@wwumit/cha2a-mcp

CHA2A identity/trust/verification MCP server — read-only tools backed by the cha2a registry (compliancehub.cn).

Tools (6, all read-only)

• resolve_number — number → agent DID + trust level (addressing / trust gate)
• query_trust — DID → level L0-L4 + status / revocation
• verify_credential — verifiable evidence/credentials (audit trail)
• verify_agent_sig — outbound signature verification (anti-spoofing)
• lookup — DID → bound numbers
• verify_artifact — AI asset content integrity (fingerprint + endorsement + level + revocation, v0.3)

Usage

{
  "mcpServers": {
    "cha2a": {
      "command": "npx",
      "args": ["-y", "@wwumit/cha2a-mcp"],
      "env": { "CHA2A_BASE": "https://compliancehub.cn" }
    }
  }
}

Read-only boundary: no registration / revocation / billing operations. Registry remains the single source of truth.

Apache-2.0.