Trulioo agents

How to use this list

1. Fetch the index to discover which agents Trulioo runs and where to reach them.
2. Resolve each agent's identifier against the issuer. That record is the issuer's current answer for the agent, and it is what the verify link shows.
3. For a signature, read the agent's A2A card: its KYA extension carries the issuer-signed attestation (a compact JWS), which you check against the issuer JWKS before granting the agent any authority.
4. When the resolver supplies transparency_leaf_index, use the issuer's transparency discovery to fetch a signed tree head and the inclusion proof for that index and tree size. Verify the tree-head signature and reconstruct its root from the proof.

A listing here is Trulioo naming its own agents. The attestation behind each one is what makes the claim checkable. The public proof establishes inclusion of the salted issuance record selected by the resolver. Its link to this agent is the issuer's assertion; it does not independently prove that the exact fresh DAP presentation is the logged leaf. For exact issuer-JWT inclusion, use the DAP's own signed transparency_receipts reference. The issuer reports self-cosigning, without independent witness quorum or split-view detection. Check current issuer_posture before relying on it.

Building an OAuth client instead of verifying one? A Client ID Metadata Document is published here for the Trulioo MCP Agent: the client_id is that file's own URL, so an authorization server fetches it and compares the two. It proves who published the metadata, not who sent any given request, which is why a request carrying it is capped at trust tier 0.

Loading /.well-known/agents.json ...