SDK and MCP

Three ways to check an agent from code. All return the same data as the API.

TypeScript: @quaestor/sdk

import { Quaestor } from "@quaestor/sdk";

const q = new Quaestor({ baseUrl: "http://localhost:3732" });

const c = await q.check("0xMasterAddress");   // slug, Hyperliquid address or registry id
if (c.verdict === "avoid") throw new Error("Severe anti-cheat flag");

const board = await q.leaderboard("linked");
const score = await q.score("my-agent");        // components, metrics, flags
const page = await q.fills("my-agent", { limit: 100 });

// Independent check: signer recovered locally, registry read straight from the chain,
// Merkle root rebuilt from the raw fills.
const v = await q.verifyProof(c.proof!.digest);
console.log(v.ok, v.signatureValid, v.onchain, v.fills);

verifyProof(proofOrDigest, { rpcUrl?, trustedAttester?, checkFills? }) returns { digest, signatureValid, signer, attesterTrusted, onchain, fills, ok }. Pass trustedAttester to pin the attester address instead of reading it from the engine.

The SDK re-exports everything in @quaestor/shared: types, fillLeaf, fillsRoot, merkleProof, verifyMerkle, recoverProofSigner, the contract ABIs and the chain config.

Python: quaestor

Standard library only (Python 3.9+), in packages/sdk-python.

from quaestor import Quaestor

q = Quaestor("http://localhost:3732")
c = q.check("0xMasterAddress")
print(c["score"], c["verdict"], [f["title"] for f in c["flags"]])

proof = q.proof("my-agent")
print(q.verify(proof=proof))   # server-side verification

MCP server: @quaestor/mcp

Gives assistants and agents three read-only tools:

Config for any MCP client (stdio):

{
  "mcpServers": {
    "quaestor": {
      "command": "node",
      "args": ["/path/to/Quaestor/packages/mcp/dist/index.js"],
      "env": { "QUAESTOR_API": "http://localhost:3732" }
    }
  }
}

Once the packages are published to npm, "command": "npx", "args": ["@quaestor/mcp"] works the same way. The server holds no keys and makes no writes.