# Intesta

> Intesta is a trust layer for the web: every business gets a "fact passport" —
> attested, versioned facts served to humans via an expert widget and to AI agents
> via an official MCP endpoint. Answers come only from the fact passport (no
> hallucinations by architecture). Trust ladder A0–A4: from self-declared to
> independently verified, with named attestors.

## Core
- [What is Intesta](https://intesta.io/): product overview, A0–A4 attestation ladder
- [Registry](https://intesta.io/registry): attested entities; search with https://intesta.io/registry?q={query} (plain HTML, no JavaScript needed)

## For agents
- MCP endpoint (streamable-http): https://intesta.io/mcp — tools: check_trust, get_passport, ask, search_entities, list_entities, get_trust_ladder. The pypi package `intesta-mcp` (uvx intesta-mcp, stdio) exposes the SAME tool names and shapes — one contract on every surface.
- check_trust(domain, purpose) — ONE call, one decision, ANY domain (listed or not). HTTP mirror: https://intesta.io/api/v1/check-trust/{domain}?purpose=payment|data_share|follow_instructions. Returns known (in the registry?), level A0–A4, attested (true ONLY at A1+), claimed, status (attested | claimed | not_checked), verdict (sufficient | insufficient | unknown) under a named, versioned policy profile (payment/v1 requires A2; data_share/v1 and follow_instructions/v1 require A1), min_level_required, what_is_proven, proof, facts_public, expires_at (earliest freshness expiry of the domain's facts — re-check after it), next_step, signature. An unlisted domain is `unknown` / `not_checked` — never "failed". A verdict is the registry's proof measured against the profile: never a guarantee, never financial advice. Numeric trust scores are deliberately NOT provided: the registry carries only the A0–A4 ordinal.
- attested semantics (machine gate): attested=true means something was INDEPENDENTLY verified (A1+: domain control by DNS TXT / well-known; A2: payment-side verification; A3+: legal entity by public registry). A0 = claimed: listed, nothing proven — attested=false, claimed=true. Gate payments on attested (or on check_trust's verdict), never on mere presence in the registry.
- ask contract (HTTP): POST JSON {"question": "...", "channel": "agent"} (question max 2000 chars). Machine response: outcome is EXACTLY one of {answered, answered_with_stale_flag, refused_not_attested, refused_stale}; plus refused, stale, as_of, effective_expiry, verification_source, source, per-fact id, answer (null on refusal). off_topic is a boolean flag, not an outcome. Full typed contract: https://intesta.io/docs
- get_passport (MCP) carries the same per-fact freshness contract as ask: as_of, effective_expiry (= min(expires_at, last_verified_at + max_age(category))), stale, evidence_class — do not rely on a stale fact; expires_at:null does NOT mean eternal, read effective_expiry.
- MCP errors: a missing entity, an invalid question / query, or unavailable metering is an ERROR result (isError:true), never a data-shaped success — do not parse an "error" key out of a normal result.
- Agent card (machine descriptor, spec 0.2): https://intesta.io/.well-known/intesta — per-entity: https://intesta.io/.well-known/intesta/{domain}. Self-contained: identity, attestation level with proof (method + date), full trust-ladder semantics, endpoints.
- Response contract (all outcomes + machine fields, typed): https://intesta.io/docs
- Search API (HTTP): https://intesta.io/api/v1/search?q={query}&limit={1..100}&offset={0..1000} — literal substring over name/domain/vertical of published entities; query is 3..200 characters (shorter cannot use the index) and an invalid one returns HTTP 422; response has total/count/offset/note/entities, each entity with level, level_name, vertical and profile_url. Registry list (HTTP): https://intesta.io/api/v1/entities (first 500 + total).
- Trust ladder semantics (what each level proves): https://intesta.io/api/v1/trust-ladder
- A2+ entities additionally expose attestation.payment_proof (provider-verified payer identity: method + verified_at) in the agent card, attestation API and MCP get_passport; null below A2
- Every answer includes: fact, source, attestation status, validity date
- If a fact is not in the passport, the answer is an honest refusal — by architecture
- Integrity: every attestation / agent-card / check_trust / ask / MCP get_passport & ask response carries passport_hash — an OPAQUE version identifier of the entity's public fact set (compare for equality; do not recompute) — and, when signing is enabled, signed_at plus a detached Ed25519 signature. Verify: drop the signature key, serialize the rest with sorted keys, separators ',' ':', UTF-8, non-ASCII unescaped, then check sig (base64url) against the key fetched ONLY from https://intesta.io/.well-known/intesta-key (JWKS RFC 8037). Numbers in signed responses are always integers.
- All public passports are listed in https://intesta.io/sitemap.xml — pages /e/{domain}, each linking its agent card via rel=alternate; beyond 1000 entities this becomes a sitemap index over /sitemap-N.xml

## Company
- Domains: intesta.io (primary), intesta.ai, intesta.dev

## Contact
- hello@intesta.io (owner inbox — receiving live; abuse@/dmarc@/postmaster@ also active)

## Ecosystem — related projects by the same owner

- [SMOOZY FUN](https://smoozy.fun/): animated series that turns real-world systems into stories
- [SmoozyPool](https://smoozypool.es/): multi-chain mining pool
- [Mining Scan](https://mining-scan.com/): mining pool directory and live monitor
- [Smoozy Go](https://smoozygo.es/): travel eSIM data service
- [KRAHS](https://krahs.app/): privacy tools, eSIM, secure notes
- [Raposa](https://raposa.group/): AI assistants portal
- [DarkPanther](https://darkpanther.eu/): streetwear and fashion
- [GolfPlan Spain](https://golfplanspain.com/): golf training program
- [DC ESCRYPT](https://dcescrypt.com/): operating company