Public-signal legitimacy check

Is this business real?
Ask before you pay.

Give it a domain. Get back a 0–100 score and the six public signals that produced it — each carrying the evidence it was read from. Deterministic arithmetic, no language model in the scoring path, so your agent can check the working.

example-shop.com · 5 of 6 signals resolvedAn illustrative reading. The unlit stem is the point: a signal we could not observe leaves the weighting entirely rather than counting as zero.

Start with your Ounie account Read the API docs

No subscription — pay in Ounie credits · 5 credits a check · $0.06 keyless over x402

Read this first

Trust Check reports publicly observable signals about a domain. It is not a certification, a credit check, or a fraud determination. A low score most often means a business is new or has a thin public footprint — not that it is dishonest. Read the signals and their evidence before acting on the number.

The six signals

Everything the number is made of, and what each part can’t tell you.

Weighted by how expensive each one is to fake. A registration date and an organization-validated certificate cost time and a real legal identity. A footer link costs nothing — so it moves the number least.

SignalWeightWhat it measures · what it cannot

Domain age
RDAP · the registry itself
25
When the registry says the domain was first registered, who the registrar is, and its EPP status codes.
Many ccTLDs publish no RDAP service. When that happens the signal is reported unresolved, not guessed.
TLS certificate
The live certificate, read off the socket
20
Whether a CA validated a legal organization (OV/EV) or only DNS control, plus issuer, expiry and name coverage.
Certificate age is not scored past a 30-day floor. Let's Encrypt rotates every 90 days, so a young certificate means nothing.
Contact surface
The homepage
20
An email on the site's own domain, a phone number, a contact page, linked social profiles.
A published address is not a monitored one. This measures reachability in principle, not whether anyone replies.
Policy pages
Links from the homepage
15
Privacy, terms, and returns or shipping pages, weighted in that order.
Presence only. Nobody reads them — not us, and, statistically, not you.
Postal address
schema.org markup, then the page text
12
A trading address, best when published as structured PostalAddress markup rather than pattern-matched from a footer.
A PO box scores low and is labelled as a mail drop. We do not verify that anyone is there.
Review footprint
Outbound links to review platforms
8
Whether the business publicly points at a third-party review profile — Trustpilot, G2, Yelp, the app stores.
A footprint, NOT a rating. We do not read the reviews or use their scores. A link is cheap to add, which is exactly why this weighs least.

Weights sum to 100. A signal that does not resolve leaves the denominator — it is never scored as zero, because “we could not look” is not the same finding as “there is nothing there”.

Scoring transparency

A score you can recompute yourself.

The whole model — every weight, every cutoff — is published at GET /api/pricing and through the MCP get_scoring_model tool. Here is the rule that matters most.

Worked example

One signal would not resolve. Watch the divisor, not the number.

Weight in play100 of 100

DomainTLSContactPoliciesAddressReviews

If we scored it zero

64 ÷ 100 × 100

64mixed

A worse reading for a business we simply could not finish looking at.

What Trust Check returns

64 ÷ 92 × 100

70strong

Scored on the five signals that resolved, and the response says so: resolved_signals: 5.

Fall below three resolved signals — or under 45 of the 100 weight — and no number is published at all. The band comes back insufficient and score: null. A trust score you can only get sometimes is more useful than one that quietly changes meaning.

For developers & AI agents

Built to be called by something that isn’t a person.

Three rails, one meter. Every call refuses rather than overdraws: an agent that runs out of credits gets a 402 with the exact shortfall and a link to top up, never a silent debt.

REST

One POST, one reading

Bearer key or the shared Ounie session cookie. Synchronous — the score and its six signals come back on the same request.

curl -X POST https://trustcheck.ounie.com/api/checks \
  -H "Authorization: Bearer trs_live_…" \
  -H "Content-Type: application/json" \
  -d '{"url":"example-shop.com"}'

# → { score: 78, band: "strong", resolved_signals: 5,
#     signals: [{ name:"domain_age", value:0.85, weight:25,
#                 evidence:"registered 2019-03-04 via …" }, …] }

MCP

A tool your agent already knows how to hold

check_business, get_check, list_checks, get_scoring_model, get_credit_balance, get_pricing, whoami. Works in Claude, Cursor, ChatGPT and the Ounie AI Team — that last one can't set headers, so the key rides the URL.

Endpoint  https://trustcheck.ounie.com/api/mcp   (legacy SSE: /api/sse)
Auth      Authorization: Bearer trs_live_…

# Hosts that can't set headers (e.g. the Ounie AI Team):
https://trustcheck.ounie.com/api/mcp?api_key=trs_live_…

# get_scoring_model is public — an agent can fetch the exact
# weights and cutoffs and recompute any score it is handed.

x402

No account, no key — pay per call in USDC

Keyless agents pay on Base. A malformed domain or a non-public address is refused with a 400 BEFORE any price is quoted, so you never sign a payment for a request that cannot succeed. Verification happens before settlement: a check where nothing resolves never takes your money.

curl -X POST https://trustcheck.ounie.com/api/x402/check \
  -H "Content-Type: application/json" \
  -d '{"url":"example-shop.com"}'
# → 402 { accepts: [{ scheme:"exact", network:"base",
#         maxAmountRequired:"60000", payTo:"0x…" }] }

curl -X POST https://trustcheck.ounie.com/api/x402/check \
  -H "X-Payment: <base64 signed payload>" \
  -d '{"url":"example-shop.com"}'

5 credits per check on the credit rails · $0.06 per check on x402 · the dashboard keeps every check you have run, free to re-read.

Full API docs Mint a key

Credit math

5 credits. Nothing for a non-answer.

Most of what a check reads is free — registries publish RDAP themselves, and a TLS certificate is read straight off a socket. Only a stubborn, JavaScript-only page costs us a browser render. That is why this is the cheapest thing Ounie sells, and why the price is a flat five cents rather than a tier.

Reserved at submit, settled when signals resolve.
Zero signals resolved is a non-answer — refunded in full, pool-exact.
Re-reading, listing and exporting past checks is free forever.
Out of credits is a 402 with the shortfall, never an overdraft.

See the pricing page

5 credits reserved while the check runs.

Questions

The awkward ones first.

Does a low score mean a business is a scam?

No, and the product will never say that. A low score means the public footprint is thin — which is what a business looks like in its first month, and also what a perfectly good local trader who has never bothered with a website looks like. It is equally what a throwaway storefront looks like. Trust Check hands you the six signals and their evidence so you can tell which, on the facts, for the transaction you are about to make.

Is this KYB?

No. Real Know Your Business checks a company against registries, beneficial-ownership records and sanctions lists, under a regulatory obligation, usually with documents. This is KYB-lite: it reads what is publicly observable about a domain in a few seconds, for five cents. Use it as a first-pass filter before a small transaction, not as compliance evidence.

Can a business game the score?

Partly, and the weights say which parts. Adding a privacy page and a footer address is cheap, so those weigh less. An organization-validated certificate means a CA checked a legal entity against a registry, and a five-year-old registration means five years — those cannot be bought this afternoon, so they weigh most. The review signal counts a link, is described that way everywhere, and carries the smallest weight in the model precisely because it is the easiest to fake.

What happens when a signal can't be read?

Its weight leaves the divisor. It is never scored as zero — that would punish a business for our blind spot, and would quietly change what the number means whenever an upstream went down. The response always tells you how many of the six resolved. Below three, no number is published at all: the band is insufficient and score is null.

Does a language model decide the score?

No. There is no model anywhere in the scoring path. Observations go into a pure function with fixed weights, which is unit-tested and published in full at GET /api/pricing and through the MCP get_scoring_model tool. The same observations always produce the same number, and you can recompute any score we hand you.

What does a check cost, and when am I not charged?

5 Ounie credits — five cents — drawn from the same wallet as every other Ounie app. If not one of the six signals could be observed, the check has told you nothing and the full amount is refunded. On the keyless x402 rail the equivalent is stricter: an on-chain settlement cannot be reversed, so nothing is ever settled for an empty result in the first place.

Can I check any URL?

Any public one. Addresses that cannot name a public site — loopback, private ranges, link-local, single-label LAN names — are refused with a 400 before anything is fetched or, on x402, before any price is quoted. A hostname that resolves into private space is refused at the same gate.

Do you store what I check?

Your own checks are kept on your account so you can re-read them for free. Keyless x402 checks are recorded without an owner, because there is no account to attach them to. We do not sell a directory of scored companies, and no business is listed or ranked anywhere on this site.

Check the counterparty before the money moves.

Five cents, five seconds, and a paper trail you can show someone.

Is this business real?Ask before you pay.

Everything the number is made of, and what each part can’t tell you.

Domain age

TLS certificate

Contact surface

Policy pages

Postal address

Review footprint