KYA backed by a real company: e-CNPJ-signed agent mandates, revocation-checked, signed verdicts
| Endpoint | https://kya-br-agents.marcelfons.workers.dev/mcp (streamable-http) |
|---|---|
| Registry version | 0.4.1 |
| Now | 15 tools · grade C (71) · pin ts_53c3678dfeaa3af90a3ba19e5ef5ffb0 · protocol 2025-06-18 |
| First / last listed | 2026-11-09 01:15 UTC / 2026-11-09 01:15 UTC |
| Grade over time | 2026-11-09: C (71), 15 tools |
Is this your server? Own a server? ToolFit hosted watch re-checks it every 24 h ($0.25 per 30 days) or 6 h ($0.60) and sends you an HMAC-signed webhook when its tools or grade change: POST https://api.youraitools.co/toolfit/v1/watch. To opt out, see About & opt-out.
Tools: kya_register kya_verify_paid kya_check_action kya_renew kya_prove kya_principal_match kya_person_agents kya_sign_link kya_verify kya_renew_prove kya_revoke kya_company_agents kya_company_webhook kya_revocations kya_about
kya_register | Register an AI agent for a Brazilian company: agent key (EVM address or Web Bot Auth Ed25519 key), CNPJ and a mandate (JSON, validated against /.well-known/kya-mandate.schema.json). Returns a one-time challenge the agent signs with its key and the company signs with its e-CNPJ (CMS/PKCS#7). Price covers the checks at issuance. params: agent*, cnpj, principal, mandate* |
kya_verify_paid | Same as the free verification, without daily limit, plus a signed receipt of the verification itself (what was checked, when). Pay per call with x402. params: credential_id* |
kya_check_action | Signed verdict: is this action (action, amount, currency, counterparty, payment instrument) inside the agent's mandate and is the credential active? Evaluates the reserved mandate fields; lists the fields it did not evaluate. params: credential_id*, action, amount, currency, counterparty, spent_today, payment_network, payment_ref_sha256 |
kya_renew | Re-issue the credential for 90 more days. The company signs the renewal challenge with an e-CNPJ in force (not revoked); the company must still be ATIVA at the Receita. params: credential_id* |
kya_prove | Free. Send both signatures of the challenge. The e-CNPJ chain is validated against ICP-Brasil roots, the CNPJ must match, the certificate must not be revoked (CRL) and the company must be ATIVA; then the credential is issued (90 days, Ed25519-signed). params: credential_id*, challenge_id*, agent_signature*, ecnpj_signature* |
kya_principal_match | Signed answer ($0.01) for a person's agent (principal.kind person): does the CPF you already have match the e-CPF holder behind it? On a match, a subject_ref of your own for that person (stable for you, different for every verifier). The CPF is never stored, published or revealed; 3 non-matching answers per credential stop your checks. The person sees every check. params: credential_id*, cpf* |
kya_person_agents | Free, person only: every live credential behind your e-CPF and every CPF check made against each one. Sign "KYA Brasil: my agents\nat: <ISO time>" with the e-CPF (valid 10 minutes). params: signed_text*, ecpf_signature* |
kya_sign_link | Free. Link for whoever holds the company's e-CNPJ (owner, accountant): give challenge_id and the agent's signature, get the /sign URL. They see agent, company and mandate and sign in the browser (A1 .pfx) or with any ICP-Brasil signer (A3 token, cloud), or run kya-sign (npm @kya-brasil/agent-tools) with the link. The issuer never sees the certificate. params: credential_id*, challenge_id*, agent_signature |
kya_verify | Free (50/day per IP). The agent's current credential: principal company, mandate, status (active, suspended, revoked, expired) and signature. Also by key: /v1/agents/by-key?kind=&id=. params: credential_id, agent |
kya_renew_prove | Free. Second step of kya_renew: send both signatures of the renewal challenge; the credential is re-issued for 90 days if the e-CNPJ is not revoked and the company is still ATIVA. params: credential_id*, challenge_id*, agent_signature*, ecnpj_signature* |
kya_revoke | Free. The company revokes the credential at once (e-CNPJ-signed request). Revocations are listed at /v1/revocations. params: credential_id*, signed_text*, ecnpj_signature*, reason |
kya_company_agents | Free, company only. Every credential ever registered for your CNPJ, any status, whoever held the certificate (an accountant, another employee). Request signed with your e-CNPJ over "KYA Brasil: agents <cnpj>" + "at: <ISO time>". params: cnpj*, signed_text*, ecnpj_signature* |
kya_company_webhook | Free, company only. Sets the https URL that receives signed events about your agents: credential issued, renewed, suspended, reinstated, revoked. Request signed with your e-CNPJ; url "-" removes it. params: cnpj*, signed_text*, ecnpj_signature* |
kya_revocations | Free. Credentials revoked since a date (default: last 30 days), for verifiers that cache credentials. params: since |
kya_about | Free. What KYA Brasil is, how the credential flow works, prices, and where the schemas and signing keys are. params: none |
Entries describe changes in tool definitions. They are not statements about a server, its quality or its author. The grade measures how the tool definitions fit model providers (token cost, schema compatibility, confusable names) as scored by the ToolFit engine at the time of the listing. JSON: append .json. Opt-out: how or hello@youraitools.co.