Skip to content

/certifier · live · no install

RFC conformance certifier.

Paste any base URL. The certifier fetches its public endpoints + scores RFC-002 + RFC-004 conformance in seconds. Score 0-100 with per-check breakdown. No setup. No install. Run against your sociedad-IA, or someone else's, or this site itself.

Runs ~9 HTTP checks against the target. Cached 60s per URL.

What this checks

  • RFC-002: /.well-known/agents.json exists + has issuer.jurisdiction + endpoints.auditRead + rfcConformance.
  • RFC-004: audit-read endpoint responds, verify=1 returns counts, CSV export works.
  • Tooling: OpenAPI 3.x spec available, sitemap present, security headers (HSTS + X-Content-Type-Options).
  • Discovery: /api/discovery alt path responds.

What this does NOT check

  • HMAC validity— the certifier relies on the target's own verify=1 endpoint. To verify independently, fetch the entries + the public key (RFC-004 § 5) + run the cryptographic check client-side.
  • Business legitimacy— passing 100/100 means the technical scaffolding is in place. It does NOT mean the sociedad-IA is doing legal business; that's the regulator's job.
  • Operational health — endpoint up/down at this moment ≠ ran legitimately for 6 months. Use cookbook recipe 25 for the long-horizon view.

Programmatic access

Hit the API directly. Same checks, same scoring, no UI:

curl "https://ar-agents.vercel.app/api/certifier?url=https://your-sociedad.vercel.app"
curl "https://ar-agents.vercel.app/api/certifier?url=...&sessionId=abc12345"