `http_status` (integer)
- `selected_network` (string)
- `service` (string, required)
- `x402_version` (string)

### `verify` (~35 tokens)

Free verification of a PHION signed receipt.

Input parameters:

- `content`
- `receipt` (object, required)
- `sources` (array)

### `attest` (~44 tokens)

x402 paid signed JSON attestation; 0.001 USDC on Base.

Input parameters:

- `content` (required)
- `sources` (array)
- `ttl_seconds` (integer)

### `payment_preflight` (~63 tokens)

Fail-closed x402 v2 firewall for network, asset, recipient, amount, scheme, resource host and expiry; 0.002 USDC.

Input parameters:

- `intent_id` (string)
- `payment_requirement` (object, required)
- `policy` (object, required)

### `fetch_evidence` (~45 tokens)

Independently fetch bounded public evidence with redirect/DNS/connected-address SSRF checks, hashes and injection screening; 0.004 USDC.

Input parameters:

- `url` (string, required)

### `mandate_reserve` (~78 tokens)

Atomic spending reservation with cumulative cap and conflict-safe idempotency; 0.004 USDC.

Input parameters:

- `amount` (string, required)
- `capability_token` (string, required)
- `cumulative_limit` (string, required)
- `idempotency_key` (string, required)
- `mandate_id` (string, required)
- `ttl_seconds` (integer)

### `inspect_agent` (~50 tokens)

Pre-payment agent inspection across x402, A2A, ERC-8004, OpenAPI and MCP; failed inspections are not charged; 0.009 USDC.

Input parameters:

- `url` (string, required)

### `journey_verify` (~53 tokens)

Verify hash continuity, timestamps and ordered intent→quote→payment→delivery lifecycle; 0.010 USDC.

Input parameters:

- `events` (array, required)
- `expected` (object)
- `journey_id` (string, required)

### `transaction_assurance` (~74 tokens)

End-to-end settlement, timestamp, delivery-hash and deterministic acceptance assurance; 0.015 USDC.

Input parameters:

- `acceptance` (array)
- `delivery` (object, required)
- `intent` (object, required)
- `offer` (object, required)
- `payment` (object, required)
- `transaction_id` (string, required)

### `transaction_recovery` (~65 tokens)

Failure classification and non-repeating recovery plan with validated attempt history; 0.010 USDC.

Input parameters:

- `assurance` (object, required)
- `attempts` (array)
- `payment` (object, required)
- `policy` (object, required)
- `transaction_id` (string, required)

### `schema_normalize` (~47 tokens)

Safe alias normalization that refuses ambiguous canonical/alias collisions and never changes payment values; 0.001 USDC.

Input parameters:

- `payload` (object, required)
- `target_service` (string, required)

### `agent_reputation_evidence` (~57 tokens)

Evidence-bounded agent reputation assessment with confidence, coverage, provenance limitations and a signed receipt; 0.005 USDC.

Input parameters:

- `evidence` (array)
- `signals` (object)
- `subject` (object, required)

### `counterparty_risk_preflight` (~63 tokens)

Deterministic counterparty policy preflight using supplied reputation evidence and transaction limits; 0.003 USDC.

Input parameters:

- `policy` (object)
- `reputation` (object)
- `subject` (object, required)
- `transaction` (object, required)

### `tool_output_firewall` (~52 tokens)

Inspect untrusted MCP/tool output before it enters agent context or triggers an action; 0.002 USDC.

Input parameters:

- `output` (required)
- `policy` (object)
- `source` (object)

### `delegation_scope_guard` (~48 tokens)

Least-privilege guard for agent-to-agent delegation scope, destinations, budget and expiry; 0.003 USDC.

Input parameters:

- `delegation` (object, required)
- `policy` (object, required)

### `memory_write_guard` (~43 tokens)

Screen persistent memory writes for poisoning, unsafe instructions and missing provenance; 0.002 USDC.

Input parameters:

- `policy` (object)
- `write` (object, required)

### `mcp_manifest_firewall` (~41 tokens)

Inspect an MCP manifest before installation or trust; 0.002 USDC.

Input parameters:

- `manifest` (object, required)
- `policy` (object)

### `tool_call_policy_guard` (~50 tokens)

Bind a proposed tool call to declared intent and execution policy; 0.002 USDC.

Input parameters:

- `call` (object, required)
- `intent` (object, required)
- `policy` (object, required)

### `data_egress_preflight` (~47 tokens)

Inspect outbound agent data and destination before transmission; 0.002 USDC.

Input parameters:

- `destination` (object, required)
- `payload` (required)
- `policy` (object)

### `agent_budget_guard` (~28 tokens)

Enforce per-call, task, session and period budgets; 0.002 USDC.

### `idempotency_replay_guard` (~31 tokens)

Detect safe replays and conflicting idempotency-key reuse; 0.002 USDC.

### `human_approval_policy` (~29 tokens)

Classify an action as automatic, approval-required or denied; 0.002 USDC.

### `secret_redaction_preflight` (~27 tokens)

Detect and redact common secret indicators before transmission; 0.002 USDC.

### `oauth_token_audience_guard` (~30 tokens)

Validate declared OAuth audience and issuer; never send raw tokens; 0.002 USDC.

### `redirect_callback_validator` (~25 tokens)

Validate HTTPS callbacks and redirect host allowlists; 0.002 USDC.

### `tool_capability_drift_monitor` (~26 tokens)

Detect tool capability or manifest drift; 0.002 USDC.

### `mcp_server_identity_evidence` (~31 tokens)

Bind MCP domain, endpoint, manifest, key and version; 0.003 USDC.

### `agent_task_handoff_receipt` (~27 tokens)

Sign a bounded agent-task handoff; 0.003 USDC.

### `context_provenance_labeler` (~29 tokens)

Hash and label context integrity, confidentiality and source; 0.002 USDC.

### `signed_result_comparator` (~26 tokens)

Compare agent results and sign agreement or conflict; 0.003 USDC.

### `service_sla_attestation` (~27 tokens)

Sign availability and latency calculations from bounded samples; 0.004 USDC.

### `payment_route_selector` (~55 tokens)

Payment Route Selector

Reject impossible x402 routes, rank safe eligible routes by policy and return the exact next payment action; read-only, deterministic, 0.002 USDC.

Input parameters:

- `policy` (object, required)
- `routes` (array, required)

### `x402_quote_comparator` (~40 tokens)

x402 Quote Comparator

Validate x402 v2 fields and compare only quotes sharing asset and decimals; 0.002 USDC.

Input parameters:

- `quotes` (array, required)

### `payment_receipt_reconciler` (~49 tokens)

Payment Receipt Reconciler

Compare canonical and common x402 payment/receipt aliases, settlement state and coverage; 0.003 USDC.

Input parameters:

- `payment` (object, required)
- `receipt` (object, required)

### `duplicate_charge_detector` (~36 tokens)

Duplicate Charge Detector

Detect repeated transaction hashes, payment identifiers and idempotent intents; 0.003 USDC.

Input parameters:

- `charges` (array, required)

### `subscription_spend_guard` (~56 tokens)

Subscription Spend Guard

Bind one recurring charge to approval, merchant, due time and per-charge/period budgets; 0.003 USDC.

Input parameters:

- `policy` (object, required)
- `subscription` (object, required)
- `usage` (object, required)

### `webhook_verifier` (~63 tokens)

Webhook Verifier

Fail-closed RFC 9421-style webhook preflight requiring trusted key, algorithm, nonce, freshness, replay status and signature coverage of method, target and content; 0.003 USDC.

Input parameters:

- `event` (object, required)
- `verification` (object, required)

### `delivery_evidence` (~47 tokens)

Delivery Evidence

Bind successful delivery to transaction, request and matching 64-hex expected/observed content hashes without echoing content; 0.003 USDC.

Input parameters:

- `delivery` (object, required)

### `inter_agent_policy_evaluator` (~46 tokens)

Inter-Agent Policy Evaluator

Require policy identity, subject, action, lifetime and valid decisions; compute the restrictive cap and shared actions; 0.003 USDC.

Input parameters:

- `policies` (array, required)

### `concurrency_guard` (~94 tokens)

Concurrency Guard

Fail closed unless capacity counter is fresh and the request carries a lease plus idempotency binding; 0.002 USDC.

Input parameters:

- `active_slots` (integer, required)
- `counter_observed_at` (integer, required)
- `idempotency_key` (string, required)
- `lease_id` (string, required)
- `lease_valid_until` (integer, required)
- `policy` (object, required)
- `requested_slots` (integer, required)

### `resource_cycle_guard` (~52 tokens)

Resource Cycle Guard

Require per-step identity, token and cost counters; detect repeated nodes/edges and enforce all three hard caps; 0.002 USDC.

Input parameters:

- `policy` (object, required)
- `trace` (array, required)

### `abandoned_tool_detector` (~44 tokens)

Abandoned Tool Detector

Require stale success plus multiple independent failed probes before classifying likely abandonment; 0.003 USDC.

Input parameters:

- `policy` (object, required)
- `tool` (object, required)

### `manifest_version_diff` (~46 tokens)

Recursive manifest diff that requires explicit versions and flags sensitive changes without a version advance; 0.002 USDC.

Input parameters:

- `current` (object, required)
- `previous` (object, required)

### `dependency_provenance_assessment` (~51 tokens)

Fail closed on empty dependency sets or absent registry policy; distinguish digest declarations from verified provenance; 0.003 USDC.

Input parameters:

- `dependencies` (array, required)
- `policy` (object, required)

### `conflict_resolution` (~49 tokens)

Resolve or abstain; every candidate must bind source, value hash, observation time and bounded confidence; 0.003 USDC.

Input parameters:

- `candidates` (array, required)
- `policy` (object, required)

### `data_freshness_certificate` (~52 tokens)

Certify freshness only when timestamp is bound to source URI and a 64-hex content hash; 0.002 USDC.

Input parameters:

- `data` (object, required)
- `policy` (object, required)

### `domain_ownership_evidence` (~52 tokens)

Require a fresh domain-bound DNS-01/HTTP-01 challenge and separate control from legal ownership; 0.003 USDC.

Input parameters:

- `domain` (string, required)
- `evidence` (object, required)

### `purpose_bound_consent` (~56 tokens)

Fail-closed consent bound to ID, subject, recipient, purpose, scope, issue/expiry and checked revocation state; 0.003 USDC.

Input parameters:

- `action` (object, required)
- `consent` (object, required)

### `retention_deletion_receipt` (~52 tokens)

Separate requested, operator-completed and evidence-verified retention/deletion states using content and evidence hashes; 0.003 USDC.

Input parameters:

- `action` (object, required)
- `record` (object, required)

### `interrupted_task_recovery` (~62 tokens)

Resume only when task/checkpoint identity, sequence, deadline, attempt budget, idempotency and side effects are explicit; 0.003 USDC.

Input parameters:

- `checkpoint` (object, required)
- `policy` (object, required)
- `task` (object, required)

### `portable_observability_audit` (~46 tokens)

Validate event identity, timestamps, hash chain and W3C-compatible lowercase nonzero trace/span identifiers; 0.004 USDC.

Input parameters:

- `events` (array, required)

### `rwa_asset_due_diligence` (~61 tokens)

Fail-closed issuer, contract, jurisdiction, custody and documentation coverage with independently fetched evidence; 0.019 USDC.

Input parameters:

- `asset` (object, required)
- `declared_facts` (object)
- `source_urls` (array)

### `rwa_compliance` (~61 tokens)

Fail-closed RWA transfer decision requiring explicit jurisdiction, KYC, allowlist, limit and transfer-window checks; 0.012 USDC.

Input parameters:

- `asset` (object, required)
- `policy` (object, required)
- `source_urls` (array)

### `rwa_nav_reserve` (~86 tokens)

Compare declared NAV and reserve ratios with structured observed facts plus independently fetched evidence; returns discrepancies in basis points and fails closed on incomplete evidence; 0.015 USDC.

Input parameters:

- `asset` (object, required)
- `declared_facts` (object, required)
- `observed_facts` (object, required)
- `source_urls` (array, required)
- `tolerance_bps` (integer)

### `rwa_transaction_assurance` (~59 tokens)

Verify an RWA asset, payment, delivery and transfer restrictions; 0.020 USDC.

Input parameters:

- `asset` (object, required)
- `policy` (object, required)
- `source_urls` (array)
- `transaction` (object, required)

### `rwa_corporate_actions` (~68 tokens)

Detect and sign material RWA changes in NAV, income, maturity, redemption or freeze state; 0.012 USDC.

Input parameters:

- `asset` (object, required)
- `current_state` (object, required)
- `previous_state` (object, required)
- `source_urls` (array)

### `rwa_sanctions_screening_evidence` (~64 tokens)

Evidence-based literal subject screening against observed official US/EU sanctions sources; 0.015 USDC. Not legal clearance or wallet attribution.

Input parameters:

- `jurisdictions` (array, required)
- `source_urls` (array)
- `subject` (object, required)

### `verified_web_extract` (~51 tokens)

Bounded public web extraction with source, timestamp and hashes; 0.003 USDC.

Input parameters:

- `expected_fields` (array)
- `query` (string)
- `source_urls` (array, required)

### `entity_enrichment_evidence` (~52 tokens)

Source-bounded entity field coverage with explicit missing facts; 0.008 USDC.

Input parameters:

- `expected_fields` (array)
- `source_urls` (array, required)
- `subject` (object)

### `social_source_evidence` (~50 tokens)

Attributable public social-source observations with identity limitations; 0.006 USDC.

Input parameters:

- `query` (string)
- `source_urls` (array, required)
- `subject` (object)

### `market_data_snapshot` (~48 tokens)

Timestamped public market-data snapshot with provenance; 0.005 USDC.

Input parameters:

- `expected_fields` (array)
- `source_urls` (array, required)
- `subject` (object)

### `onchain_evidence` (~42 tokens)

Public explorer or RPC response evidence with immutable hashes; 0.004 USDC.

Input parameters:

- `source_urls` (array, required)
- `subject` (object)

### `verified_news_monitor` (~40 tokens)

Literal query evidence across bounded public news sources; 0.006 USDC.

Input parameters:

- `query` (string)
- `source_urls` (array, required)

### `multi_source_fact_bundle` (~48 tokens)

Independent source observations with agreement made explicit; 0.005 USDC.

Input parameters:

- `expected_fields` (array)
- `query` (string)
- `source_urls` (array, required)

### `document_to_verified_json` (~50 tokens)

Public text, HTML, JSON or XML normalized to source-backed JSON; no OCR; 0.010 USDC.

Input parameters:

- `expected_fields` (array)
- `source_urls` (array, required)

### `source_backed_search` (~43 tokens)

Literal search over supplied public sources with citations and hashes; 0.004 USDC.

Input parameters:

- `query` (string, required)
- `source_urls` (array, required)

### `live_data_freshness` (~44 tokens)

Evaluate live source observation against explicit maximum age; 0.002 USDC.

Input parameters:

- `max_age_seconds` (integer, required)
- `source_urls` (array, required)

### `person_enrichment_evidence` (~263 tokens)

Person enrichment with free input preflight, provider attribution, likelihood, limitations and signed receipt; 0.006 USDC.

Input parameters:

- `birth_date` (string)
- `company`: Company name or nested input object
- `contact` (object)
- `country` (string)
- `email` (string)
- `email_hash` (string)
- `entity` (object)
- `first_name` (string)
- `identifier` (string): Email, profile URL, phone, company domain, ticker or name; interpreted by service
- `input` (object)
- `last_name` (string)
- `lid` (string)
- `locality` (string)
- `location` (string)
- `minimum_likelihood` (integer)
- `name` (string)
- `pdl_id` (string)
- `person` (object)
- `phone` (string)
- `postal_code` (string)
- `profile` (string)
- `query` (object)
- `region` (string)
- `school` (string)
- `street_address` (string)
- `subject` (object)
- `ticker` (string)
- `website` (string)

### `company_enrichment_evidence` (~259 tokens)

Company enrichment with free input preflight, provider attribution and signed evidence; 0.005 USDC.

Input parameters:

- `birth_date` (string)
- `company`: Company name or nested input object
- `contact` (object)
- `country` (string)
- `email` (string)
- `email_hash` (string)
- `entity` (object)
- `first_name` (string)
- `identifier` (string): Email, profile URL, phone, company domain, ticker or name; interpreted by service
- `input` (object)
- `last_name` (string)
- `lid` (string)
- `locality` (string)
- `location` (string)
- `minimum_likelihood` (integer)
- `name` (string)
- `pdl_id` (string)
- `person` (object)
- `phone` (string)
- `postal_code` (string)
- `profile` (string)
- `query` (object)
- `region` (string)
- `school` (string)
- `street_address` (string)
- `subject` (object)
- `ticker` (string)
- `website` (string)

### `contact_enrichment_evidence` (~260 tokens)

Business-contact enrichment with free input preflight, identity limitations and signed receipt; 0.007 USDC.

Input parameters:

- `birth_date` (string)
- `company`: Company name or nested input object
- `contact` (object)
- `country` (string)
- `email` (string)
- `email_hash` (string)
- `entity` (object)
- `first_name` (string)
- `identifier` (string): Email, profile URL, phone, company domain, ticker or name; interpreted by service
- `input` (object)
- `last_name` (string)
- `lid` (string)
- `locality` (string)
- `location` (string)
- `minimum_likelihood` (integer)
- `name` (string)
- `pdl_id` (string)
- `person` (object)
- `phone` (string)
- `postal_code` (string)
- `profile` (string)
- `query` (object)
- `region` (string)
- `school` (string)
- `street_address` (string)
- `subject` (object)
- `ticker` (string)
- `website` (string)

### `mcp_2026_compatibility_gateway` (~29 tokens)

MCP 2026 Compatibility Gateway

MCP 2026 Compatibility Gateway; deterministic signed assessment over supplied input.

### `durable_agent_task` (~20 tokens)

Durable Agent Task

Durable Agent Task; deterministic signed assessment over supplied input.

### `task_checkpoint_evidence` (~22 tokens)

Task Checkpoint Evidence

Task Checkpoint Evidence; deterministic signed assessment over supplied input.

### `task_cancel_assurance` (~21 tokens)

Task Cancel Assurance

Task Cancel Assurance; deterministic signed assessment over supplied input.

### `agent_approval_relay` (~22 tokens)

Agent Approval Relay

Agent Approval Relay; deterministic signed assessment over supplied input.

### `capability_negotiation_preflight` (~25 tokens)

Capability Negotiation Preflight

Capability Negotiation Preflight; deterministic signed assessment over supplied input.

### `mcp_catalog_cache_guard` (~23 tokens)

MCP Catalog Cache Guard

MCP Catalog Cache Guard; deterministic signed assessment over supplied input.

### `oauth_issuer_binding_evidence` (~25 tokens)

OAuth Issuer Binding Evidence

OAuth Issuer Binding Evidence; deterministic signed assessment over supplied input.

### `mcp_a2a_task_bridge` (~27 tokens)

MCP-A2A Task Bridge

MCP-A2A Task Bridge; deterministic signed assessment over supplied input.

### `quote_freshness_guard` (~23 tokens)

Quote Freshness Guard

Quote Freshness Guard; deterministic signed assessment over supplied input.

### `delegated_credential_guard` (~22 tokens)

Delegated Credential Guard

Delegated Credential Guard; deterministic signed assessment over supplied input.

### `agent_session_continuity` (~23 tokens)

Agent Session Continuity

Agent Session Continuity; deterministic signed assessment over supplied input.

### `task_lease_guard` (~21 tokens)

Task Lease Guard

Task Lease Guard; deterministic signed assessment over supplied input.

### `tool_result_schema_validator` (~22 tokens)

Tool Result Schema Validator

Tool Result Schema Validator; deterministic signed assessment over supplied input.

### `agent_memory_provenance` (~23 tokens)

Agent Memory Provenance

Agent Memory Provenance; deterministic signed assessment over supplied input.

### `payment_delivery_atomicity` (~22 tokens)

Payment Delivery Atomicity

Payment Delivery Atomicity; deterministic signed assessment over supplied input.

### `service_failover_selector` (~22 tokens)

Service Failover Selector

Service Failover Selector; deterministic signed assessment over supplied input.

### `agent_rate_limit_negotiator` (~25 tokens)

Agent Rate Limit Negotiator

Agent Rate Limit Negotiator; deterministic signed assessment over supplied input.

### `execution_cost_estimator` (~22 tokens)

Execution Cost Estimator

Execution Cost Estimator; deterministic signed assessment over supplied input.

### `cross_agent_receipt_bundle` (~23 tokens)

Cross-Agent Receipt Bundle

Cross-Agent Receipt Bundle; deterministic signed assessment over supplied input.

### `capability_verification` (~35 tokens)

Capability Verification

Separate claimed capabilities from independently evidenced successful demonstrations.; 0.003 USDC. Deterministic, evidence-bounded and signed.

### `capability_benchmark` (~42 tokens)

Capability Benchmark

Measure reproducible success, latency and cost from versioned evidence-bound benchmark cases.; 0.004 USDC. Deterministic, evidence-bounded and signed.

### `sybil_reputation_guard` (~41 tokens)

Sybil Reputation Guard

Combine multiple bounded Sybil signals while abstaining without independent evidence.; 0.004 USDC. Deterministic, evidence-bounded and signed.

### `agent_behavior_fingerprint` (~42 tokens)

Agent Behavior Fingerprint

Create a privacy-minimized behavioral commitment without retaining payloads or raw identifiers.; 0.003 USDC. Deterministic, evidence-bounded and signed.

### `trust_anomaly_detector` (~38 tokens)

Trust Anomaly Detector

Detect material drift between comparable trust vectors without asserting misconduct.; 0.003 USDC. Deterministic, evidence-bounded and signed.

### `economic_loop_detector` (~39 tokens)

Economic Loop Detector

Detect self-transfer and reciprocal economic patterns without presenting correlation as fraud.; 0.004 USDC. Deterministic, evidence-bounded and signed.

### `provider_quality_predictor` (~42 tokens)

Provider Quality Predictor

Estimate provider success, quality, latency and cost using transparent sample-aware statistics.; 0.004 USDC. Deterministic, evidence-bounded and signed.

### `transaction_risk_score` (~39 tokens)

Transaction Risk Score

Estimate evidence-supported loss probability without selling insurance or assuming liability.; 0.004 USDC. Deterministic, evidence-bounded and signed.

### `payment_optimizer` (~38 tokens)

Payment Optimizer

Rank only integration-tested payment routes under explicit cost and latency constraints.; 0.003 USDC. Deterministic, evidence-bounded and signed.

### `x402_v2_router` (~43 tokens)

x402 v2 Router

Select an exactly compatible x402 v2 payment requirement without receiving private keys.; 0.003 USDC. Deterministic, evidence-bounded and signed.

### `erc8004_identity_evidence` (~46 tokens)

ERC-8004 Identity Evidence

Bind an ERC-8004 registry identity to evidence while separating registration from ownership.; 0.004 USDC. Deterministic, evidence-bounded and signed.

### `erc8004_reputation_intelligence` (~43 tokens)

ERC-8004 Reputation Intelligence

Aggregate diverse verified reputation observations with low-sample abstention.; 0.004 USDC. Deterministic, evidence-bounded and signed.

### `delegated_spend_policy` (~42 tokens)

Delegated Spend Policy

Fail closed when delegated authority, per-call limit or remaining budget is insufficient.; 0.003 USDC. Deterministic, evidence-bounded and signed.

### `ap2_mandate_bridge` (~42 tokens)

AP2 Mandate Bridge

Map mandate fields for review without advertising unsupported AP2 production authorization.; 0.004 USDC. Deterministic, evidence-bounded and signed.

### `a2a_transaction_bridge` (~42 tokens)

A2A Transaction Bridge

Bind an A2A task to a transaction without silently transferring authority.; 0.004 USDC. Deterministic, evidence-bounded and signed.

### `mcp_transaction_gateway` (~41 tokens)

MCP Transaction Gateway

Bind an MCP tool call to transaction evidence without granting undeclared authority.; 0.004 USDC. Deterministic, evidence-bounded and signed.

### `proof_of_service` (~41 tokens)

Proof of Service

Commit request, authority, execution, payment and delivery evidence in one proof.; 0.005 USDC. Deterministic, evidence-bounded and signed.

### `automated_dispute_bundle` (~37 tokens)

Automated Dispute Bundle

Assemble failure evidence and recommend resolution without executing refunds.; 0.005 USDC. Deterministic, evidence-bounded and signed.

### `transaction_recovery_v2` (~38 tokens)

Transaction Recovery v2

Recommend bounded recovery and reconcile ambiguous payments before retry.; 0.005 USDC. Deterministic, evidence-bounded and signed.

### `reputation_update_receipt` (~39 tokens)

Reputation Update Receipt

Recommend a bounded auditable reputation update from verified outcome evidence.; 0.004 USDC. Deterministic, evidence-bounded and signed.

### `agent_economic_graph` (~40 tokens)

Agent Economic Graph

Build privacy-bounded economic relationships only from supplied nodes and edges.; 0.005 USDC. Deterministic, evidence-bounded and signed.

### `market_demand_predictor` (~39 tokens)

Market Demand Predictor

Forecast verified demand trends while abstaining on insufficient history.; 0.005 USDC. Deterministic, evidence-bounded and signed.

### `service_gap_detector` (~37 tokens)

Service Gap Detector

Detect capability shortages using verified demand and verified provider supply.; 0.004 USDC. Deterministic, evidence-bounded and signed.

### `price_discovery_engine` (~42 tokens)

Price Discovery Engine

Derive price bands only from settled observations, never traffic or unsigned quotes.; 0.005 USDC. Deterministic, evidence-bounded and signed.

### `sla_risk_predictor` (~39 tokens)

SLA Risk Predictor

Estimate SLA failure probability from bounded success and latency evidence.; 0.004 USDC. Deterministic, evidence-bounded and signed.

### `dynamic_service_pricing` (~39 tokens)

Dynamic Service Pricing

Propose a capped shadow price without changing the live catalog.; 0.004 USDC. Deterministic, evidence-bounded and signed.

### `autonomous_procurement` (~37 tokens)

Autonomous Procurement

Recommend a verified eligible provider under a mandate without purchasing.; 0.005 USDC. Deterministic, evidence-bounded and signed.

### `multi_agent_escrow` (~42 tokens)

Multi-Agent Escrow

Recommend hold or release from evidence without PHION custody or fund movement.; 0.005 USDC. Deterministic, evidence-bounded and signed.

### `cross_protocol_receipt` (~35 tokens)

Cross-Protocol Receipt

Bundle consistent transaction commitments across multiple protocols.; 0.004 USDC. Deterministic, evidence-bounded and signed.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/systems-phion-evidence-engine/phion#diagnostics

## Score history

- 2026-09-25: 66
- 2026-09-24: 67
- 2026-09-23: 66
- 2026-09-22: 66
- 2026-09-21: 65
- 2026-09-20: 63
- 2026-09-19: 63
- 2026-09-18: 62
- 2026-09-17: 62
- 2026-09-16: 61
- 2026-09-15: 61
- 2026-09-14: 60
- 2026-09-13: 59
- 2026-09-12: 59
- 2026-09-11: 59

## Common questions

### What is the PHION Agent Trust Infrastructure MCP server?

PHION Agent Trust Infrastructure is an MCP server listed in the public MCP registry as systems.phion/evidence-engine. 118 agent services with free discovery, intent, x402 terms and signed verification. This page covers its hosted endpoint (https://phion.systems/mcp).

### Is the PHION Agent Trust Infrastructure MCP server safe to use?

PHION Agent Trust Infrastructure scores 66 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the PHION Agent Trust Infrastructure MCP server expose?

PHION Agent Trust Infrastructure exposes 124 tools: phion_execute, index_feed, preflight, try_service, schema_normalize_free, and 119 more. Their descriptions and schemas cost roughly 5,964 tokens of context every time the server is loaded.

### Does the PHION Agent Trust Infrastructure MCP server require authentication?

No. We connected to PHION Agent Trust Infrastructure without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the PHION Agent Trust Infrastructure MCP server still maintained?

PHION Agent Trust Infrastructure is still listed as active in the MCP registry. We last reached this channel on 25 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://phion.systems/mcp
- Website: https://phion.systems/
- Changelog RSS feed: https://verifymcp.io/servers/systems-phion-evidence-engine/phion.xml
- Changelog JSON feed: https://verifymcp.io/servers/systems-phion-evidence-engine/phion.json
- HTML version of this page: https://verifymcp.io/servers/systems-phion-evidence-engine/phion