Answers agents can cite.
Connect any MCP agent. Every tool call returns its proof.
One config block
Point any MCP client at the server, hand it a scoped key from AIOS:PLATFORM, and every registered model becomes a tool.
MCP Server
A standard MCP server over stdio. Works with any MCP client.
npx -y @aios/mcpA Scoped Key
Minted on AIOS:PLATFORM: spend-capped, revocable, never custody of funds.
Three Tools
Call a model, find a model, check a record. Nothing that touches keys.
{
"mcpServers": {
"aios": {
"command": "npx",
"args": ["-y", "@aios/mcp"],
"env": { "AIOS_KEY": "aios_sk_9f2…", "AIOS_DEFAULT_MODEL": "bitnet-ref-1" }
}
}
}
Your agent calls a tool
Escrow to settlement
Between the tool call and the tool result sits the whole mechanism. The agent just sees output, with a record attached that anyone can look up later.
- aios.infer submit a job, get output and its record
- aios.models search the registry by the guarantee it needs
- aios.record fetch and check any past record
- 01 / Connect
Handshake
The agent connects over MCP and discovers the AIOS tools. The key pins scope and spend cap.
- 02 / Call
A tool call becomes a job
The fee escrows in $AIOS, caller-owned, refunded in full if no quorum forms.
- 03 / Recompute
The committee recomputes
A VRF-seated committee recomputes; the work-weighted >2/3 hash becomes canonical.
- 04 / Record
Output and record return
Job id, model, hashes, committee agreement and settlement, machine-readable.
What the record is
Provenance, not truth
The registered model produced this output on this input, unforged. It never certifies a real-world judgment.
Verified is not attested
Only committee consensus earns verified. A confidential job returns an attested record, with the trust root on chip vendors.
Large models verify statistically
Exact certainty exists only on deterministic integer models, and the record says which applies.
Not an agent-security product
Prompt injection and tool misuse are separate, unsolved problems that a record does not fix.
Every call, on the record
Start with the developer surface it plugs into, or read how the record is produced.