Trooth

trooth-mcp

The Trooth Network over the Model Context Protocol. Read any company's public record from Claude, ChatGPT, Cursor, VS Code or any MCP client. No key, no account.

https://api.trooth.co/public/mcp

Trooth operates the Trooth Network: one public, machine-readable record per company, carrying its identity, products, commercial terms, people, documents, security and privacy posture, AI practices, procurement terms and relationships. Every item says who said it. It is Trooth's only product, and it is free.

Trooth witnesses and dates facts. It does not grade, rate or rank anyone. No tool here returns a number that sums a company up.

Is your company on the Trooth Network? Any company can publish one free, public record that buyers, and the AI assistants they use, read directly. [Claim your company's record](https://trooth.co/signup) · See an example

Quick start

Then ask in plain words: *"Read trooth.co's Trust Profile and tell me how it handles customer data."*

Every client's current steps, with install links, are at trooth.co/docs/agents.

Configuration files

The same blocks trooth.co/docs/agents gives, one per client.

Claude Code:

claude mcp add --transport http trooth https://api.trooth.co/public/mcp

Codex, ~/.codex/config.toml:

# or: codex mcp add trooth --url https://api.trooth.co/public/mcp

[mcp_servers.trooth] url = "https://api.trooth.co/public/mcp"

Gemini CLI, settings.json. Use httpUrl: in the Gemini CLI, url is for servers that use server-sent events.

{

"mcpServers": { "trooth": { "httpUrl": "https://api.trooth.co/public/mcp" } } }

Cursor, .cursor/mcp.json:

{

"mcpServers": { "trooth": { "url": "https://api.trooth.co/public/mcp" } } }

VS Code, .vscode/mcp.json:

{

"servers": { "trooth": { "type": "http", "url": "https://api.trooth.co/public/mcp" } } }

Tools

Eleven tools, all read only. Each answers with prose for a person and the same answer as typed structuredContent for a machine, under a declared outputSchema.

Every fact carries one of four provenance words: witnessed, public record, attested or declared. Only the witness statement is signed on a record: Trooth signs witness statements and, for workspaces that create a delegation, delegation receipts and action evidence references; it does not sign the profile, its facts or a company's declarations. Three negatives are kept apart: no (the record holds a negative value), not_published (the company has not published it) and not_read (Trooth's reading did not read it). ## Resources and prompts

resources/list returns seven fixed resources, on every protocol revision the server supports:

resources/templates/list returns two templates, read live: trooth://company/{company} (one company's Trust Profile as Markdown) and trooth://company/{company}/{section} (one section of it).

prompts/list returns four prompts. Each takes one argument.

A sample call

One question asked of one company's record, exactly as the server answered it on 2026-10-17 (the assurance_boundary and content_trust blocks are cut here for length; every answer carries both).

curl -s https://api.trooth.co/public/mcp \

-H 'content-type: application/json' \ -H 'accept: application/json, text/event-stream' \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"trooth_get_fact","arguments":{"company":"trooth.co","question":"q_data_location"}}}'

The tool's structuredContent:

{

"status": "answered", "subject": "trooth.co", "source": { "name": "trooth.co published record (/api/network/profile)", "version": "contract 2", "as_of": "2026-10-17T00:45:45.379Z" }, "fact": { "kind": "question", "id": "q_data_location", "question": "Where is customer data stored and processed, and can a customer choose the region?", "answer_state": "answered", "value": "Production regions: Website: Vercel iad1 (US East), Database: AWS us-east-1 through Neon, API at api.trooth.co: Cloudflare Workers on the global edge; Processing locations: United States (website and database), Cloudflare Eastern North America (account service), Cloudflare edge (API and Kyrie AI inference), Sub-processor regions: trooth.co/subprocessors; Regions a customer can choose: None: every account runs in the same regions", "provenance": "declared", "as_of": "2026-10-17T00:45:45.379Z", "anchor_url": "https://trooth.co/network/company/trooth#q-data-location", "fact_ids": ["hosting.production_regions", "hosting.processing_locations", "hosting.regions_a_customer_can_choose"] } }

The provenance word is declared: the company said it, and the answer says so rather than presenting it as something Trooth observed. The anchor opens the same answer on the company's Trust Profile.

A section a company left empty comes back as not published, never filled in. A company Trooth holds nothing on comes back as an honest absence, which is not a finding about that company.

How it works

Signing in, for trooth_my_company_record

The server's protected-resource metadata is at https://api.trooth.co/.well-known/oauth-protected-resource/public/mcp (RFC 9728) and names Trooth's WorkOS AuthKit issuer. A client registers itself with that issuer and requests a token for resource=https://api.trooth.co/public/mcp (RFC 8707); no scope is required. The tool reads only the workspace linked to the person the token was issued for. The link is made when that person signs in to trooth.co once with Continue with enterprise SSO; until then the tool answers not_linked. A call without a token answers 401 with a WWW-Authenticate header naming the metadata. The token is never stored or forwarded.

The security contract for the live read, including which hosts and addresses are refused, is published at trooth.co/docs/agents#mcp-security-contract.

Troubleshoo