# Digital Trust Passport

> A continuous, publicly-verifiable check that a website doesn't track visitors and isn't a
> scam, link farm, or unsafe SaaS — built entirely from public evidence (domain registries,
> certificate transparency, DNS, a live page scan). No OAuth or credential grant is ever
> requested from a site being checked.

## For AI agents

A public, no-authentication MCP tool is available for deciding whether a site is safe to
interact with before entering payment information, personal data, or credentials on a user's
behalf. This has to be deliberately integrated into an agent's toolset — there is no mechanism
by which an agent visiting an arbitrary site discovers this automatically.

- MCP endpoint (Streamable HTTP): https://api.provadeconsentimento.com.br/mcp
- Tools:
  - check_site_trust(domain: str) -> JSON (status, named findings, tracking/fingerprinting
    summary, RFC 3161 trusted timestamp, and an explicit disclosure of what the result does and
    does not prove)
  - check_multiple_sites(domains: list[str]) -> JSON (same, for up to 20 domains in one call —
    for comparing candidates rather than auditing one already-chosen site)
- Full REST API reference: https://api.provadeconsentimento.com.br/docs
  - GET /verify/{domain} — single domain
  - POST /verify/batch {"domains": [...]} — up to 20 domains
- Rate limit: 10 requests/second per IP, burst 20. No API key required.
- Human-readable explanation: https://provadeconsentimento.com.br/developers

## Key pages

- Homepage / how it works: https://provadeconsentimento.com.br
- Verify a site: https://provadeconsentimento.com.br/verify
- For SaaS founders: https://provadeconsentimento.com.br/for-saas
- Sign up: https://provadeconsentimento.com.br/auth/register