Back
The chain of trust
fly.meVerified
Open Trust Index9 / 9
Checked live at 18:13:08 UTC.

  1. Found

    An agent can find fly.me by name and learn how to reach it.
    ✓Name record in DNS (ANS)_agent.fly.me → www.fly.me
    ✓Agent card and key directory publishedMCP at https://www.fly.me/mcp; 1 Ed25519 key

  2. Verified

    The owner of fly.me proves it, in DNS and with a signature (PKI).
    ✓Owner key in DNS_dna.fly.me · key c0DXbH4lkfvE…
    ✓DNS answer signed (DNSSEC)Resolver validated the chain to the root
    ✓Fresh challenge signed by the owner keyEd25519 signature verified with the DNS key

  3. Allowed

    fly.me acts only inside the traveler's rules.
    ✓Passkey on every booking, under the capNever over $1,500; one passkey approval per booking, at one amount
    ✓Unverified agents kept from bookingDNA Guard enforce: 403 on booking and approval routes; everything else watched

  4. Connected

    Every hop is encrypted and every agent request is signed.
    ✓HTTPS, and signed agent requests verify (Web Bot Auth)HTTPS origin · Signed as www.fly.me, key 0PkkXzsgGbeI…

  5. Recorded

    Each booking is an entry in a signed, hash-chained log.
    ✓Log chain intact2 entries · head a813909a7132

  6. Trusted

    The Open Trust Index: how many of the checks above pass, right now.
    ✓9 of 9 checks passOwner proven in DNS and by signature.

For domains

Any domain can answer agents the same way. Publish these TXT records, turn on DNSSEC, and set the signing key as a Worker secret (npm run dna:keys makes one).

_agent.fly.me"v=agent1; card=https://www.fly.me/.well-known/agent-card.json"
_dna.fly.me"v=dna1; k=ed25519; p=c0DXbH4lkfvEcNeb0lf6Nq8NzfICy2llV9Mk2Wb4cbI"

Agent card · Key directory · Who answers at fly.me