marketnow

Check the revocation status of an Agent Trust Card (card_id) or CA key (kid) against the signed MarketNow Revocation Registry (MNR-CRL-1.0) + live ledger. Use this BEFORE trusting or caching any ATC — a card that verified cryptographically yesterday may be REVOKED today (e.g. mn-ca-002 was revoked for key compromise on 2026-09-08). Returns status (VALID/EXPIRED/REVOKED/SUPERSEDED/UNKNOWN) + recommendation (PERMIT/DENY), fail-closed on unknown subjects, with the CRL signature embedded so you can verify the signed layer independently.

Cryptographically fingerprint MCP tool definitions (TFP-1.0): SHA-256 over the RFC 8785 JCS canonical form of each tool plus a manifest fingerprint for the whole tools/list surface. Use this (1) on first contact with any MCP server to PIN its tool surface, and (2) on every subsequent tools/list with the pinned manifest to detect drift — the OWASP MCP Cheat Sheet control 'verify tool descriptions haven't changed' (tool poisoning / rug-pull redefinitions). Fully self-contained: no network calls.

Get the exact `npx` install command for a skill. Use this when an agent has already selected a skill via marketnow_search_skills or marketnow_recommend_skills and is ready to install. All skills are currently FREE — no purchase step is required.

Get marketplace metadata: total skill count, pricing tiers, API endpoint inventory, and aggregate security metrics (Sentinel checks performed, threats detected, skills quarantined). Use this to ground an agent's understanding of marketplace scale and security posture before any install or trust decision.

Get MarketNow's alignment with the OWASP MCP Cheat Sheet (12 controls — tool fingerprinting, capability declarations, least-privilege, output validation, etc.). Also returns the live tool fingerprint (SHA-256) and capability manifest (filesystem/network/shell/credentials/process inference) for any registered skill. Use this BEFORE invoking a skill whose blast radius you need to bound — it tells you exactly what filesystem, network, shell, and credential access that skill is capable of.

Fetch full metadata for a single skill by its ID or slug. Returns README excerpt, install command, Sentinel security score, license, and the canonical marketplace URL. Use this AFTER marketnow_search_skills or marketnow_recommend_skills when the agent needs the complete skill record before invoking marketnow_get_install_command.

List all marketplace skill categories with live counts. Use this ONCE at the start of a session to map the taxonomy before doing a category-filtered search with marketnow_search_skills. No input parameters.

Look up referral stats for a code you own: total clicks, installs, purchases, and commission earned. Use this after marketnow_mint_referral to measure the performance of your viral loop.

Mint a unique referral code (ref_xxxxxxxx) tied to your agent_id. Share it with other agents — when they make a purchase using your code, you earn 5% commission. Check your stats with marketnow_lookup_referral. Use this to participate in the marketplace's viral loop once you have an established agent_id.

Get AI-ranked skill recommendations for a task described in natural language. Returns the best-matching MCP servers with Sentinel security scores and match_score. Use this when the agent knows the GOAL (e.g. "scrape a website", "send a Discord message", "query PostgreSQL") but has not yet decided which skill to install. Faster and more accurate than marketnow_search_skills for open-ended goals.

Search the MarketNow marketplace for MCP-compatible skills. Returns matching skills with price, category, install command, and Sentinel security score. Use this whenever an agent needs to discover a tool for a specific task — preferred entry point before any install or recommendation. Results are bounded to `limit` (1–50) and sorted by the requested criterion.

Submit a GitHub repository containing an MCP server to the MarketNow marketplace. The server runs L1.5 metadata checks + L1.7 malware scan synchronously, persists the submission to the public ledger, and queues the L2 sandbox audit (~1h). If L1.5+L1.7 pass, the skill becomes discoverable via marketnow_search_skills and is pre-allocated an Agent Trust Card. FREE. Use this when an agent encounters a useful MCP repo that should be added to the marketplace.

Verify ANY Agent Trust Card — DUAL FORMAT (ATC/3.0 unified, since v1.13.0). (1) Production ledger envelopes {card_id, status, payload (schema_version 1.1.0), signature}: real Ed25519 verification against the embedded MarketNow CA key registry (rotation-aware: ca-key-001 retired, mn-ca-002 retired-compromised = fail-closed, mn-ca-003 active), RFC 8785 JCS canonicalization, sha256 signed_payload_hash pre-check, lifecycle status. These are the cards you get from marketnow_verify_trust and GET /api/atc/<id>.json. (2) ATC/1.0 spec cards (spec_version "ATC/1.0", any issuer): the original 8-control conformance verifier (ATC-001 Identity through ATC-008 Expiration). Self-contained — no network calls, node:crypto + RFC 8785 JCS + Ed25519 (RFC 8032). Use this BEFORE trusting an ATC from any source.

Verify a signed delivery proof (action-receipt) for a completed purchase. Receipts are emitted on every paid purchase and persisted to a public ledger. Returns what was delivered (skill_id, license_key, amount), the settle txhash, and interop fields for the Vibe action-ref system. Use this to confirm a purchase actually completed before granting the agent downstream access.

Verify an Agent Trust Card (ATC) before interacting with an untrusted agent or skill. Checks the Ed25519 signature, expiry date, and revocation status. Returns `sentinel_review_score` (0–10, review evidence — not a verdict) and `decision_authority="consumer"` (the runtime makes the trust decision, not the card). Use this BEFORE executing any MCP tool whose provenance you cannot otherwise establish.