Agent Trust Card

Safe placeholder setup examples for the three resolver-identifiable surfaces ECZ-ID supports today: /.well-known/ecz-agent.json, /.well-known/ecz-mcp.json, and OpenAPI x-ecz-id. These examples are illustrative. They are not live credentials. ECZ-ID keeps setup, verification state, and public proof separated by design. The Agent Trust Card is documentation only.

A declaration names its operator with operator_ecz_id. A binding proof is a separate step: when ECZ-ID Core opens a binding challenge, its proof instructions give the exact document to publish, with parent_ecz_id, binding_id and challenge. Copy that document verbatim. Never write those fields by hand, and never rename operator_ecz_id to parent_ecz_id in a declaration. The shapes below are generated from the one machine-readable registry, /schemas/declaration-contracts.json.

Never embed in these files:

No secrets.
No private keys.
No API keys.
No webhook secrets.
No raw logs.
No raw telemetry.

/.well-known/ecz-agent.json

Discovery manifest published on the agent’s authorised origin. Discovery only — it is not proof. Resolver projects current state.

/.well-known/ecz-agent.json

{
  "schema_version": "ecz-agent-json-v1",
  "operator_ecz_id": "<ECZ-XX-XXXXXX>",
  "agent_credential_id": "<ECZ-XX-XXXXXX::AGENT-XXXXXX>",
  "agent_name": "<agent name>",
  "logical_agent_id": "<logical-agent-id>",
  "manifest_url": "https://<your-origin>/.well-known/ecz-agent.json",
  "resolver_url": "https://resolver.ecocitizenz.org/p/<ECZ-XX-XXXXXX>/AGENT/<XXXXXX>"
}

ecz-agent.json schema reference →

/.well-known/ecz-mcp.json

Discovery manifest published on the MCP server’s operator origin, in the shape of the first-party declaration this site serves. Discovery only — it is not proof. No secrets.

/.well-known/ecz-mcp.json

{
  "manifest_type": "ecz-mcp",
  "operator_ecz_id": "<ECZ-XX-XXXXXX>",
  "resolver_url": "https://resolver.ecocitizenz.org/p/<ECZ-XX-XXXXXX>",
  "machine_proof_url": "https://api.ecocitizenz.com/api/p/<ECZ-XX-XXXXXX>.json",
  "mcp_server": {
    "name": "<registry-name>",
    "transport": "streamable-http",
    "endpoint": "https://<your-origin>/mcp"
  }
}

The first-party declaration, live →

OpenAPI x-ecz-id

OpenAPI 3.1 extension object that names the operator (operator_ecz_id), the API Passport, an optional Agent Credential, and the recheck-before-reliance flag.

openapi.yaml

openapi: 3.1.0
info:
  title: Example API
  version: "1.0.0"
  x-ecz-id:
    operator_ecz_id: <ECZ-XX-XXXXXX>
    api_passport_id: <ECZ-XX-XXXXXX::API-XXXXXX>
    api_origin: https://api.example.com
    spec_hash: sha256:<hash-of-canonical-spec>
    resolver_url: https://resolver.ecocitizenz.org/p/<ECZ-XX-XXXXXX>/API/<XXXXXX>
    agent_credential_id: <ECZ-XX-XXXXXX::AGENT-XXXXXX>
    recheck_before_reliance: true

OpenAPI x-ecz-id reference →

Start setup in TrustOps ↗Open Resolver ↗View OpenAPI x-ecz-id docs →

ECZ-ID keeps setup, verification state, and public proof separated by design. TrustOps handles setup. Resolver remains the public proof surface. Local policy decides. Re-check before reliance. Canonical TrustOps handoff: https://trustops.ecocitizenz.com/start.