# Attest

> A bank asks a vendor a security control question. The vendor answers and attaches
> evidence its own agent produced. Two gates decide whether that evidence supports
> the answer before it is recorded.

- MCP endpoint: https://attest-tprm.zubairzafar480.workers.dev/mcp  (attest_list_vendors, attest_list_controls, attest_assess)
- Agent card:   https://attest-tprm.zubairzafar480.workers.dev/.well-known/ai-agent.json
- REST:         https://attest-tprm.zubairzafar480.workers.dev/api/vendors, /api/controls, /api/run?vendor=<id>
- Source:       https://github.com/zubair480/attest

The severity counter counts blocking findings. The relevance judge asks whether the
evidence can answer the control at all. Neither overrides the other: a disagreement
returns ESCALATED and records nothing, because that is the case a person should read.

Try ACC-01 against both vendors. The counter refuses one and clears the other on
evidence that answers neither.