For developers & AI agents

Machine-readable trust for agentic browsing

As AI agents act on a user's behalf — filling a form, entering payment info — they need some way to decide whether a site is safe to interact with, autonomously. This is a public, no-auth tool an agent can call before it does.

Being direct about what this is: there's no mechanism today by which an agent visiting an arbitrary site automatically discovers this. It only helps once you (or whoever builds the agent) deliberately wire it in as a pre-flight check — same as calling any other API. Nothing here fires on its own.

Try it now

This calls the real, live REST API from your browser right now — the same call your agent or script would make. Only registered, ownership-verified domains return a full result.

MCP endpoint

https://api.provadeconsentimento.com.br/mcp

Streamable HTTP transport, no authentication required. Add it as a custom connector in Claude Desktop, or connect with any MCP client.

Claude Desktop config

{
  "mcpServers": {
    "provadeconsentimento": {
      "url": "https://api.provadeconsentimento.com.br/mcp"
    }
  }
}

Tools

check_site_trust(domain: str) -> JSON

check_multiple_sites(domains: list[str]) -> JSONUp to 20 domains in one call — for comparing candidates (e.g. links in a search result) rather than auditing a single site you've already committed to.

Returns status, specific named findings, the tracking/fingerprinting summary, an RFC 3161 trusted timestamp with the exact command to verify it independently outside this system entirely, and an explicit disclosure of what the result does and doesn't prove. not_registered or no_scans_yet means no evidence exists yet — a meaningfully weaker state than a clean result, not the same thing.

How an agent actually uses this

# Pseudocode for a form-filling / checkout agent —
# the pre-flight check has to be a deliberate step you add,
# it doesn't run automatically for sites your agent visits.

result = mcp_client.call_tool(
    "check_site_trust", {"domain": "example.com"}
)

if result["status"] == "red":
    abort("Site failed trust checks — not proceeding.")
elif result["status"] in ("no_scans_yet", "not_registered"):
    # No evidence exists yet — not the same as a clean result.
    # Decide how your agent should treat "unknown."
    proceed_with_caution()
else:
    fill_form_and_submit()

Full REST API

Everything the MCP tools wrap is also a plain REST API, with interactive docs generated directly from the running service:

https://api.provadeconsentimento.com.br/docs →

Single domain

curl -s https://api.provadeconsentimento.com.br/verify/example.com

Batch (up to 20 domains)

curl -s -X POST https://api.provadeconsentimento.com.br/verify/batch \
  -H "Content-Type: application/json" \
  -d '{"domains": ["example.com", "another-example.com"]}'

Limits & reliability

10 requests/second per IP, burst 20 — no API key, no account needed.
Batch calls are capped at 20 domains per request.
Results reflect the last scheduled scan, not a live re-check on every call — see last_scanned_at in the response.

Also published at /llms.txt for automated discovery.