One call before money moves.

# the one call: no key, no signup
curl -s https://studio.mizan.market/api/check/try-me

# for a payment: bind the answer to the payee and amount
curl -s "https://studio.mizan.market/api/check/0xabc…?payee=0xabc…&amount=5&currency=USDC"

# hosted MCP server: nothing to install
claude mcp add --transport http mizan https://studio.mizan.market/mcp

# Cursor: .cursor/mcp.json
{ "mcpServers": { "mizan": { "url": "https://studio.mizan.market/mcp" } } }

# then the agent calls
check("try-me")        # structuredContent = the verdict object

curl -s -X POST https://studio.mizan.market/a2a \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"message/send","params":{"message":{
        "role":"user","messageId":"m1",
        "parts":[{"kind":"data","data":{"skill":"check","subject":"try-me"}}]}}}'
# the verdict comes back as the data part of the task artifact

import json, urllib.request

def get(url):
    return json.load(urllib.request.urlopen(url))

v = get("https://studio.mizan.market/api/check/try-me")
print(v["decision"], v.get("grade"), v["kid"])

if v["decision"] == "ALLOW":
    attach(v["token"])            # carry the token with the payment

const v = await (await fetch("https://studio.mizan.market/api/check/try-me")).json();
console.log(v.decision, v.grade, v.kid);

if (v.decision === "ALLOW") attach(v.token);   // carry the token with the payment

import base64, json, time, urllib.request
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey

def b64u(s): return base64.urlsafe_b64decode(s + "=" * (-len(s) % 4))

def verify(token, keys, payee=None, rule=None, now=None):
    """Offline. keys = {kid: base64 Ed25519}, your pinned copy. -> (code, claims)"""
    try:
        pre, body, sig = token.split(".")
        c = json.loads(b64u(body))
    except Exception:
        return "malformed", None
    if pre != "mzv1" or c.get("typ") != "mizan.verdict/1": return "malformed", c
    if c.get("kid") not in keys: return "unknown_kid", c
    try:
        Ed25519PublicKey.from_public_bytes(base64.b64decode(keys[c["kid"]])).verify(b64u(sig), f"{pre}.{body}".encode())
    except Exception:
        return "bad_signature", c
    if not c.get("exp", 0) > (now or time.time()): return "expired", c
    bt = c.get("bound_to") or {}
    if payee is not None and str(bt.get("payee", "")).lower() != str(payee).lower(): return "payee_mismatch", c
    if rule is not None and rule not in (c.get("rule"), c.get("rule_id")): return "rule_mismatch", c
    return "valid", c

# pin this copy of the key set; fetch it again only for a key id you do not know
keys = json.load(urllib.request.urlopen("https://studio.mizan.market/api/verdict/keys"))["keys"]
code, claims = verify(token, keys, payee="0xabc…", rule="sha256:2e10…d559")
if code == "valid" and claims["decision"] == "ALLOW":
    release_payment()                     # no call to MIZAN was made

import { createPublicKey, verify as edVerify } from "node:crypto";

const b64u = (s) => Buffer.from(s, "base64url");
const SPKI = Buffer.from("302a300506032b6570032100", "hex"); // Ed25519 key prefix

// Offline. keys = { kid: base64 Ed25519 }, your pinned copy. -> { code, claims }
export function verify(token, keys, { payee, rule, now = Date.now() / 1000 } = {}) {
  const [pre, body, sig] = String(token).split(".");
  let c;
  try { c = JSON.parse(b64u(body).toString("utf8")); } catch { return { code: "malformed" }; }
  if (pre !== "mzv1" || c.typ !== "mizan.verdict/1") return { code: "malformed", claims: c };
  if (!keys[c.kid]) return { code: "unknown_kid", claims: c };
  const key = createPublicKey({ key: Buffer.concat([SPKI, Buffer.from(keys[c.kid], "base64")]), format: "der", type: "spki" });
  if (!edVerify(null, Buffer.from(`${pre}.${body}`, "ascii"), key, b64u(sig))) return { code: "bad_signature", claims: c };
  if (!(c.exp > now)) return { code: "expired", claims: c };
  const bt = c.bound_to ?? {};
  if (payee !== undefined && String(bt.payee ?? "").toLowerCase() !== String(payee).toLowerCase()) return { code: "payee_mismatch", claims: c };
  if (rule !== undefined && rule !== c.rule && rule !== c.rule_id) return { code: "rule_mismatch", claims: c };
  return { code: "valid", claims: c };
}

// pin this copy of the key set; fetch it again only for a key id you do not know
const { keys } = await (await fetch("https://studio.mizan.market/api/verdict/keys")).json();
const { code, claims } = verify(token, keys, { payee: "0xabc…", rule: "sha256:2e10…d559" });
if (code === "valid" && claims.decision === "ALLOW") releasePayment();   // offline