Web Bot Auth Check MCP Server

web-bot-auth-check

Find out why your web bot auth signature is being rejected.

Signed attestations, paid per call over x402 on Base.

Part of autobus, which is where the rest of these live — one face per product, each carrying everything its buyer needs.

This repository is the buyer's side: how to call the service, and how to verify what it gave you. It carries no dependencies and nothing here phones home.

Live at https://witness.holoweave.org. No account, no key, no signup. Call the endpoint, get a 402 with a quote, pay, get a signed attestation.

What it answers

POST /v1/wba-thumbprint — $0.01

Does your keyid name a key you actually published? RFC 7638 thumbprint against your key directory

Anchored to RFC 7638 JWK Thumbprint, with RFC 8037 Appendix A.3 for Ed25519 (RFC 7638), read 2026-08-23.

POST /v1/wba-signature — $0.01

Does your signature verify against the key you published? RFC 9421 signature base, Ed25519

Anchored to RFC 9421 HTTP Message Signatures (RFC 9421), read 2026-08-23.

POST /v1/signature-acceptance — $0.01

Signature acceptance check against draft-meunier-web-bot-auth-architecture

Anchored to draft-meunier-web-bot-auth-architecture (-05), read 2026-08-23.

Evidence, never conclusions

An attestation says what is true of the artifact you sent, against a named specification, at a stated time. It never says you are compliant, valid or approved — those are conclusions, and they are yours to draw.

A finding looks like "keyid matches the kid of key 0 but NOT its RFC 7638 thumbprint". It does not look like "your setup is wrong".

Calling it

POST https://witness.holoweave.org/v1/wba-thumbprint
Content-Type: application/json

{
  "key_directory": "https://signer.example/.well-known/http-message-signatures-directory",
  "keyid": "poqkLGiymh_W0uP6PZFw-dvez3QJT5SolqXBCW38r0U"
}

Unpaid, that returns 402 with a PAYMENT-REQUIRED header carrying the quote: scheme exact, network eip155:8453 (base-mainnet), the amount in atomic units, and the asset. Pay with an x402 client and repeat the call with the PAYMENT-SIGNATURE header. See examples/call.mjs for the whole flow in one dependency-free file.

A GET returns the same 402, so a crawler can read the price without buying anything.

Verifying what you were given

Every attestation is signed Ed25519 over the RFC 8785 canonical form of the attestation object alone — the signature block is not part of what is signed.

node verify.mjs attestation.json

verify.mjs has no dependencies and does not call us. The public key is in key.json and is also served live at https://witness.holoweave.org/v1/key.

examples/attestation.json is a real one, bought on mainnet for a cent. Verify it before you trust anything else here.

Fixtures

fixtures.json is the published fixture suite: inputs and the exact findings they must produce. If a fixture stops matching, our judgment moved, and you can tell without asking us.

Idempotence

The same input digest is served from cache and not charged twice. Asking the same question again is free; asking a different one is a different question.

---

Operated from Austria as a Kleinunternehmen. Imprint and privacy notice at https://witness.holoweave.org/impressum.html and /datenschutz.html.