MODULE_FAQ // ANSWERS

FAQ

The questions that come up most. Linkable by anchor — every entry has a stable id.

PROTOCOL

How AAL works

What is AgentAuditLabs?

A signal-based trust protocol for AI agents. AAL collects signed measurements from independent sources — on-chain registries (ERC-8004, Solana ATOM), third-party reputation services, and AAL-native sandbox tests — and aggregates them into a single Universal Trust Score on the 0-100 scale.

Q · OPEN-VOCABULARY-TAGS

What does "open vocabulary tags" mean?

Signals carry tag strings rather than enum categories. Any string is a valid tag, but only registered tags pass validation (ADR-012). The registry holds 28 tags as of 2026-05-02 and grows by migration plus ADR — no signal is ever silently dropped or invented.

Q · HOW-SIGNALS-SIGNED

How are signals signed?

Every signal is Ed25519-signed at emission with the AAL master key. The signing_key_id is recorded on the signal so verifiers can independently fetch the public key from the signing_keys table and reproduce the signature. No unsigned signals reach the engine.

SCORING

The Universal Trust Score

Q · WHY-ZERO-TO-ONE-HUNDRED

Why a 0-100 scale and not 0-1000 or 0-5 stars?

A 0-100 integer is the minimum representation that fits all six tier bands without rounding artifacts and is universally readable. ADR-009 locks the scale; there is no multiplier in the formula. Scores are not stars, percentiles, or grades — they are weighted means.

Q · HOW-IS-SCORE-COMPUTED

How is the Universal Trust Score computed?

score = round(weighted_mean × coverage). The weighted mean is taken across all applicable signals using the source weight at the time the signal was emitted. Coverage is a 0-1 source-diversity factor that saturates at eight independent sources. A high-quality agent with thin coverage gets a thin score; only good and broad together produce high tiers.

Q · CONFIDENCE-DISTRIBUTION

What does "85 ± 2 (Platinum, 78% confidence)" mean?

A score is a distribution, not a point. 85 is the mean; ±2 is the standard deviation; 78% is the integral of a normal distribution centered on the mean over the Platinum tier band [70-84]. Tight stddev with the mean dead-center in a tier yields high confidence; wide stddev or boundary-adjacent means yield lower confidence even when the score is the same.

INTEGRATION

Connecting your agent

Q · HOW-TO-IMPROVE-SCORE

How can I improve my agent’s score?

Two levers: improve signal values (pass more ASI threats, raise reliability), and broaden coverage (register on more chains, claim more independent attestations). The /certification page lays out the climb path tier by tier. Both levers matter — neither alone produces a high score.

Q · CRAWLED-VS-SCORE-ANY

What’s the difference between a crawled score and Score-Any-Agent?

Crawled scores come from periodic ingestion of on-chain registries and third-party reputation services. Score-Any-Agent (/v1/score-any) is an on-demand audit triggered by an authenticated request — the first call against an agent is free, subsequent re-scores cost $0.10 USDC via x402. Both produce signed signals that flow through the same engine.

Q · MCP-SERVER

How do I integrate AAL into Claude / Cursor / GPT?

AAL ships an MCP server (@agentauditlabs/mcp-server) exposing eight tools: aa_score, aa_dimensions, aa_verify, aa_score_any, aa_compare, aa_search, aa_history, aa_credential. Install via the MCP configuration in your client. The /docs/api page documents the equivalent REST endpoints.

Q · BADGE-EMBED

Can I embed an AAL badge on my agent’s site?

Yes, once your agent is at Gold or above. The badge is an SVG bound to the score on the day it was issued, signed by AAL. Re-fetch the badge URL daily for the live score, or embed a static snapshot from a published Verifiable Credential.

DATA

Storage and on-chain attestation

Q · APPEND-ONLY-DATA

Can a signal or score be deleted or modified after the fact?

No. signals, score_events, calibration_log, outcomes, and signing_keys are append-only at the database level. Corrections create a new signal that supersedes the prior one (supersedes_signal_id). The scores table is a materialized cache regenerable from score_events — drop it and recompute.

Q · ON-CHAIN-ATTESTATION

Are scores written on-chain?

Yes. Final scores are written to two chains: Solana via SEAL v1 (memo-program payloads with magic "AALS") and Base via ERC-8004 attestation. Both writeback paths sign the score with the master key and include the signing_key_id so the attestation is independently verifiable.

PRICING

Cost and access

Q · PRICING

How much does AAL cost?

Reading public scores is free. Programmatic access to the API and the MCP server is on a tiered subscription. Score-Any-Agent is free for the first call against an agent and $0.10 USDC for subsequent re-scores via x402 micropayment. See the /pricing page for current plans.

COMPLIANCE

Trust, privacy, and the law

Q · EU-AI-ACT

Is AAL aligned with the EU AI Act?

Yes. Per ADR-010 and the dedicated /compliance/eu-ai-act page, AAL’s evidence inputs and append-only event log map to the Act’s technical-documentation, transparency, and human-oversight obligations. AAL is not a substitute for an agent operator’s own compliance work — it is one of the inputs.

Q · SECURITY-ISSUE

How do I report a security issue?

Email security@agentauditlabs.com with a clear reproduction. Do not disclose publicly until we acknowledge. AAL operates under standard responsible-disclosure norms; bounty terms are listed on the security page once published.

STILL STUCK

Where to go next

Didn’t find your question? Check the deeper references below, or email support@agentauditlabs.com.

/methodology — full protocol explanation, scoring math, sandbox modules, hard rules.
/certification — tier boundaries, badge gallery, climb path.
/docs/api — REST endpoints, auth, x402 micropayment flow.
/compliance/eu-ai-act — alignment notes for the EU AI Act.