ProvenGraph

What is ProvenGraph?

ProvenGraph is a provenance graph — a shared, verifiable record of who said what, when, and whether it held up. Every node and every edge carry evidence: URLs, content hashes, timestamps, issuers, and freshness values that decay over time. Trust is computed over the graph, not from a flat table.

Think of it as the credit bureau for the agent economy. Agents don't blindly trust a server they just discovered. They query ProvenGraph: "Has anyone attested to this server? Did it work for them? Is this knowledge claim still current?" The graph answers, weighted by the reputation of the reporters themselves — that's the anti-gaming moat.

One binary, MIT-licensed, zero external dependencies. Deploy behind Caddy or nginx and you have a private trust graph in minutes.

Three Product Lines, One Graph Core

ProvenGraph has three product lines, each built on the same provenance graph core. The graph nodes are Service, Agent, KnowledgeClaim, MemoryEntry, and Org — with edges like attests-to, depends-on, remembers, supersedes, contradicts, and observed-by.

All three share the same graph core — same nodes table, same edges table, same trust-scoring engine. Register a server once and it's a first-class node in all three product lines. That's the power of a provenance graph: each product line is just a different query over the same data.

Trust — Server Verification (Live)

Trust is the first and currently live product line. It's what everyone knows as "MeshDNS" — the capability-based service registry for MCP servers. Servers register with capabilities, get health-checked every 60s, and agents resolve by capability at runtime. Never hardcode an MCP URL again.

The trust scoring engine computes a 0-100 score from five signals: reliability (uptime from probe history), latency (avg response time), cost transparency (disclosed cost earns an honesty bonus), outcome-verified reputation (the moat — weighted by reporter trust), and schema integrity (hash-pinned manifests detect rug pulls).

Architecture

Six components in one static Go binary:

Getting Started

Install, start, register, resolve — 60 seconds:

$ go install github.com/trucore-ai/provengraph/cmd/meshdns@latest
$ meshdns serve
  ProvenGraph Trust starting on :8080

# Register a server
$ curl -s -X POST http://localhost:8080/v0/servers \
  -H "Content-Type: application/json" \
  -d '{"name":"weather-agent","description":"Weather data MCP server",
       "server_url":"https://weather.example.com",
       "health_url":"https://weather.example.com/health",
       "capabilities":["weather","forecast","alerts"],
       "owner_contact":"ops@example.com"}'
# → {"server_id":"...","write_key":"..."}

# Resolve by capability
$ curl -s "http://localhost:8080/v0/resolve?capability=weather"
# → [{"name":"weather-agent","server_url":"https://weather.example.com",...}]

API Reference

Trust Scoring Model

How Health Checks Work

ProvenGraph probes every registered server's health_url every 60s (configurable). GET by default, auto-detects POST-only endpoints (MCP streamable-HTTP servers that answer GET with 405). 5-second timeout. Non-2xx → DOWN. Resolution never returns DOWN servers.

SDK Reference

Python

$ pip install meshdns-client

from meshdns_client import MeshDNSClient

client = MeshDNSClient("https://provengraph.trucore.xyz")

# Resolve a capability
servers = client.resolve("weather")
# → [{"name":"weather-agent","server_url":"https://...","up":true}]

# Smart retry — skips recently-failed servers
next_server = client.resolve_next("weather")

TypeScript

$ npm i @meshdns/client

import { MeshDNSClient } from "@meshdns/client";

const client = new MeshDNSClient("https://provengraph.trucore.xyz");

// Resolve a capability
const servers = await client.resolve("weather");

// Smart retry — skips recently-failed servers
const next = await client.resolveNext("weather");

Configuration

All config via environment variables:

Security Model

FAQ

Why ProvenGraph instead of just MeshDNS?

MeshDNS is the Trust product line — the MCP server registry everyone already uses. ProvenGraph is the underlying provenance graph that powers Trust, and will power Knowledge and Memory when they launch. Same binary, same API, expanded scope. All 3,000+ existing servers, all existing API endpoints, all existing SDKs work unchanged.

Can I run my own instance?

Yes. A single Go binary — MIT-licensed, self-contained, zero external dependencies. Deploy behind Caddy or nginx with auto-TLS and you have a private provenance graph in minutes. The public instance at provengraph.trucore.xyz is a convenience, not a requirement.

What happens if ProvenGraph goes down?

Agents should cache the last resolve result and fall back to cached servers. GET /v0/export gives you the full registry as JSON — archive it periodically for disaster recovery.

How fast is resolution?

p99 under 100ms with 3,000+ registered servers on MVP hardware. Resolution is a simple indexed SQLite query — no network hops, no external services.

When will Knowledge and Memory launch?

Trust is live today with 3,000+ servers and the full trust-scoring engine. Knowledge and Memory are planned product lines on the same graph core. Register now and your server accumulates uptime and outcome history that transfers directly to future product lines.

Integrations & Next Steps