How MCP Agents Verify Each Other Before Tool Calls

1. The Problem

MCP enables AI models to call tools on remote servers. But the MCP specification has no concept of agent trust. When Agent A calls a tool on Server B, there is no verification that Agent A has active compliance attestations, valid guardrails, or a non-revoked identity. The tool runs regardless.

In regulated environments, this is a gap. EU AI Act Art. 9 requires risk management measures. NIST AI RMF requires characterization of third-party AI components. When an unverified agent invokes a tool that accesses customer data, makes financial decisions, or modifies infrastructure, the absence of trust verification is an audit finding.

2. What is Trust Mesh

The SWT3 Trust Mesh is a protocol for mutual compliance verification between AI agents. Before two agents interact, each presents a cryptographic credential proving its compliance posture (active guardrails, fresh attestations, valid signing key). The receiving agent verifies the credential locally and assigns a trust level from 0 (DENIED) to 4 (SOVEREIGN).

Every verification mints two SWT3 witness anchors: AI-TRUST.1 (the verification result) and AI-TRUST.2 (the handshake evidence). Both are independently verifiable at the public /verify endpoint. For the full protocol specification, see the Protocol Reference.

3. Two MCP Tools

The SWT3 MCP Server (@tenova/swt3-mcp) exposes Trust Mesh as two tools that LLMs can call autonomously during a conversation.

present_trust_credential

Generates a trust credential for the current agent. Read-only. No anchors minted.

Returns: A formatted credential containing agent_id, tenant_id, anchor_fingerprint, anchor_timestamp_ms, is_signed, and clearing_level. The counterpart passes these fields to their verify_agent_trust tool.

verify_agent_trust

Verifies a counterpart agent's credential. Mints AI-TRUST.1 and AI-TRUST.2 anchors.

Returns: Verification result (GRANTED/DENIED), trust level (0-4), denial reason if applicable, and the minted AI-TRUST.1 and AI-TRUST.2 anchor tokens.

4. Conversation Flow

Here is a real MCP conversation where Agent A presents credentials, Agent B verifies, and then Agent B proceeds with a tool call. These are the actual JSON-RPC messages your MCP client sees.

Step 1: Agent A presents credentials

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "present_trust_credential",
    "arguments": {}
  }
}

Response:

{
  "jsonrpc": "2.0",
  "id": 1,
  "result": {
    "content": [{
      "type": "text",
      "text": "Trust Credential for Agent-to-Agent Verification\n\nagent_id: claims-processor-v3\ntenant_id: acme-prod\nanchor_fingerprint: a1b2c3d4e5f6\nanchor_timestamp_ms: 1786825895000\nis_signed: true\nclearing_level: 2\nhas_guardrails: false\nhas_hardware_attestation: false\n\nPass these fields to another agent's verify_agent_trust tool\nto establish mutual compliance trust before exchanging data."
    }]
  }
}

Step 2: Agent B verifies Agent A

{
  "jsonrpc": "2.0",
  "id": 2,
  "method": "tools/call",
  "params": {
    "name": "verify_agent_trust",
    "arguments": {
      "counterpart_agent_id": "claims-processor-v3",
      "counterpart_tenant_id": "acme-prod",
      "anchor_fingerprint": "a1b2c3d4e5f6",
      "anchor_timestamp_ms": 1786825895000,
      "is_signed": true,
      "clearing_level": 2
    }
  }
}

Response:

{
  "jsonrpc": "2.0",
  "id": 2,
  "result": {
    "content": [{
      "type": "text",
      "text": "Trust Verification: GRANTED\nTrust Level: 2 (verified)\nChecks: 4/4 passed\n\nCounterpart: claims-processor-v3 @ acme-prod\n\nAI-TRUST.1 Verdict: PASS\nAI-TRUST.1 Anchor: SWT3-E-CLOUD-AI-AITRUST1-PASS-1786825900-c3d4e5f6a1b2\nAI-TRUST.2 Anchor: SWT3-E-CLOUD-AI-AITRUST2-PASS-1786825900-d4e5f6a1b2c3\nWitnessed: 2026-08-15T20:31:40.000Z\nVerify: https://sovereign.tenova.io/verify?fp=c3d4e5f6a1b2"
    }]
  }
}

Step 3: Proceed with the actual tool call

Trust is established. Agent B can now call the tool it needs with confidence that Agent A is compliant.

5. The Full Stack: Trust + Middleware

Trust Mesh (pre-call verification) and the Witness Middleware (post-call evidence) create three independent evidence layers.

6. Configuration

The SWT3 MCP Server reads configuration from environment variables and an optional .swt3.yaml file.

Environment Variables

Trust Mesh Configuration (.swt3.yaml)

# .swt3.yaml for an MCP server with trust mesh
trust_mesh:
  mode: strict
  min_trust_level: 2
  require_signature: true
  trusted_tenants:
    - partner-org
  signing_keys:
    - agent: claims-processor-v3
      key_env: PARTNER_SIGNING_KEY

When a client calls verify_agent_trust, the server uses this configuration to determine whether to grant or deny trust. See the Implementation Guide for all configuration options.

7. What the Assessor Sees

A complete MCP interaction with trust verification produces three anchors. Here is how to read them:

Example Anchor Sequence

SWT3-E-CLOUD-AI-AITRUST1-PASS-1786825900-c3d4e5f6a1b2   (trust verified)
SWT3-E-CLOUD-AI-AITRUST2-PASS-1786825900-d4e5f6a1b2c3   (4/4 checks)
SWT3-E-CLOUD-AI-AITOOL1-PASS-1786825905-e5f6a1b2c3d4    (tool witnessed 5s later)

8. Demo Mode

Run the MCP server without an API key to see trust verification in action locally.

npx @tenova/swt3-mcp

In demo mode, all tools work locally. Trust verification mints demo anchors to stderr. No network calls, no account required. The output includes:

[DEMO MODE: local only, not persisted]

Trust Verification: GRANTED
Trust Level: 1 (basic)
Checks: 4/4 passed

Counterpart: test-agent @ demo-tenant
Anchor: a1b2c3d4e5f6

AI-TRUST.1 Anchor: SWT3-DEMO-LOCAL-AI-AITRUST1-PASS-1786825900-c3d4e5f6a1b2
AI-TRUST.2 Anchor: SWT3-DEMO-LOCAL-AI-AITRUST2-PASS-1786825900-d4e5f6a1b2c3

This anchor was minted locally. To persist anchors to the SWT3 ledger,
use the signup tool to create a free account, or set SWT3_API_KEY.

9. Common Questions

"Can the LLM skip verification?"

Yes. Trust Mesh tools are available to the LLM but not mandatory. The LLM can call business tools directly without calling verify_agent_trust first. To enforce verification before tool execution, use the MCP server's toolPolicyGate feature, which blocks tools until a trust verification has been completed in the current session.

"What if verification fails?"

The tool returns a DENIED result with a denial reason (e.g., tenant_not_trusted, anchor_expired, signature_invalid). An AI-TRUST.1 FAIL anchor is minted. The LLM sees the denial and should not proceed with the interaction. The evidence that the denial occurred is permanently recorded.

"Does this work with any MCP client?"

Yes. The trust tools are standard MCP tools. Any MCP client (Claude Desktop, Cursor, VS Code, custom clients) can call them. The client does not need to know about Trust Mesh. The LLM decides when to call the tools based on the conversation context.

"How does this relate to the Witness Middleware?"

Different layers, complementary evidence. Trust Mesh verifies the counterpart before the interaction. The Witness Middleware records the tool call after it completes. Together they produce three evidence layers (AI-TRUST.1, AI-TRUST.2, AI-TOOL.1). Each works independently. You can use one without the other.

"Does this require the full SWT3 MCP Server?"

The trust tools are part of the SWT3 MCP Server (@tenova/swt3-mcp), which provides 33 tools in total. If you only want transport-level witnessing (no trust tools), use the Witness Middleware alone (@tenova/swt3-mcp/middleware).

10. Getting Started

npm install @tenova/swt3-mcp

Run the server, connect your MCP client, and call present_trust_credential to see your agent's credential. Call verify_agent_trust with a counterpart's credential to see the verification flow.

No API key? The server runs in demo mode. Anchors log to stderr. Create a free account when you want persistent evidence.

• Witness Middleware Guide - Transport-level audit trail
• Implementation Guide - SDK-level Trust Mesh quickstart
• Multi-Agent Guide - Orchestrator and delegation patterns
• Protocol Reference - Full specification
• SDK Documentation - API reference for all 10 languages
• npm package