{ "kind": "trust_methodology", "version": "v0", "url": "https://api.lumitrades.io/v1/trust/methodology", "label": "Lumi's automated observations of this x402 endpoint (free 402-quote checks plus small paid test-buys), not a rating or review of the business. Few samples = low confidence.", "what_is_measured": [ "Free probes: every 30 minutes Lumi sends one unpaid request to each listed endpoint and records whether it answers with a valid x402 v2 402 quote that offers an XRPL (xrpl:0) option paying an address listed for that vendor, the quoted price and asset, whether the quote carries a sourceTag, and the response time. Probes never send a payment.", "Paid test-buys: Lumi buys one call per vendor per day from its own XRPL wallet (hard caps: 0.15 RLUSD + 0.05 XRP per day in total, and no endpoint priced above 0.05). Each record shows the amount, asset, ledger tx hash, HTTP status, whether the response contained data, and latency. Every test-buy tx is checked on the XRPL ledger before it is stored.", "Agent reports: any agent that paid a listed vendor can POST /v1/reports. A report counts only if the payment is validated on-ledger (tesSUCCESS, sent by the reporter, delivered to a pay-to address listed for that vendor, within the last 7 days) AND the payer signs the challenge `lumi-report::`. Unverified submissions are stored privately for abuse review and are never shown or scored." ], "x402_catalog": { "source": "CDP x402 Bazaar discovery API (free), ingested daily at 02:00 UTC. x402scan's resource API is paid, so it is not ingested.", "lookup": "https://api.lumitrades.io/v1/trust/vendors?url= | ?domain= | ?payTo=
(case-insensitive)", "quote_checks": "Every catalogued http resource gets one free, unpaid request at least once a day (rotating slices every 30 minutes, fanned out over a queue). Recorded: HTTP status, whether a readable x402 quote came back, whether it pays an address in the listing, quoted price vs listed price, latency, and the last 30 results. MCP listings are not probed. The registrable domain's registration date is read from RDAP about monthly (shared hosting hosts such as workers.dev are skipped). TLS certificate age is not measured.", "tiers": { "catalogued, not yet checked": "Listed in the Bazaar; no quote check yet.", "quote-verified, low confidence": "A valid x402 quote in the last 48 h. This shows the endpoint is up and asks for payment as listed; it says nothing about what a paid call returns.", "quote-checked: no valid x402 quote at the last check": "The last free request did not return a readable 402 quote (e.g. it answered 200, 404, timed out, or quoted a different payTo). Often a parameter issue; not a judgment of the seller.", "purchase-verified": "Lumi paid for one call from its own wallet (Base USDC or XRPL); the payment is confirmed on-chain before it is stored, with HTTP status, data returned yes/no and latency.", "self, not scored": "Lumi's own endpoints." }, "no_match": "{observed:false, note}: Lumi has not seen this seller. No observation is not a negative signal.", "not_scored": "Catalog entries get labels, not scores; scores apply only to the curated XRPL list below." }, "score": { "range": "0-100, over the last 30 days", "weights": { "delivery": 0.5, "uptime": 0.2, "latency": 0.15, "agent_reports": 0.15 }, "formula": "weighted mean of the components that have data (a component with no data is left out and the weights are renormalised)", "delivery": "delivered / paid test-buys", "uptime": "valid 402 quotes / probes", "latency": "1 - (median_ms - 500) / 4500, clipped to 0..1", "agent_reports": "positive / (positive + negative) verified reports; a negative report gets weight 1.5 when a Lumi test-buy within 6 h also returned no data; max 1 counted report per reporter per day and 5 per 30 days; 24 h hold before counting", "confidence": "low when there are fewer than 5 paid test-buys or fewer than 10 probes; medium below 20 paid test-buys; otherwise high", "ordering": "vendors are listed in allowlist order, not ranked" }, "data_returned_rule": "A response 'contained data' when the HTTP status is 2xx and the body has non-empty content for that endpoint (e.g. a non-empty result list). Error bodies, empty lists and empty objects count as no data.", "right_to_reply": { "email": "hello@lumitrades.io", "endpoint": "POST https://api.lumitrades.io/v1/trust/replies", "how": "Sign `lumi-reply::` with the key of a pay-to address listed for your entry (XRPL: ripple-keypairs over the UTF-8 hex of the message, and include public_key; EVM: EIP-191 personal_sign) and POST {vendor_id, text, network, address, public_key?, signature}. Verified replies are shown with your entry. Or email us and we will add it." }, "reports": { "endpoint": "POST https://api.lumitrades.io/v1/reports", "challenge": "lumi-report:: (XRPL: tx hash uppercase; Base: 0x-prefixed lowercase)", "xrpl_signature": "ripple-keypairs sign(, privateKey), verified against the tx's SigningPubKey (single-signed payments only)", "base_signature": "EIP-191 personal_sign of the challenge by the address that sent the USDC", "fields": { "vendor_id": "id from /v1/trust/vendors", "network": "xrpl:0 | eip155:8453", "tx_hash": "payment tx", "reporter": "address that paid (XRPL r-address or 0x address)", "signature": "hex signature of the challenge", "outcome": "delivered | no_data | empty_result | error_status | timeout | wrong_data | other", "http_status": "optional, the status the vendor answered with", "response_excerpt": "optional, up to 4000 chars; kept private" }, "limits": "20 per IP per day, 5 per minute; one verified report per tx" }, "tips": { "endpoint": "POST https://api.lumitrades.io/v1/tips", "privacy": "Stored privately. Never shown, published, or returned by any endpoint, MCP tool or A2A skill." }, "self": "Lumi does not list or score its own API." }