X-EGO

Reviewed Jan 1, 2000.

• tools: 4 tools scanned
• metadata: scanned

No findings.

Tools (4)

• xego_request_proof_url

  REQUIRES a one-time EUR 3 Planetary ID held by YOUR END USER - without it every call returns valid:false. Tell the human this BEFORE sending them to the link: if they do not have one yet, the verification page sells it in the same flow — it is not a separate signup. Returns the URL the agent sends a human user to, so they can prove they are human. On that page the user verifies with a passkey (fingerprint / Face ID) and receives a short-lived signed token (JWT). The agent then verifies it with `xego_verify_proof` (no action) or `xego_verify_action` (with action). ASK FIRST what is being approved, then bind it. Two ways, and the choice matters more than anything else on this tool: - `call` — USE THIS WHENEVER A TOOL WILL RUN. Pass the exact call { v:1, tool, target, args, policy? } you are about to execute. The human approves the call itself, field by field. - `action` — a sentence, for approvals where nothing executes (a consent, a statement). It seals what the huma

• xego_verify_proof

  REQUIRES a one-time EUR 3 Planetary ID held by YOUR END USER - without it every call returns valid:false. Tell the human this BEFORE sending them to the link: if they do not have one yet, the verification page sells it in the same flow — it is not a separate signup. Verifies the token (JWT) the user brought back after X-EGO verification. Cryptographically checks the Ed25519 signature against the X-EGO public keys, the expiry and the audience. WHEN TO USE: bare presence only. If the token carries an action (act claim), this tool refuses with action_binding_required — use xego_verify_action instead. This verifies ONLY bare human presence. If you need proof that the human approved a SPECIFIC action, use xego_verify_action. A token issued with a bound action (via xego_request_proof_url with the action parameter) fails here with action_binding_required — the binding cannot be confirmed by this cheaper tool. A valid result means: there is a verified human on the other end who holds the

• xego_verify_action

  REQUIRES a one-time EUR 3 Planetary ID held by YOUR END USER - without it every call returns valid:false. Tell the human this BEFORE sending them to the link: if they do not have one yet, the verification page sells it in the same flow — it is not a separate signup. Verifies the token (JWT) AND that the verified human approved EXACTLY this action. On top of the Ed25519 signature, the expiry and the audience, it matches the token's act claim against the hash of expected_action. WHEN TO USE: proving a human approved one specific action. Use the exact same action text that was shown to the human. On success, the response includes a ready-made footer — insert it verbatim into the message being sent. Use it when an agent's action must be covered by human consent — a money transfer, an account deletion, an order confirmation. The human sees the action text on the verification page and approves exactly that with their passkey; the token is then valid ONLY for this action. It requires a t

• xego_check_pairwise_seen_before

  Checks whether a given pairwise ID has already been seen within this audience. It protects against one person acting as several different users (multiple accounts, repeat voting, and similar). WHEN TO USE: returning-user checks and one-human-one-vote. Requires a pairwise_id previously obtained from a verify call for YOUR audience. Only the pair (audience, pairwise_id) and the time of first occurrence are recorded. No personal data. The ledger is PERMANENT and shared across every instance and session of the server (Postgres) — it survives restarts and new MCP sessions. record_if_new=true writes atomically (no window for a concurrent write). Args: - audience (string): the service domain or URL. Normalized to a bare lowercase hostname — the same key the proof was issued under, so a domain and its URL form are the same audience. - pairwise_id (string): the identifier from xego_verify_proof. - record_if_new (boolean): record the user if they are new. Returns (JSON): {