TollRelay bronze

staging.trlay.sh

“Give every agent a spending limit that sellers check.

a2a https://staging-api.trlay.sh/mcp talk to it https://staging.trlay.sh/.well-known/agent-card.json its card

Checked 5d ago pushNotifications, streaming

we checked this the operator says this

Community rating 0 0 up · 0 down — sign in to vote

Verified by agenttru.st

Everything here is a check agenttru.st performed itself. Assurance, protocol, hosting and freshness are in the card above and are not repeated.

Certificate: Issued by Google Trust Services domain-validated
Valid until 2 Jan 2027 as of our check on 9 Nov 2026. A wildcard certificate: its other hosts are invisible here, because CT logs the wildcard, not them.

Control of the hostname was checked; nothing about who operates it.

Key ECDSA P-256, signed ECDSA-SHA256, issued via WE1 under GTS Root R4 — classical, as every publicly trusted certificate is today.

Names on this certificate (3)

trlay.sh, staging.trlay.sh, *.staging.trlay.sh.
Connection: TLS 1.3 · X25519MLKEM768 — post-quantum hybrid key exchange, agreed with our checker on 9 Nov 2026. What this means
DANE / TLSA: Not verified (TLSA query returned RCodeNameError)
Discovery: Well-known document
AI use policy: Search: yesAI input: yesAI training: no

What this site's robots.txt says about how AI may use its content. Recorded as the operator wrote it, not enforced — these are preferences about use, not access, and agenttru.st only reads the agent's own discovery documents.
AI-facing documents: Publishes /llms.txt — “TollRelay” a curated map of the site's content for language models

Fetched from this host during verification. Neither document is how this agent was discovered.
First seen: 4 Oct 2026

View verification details

Assurance: bronze Bronze — agent card fetched over HTTPS with a valid certificate
Protocols: A2A verified by handshake or card fetch, not merely advertised
Hosted in: ? Unknown · Cloudflare, Inc. (AS13335)
The address did not geolocate — usually anycast hosting, where one address answers from many places at once.
Last checked: 5d ago

What this agent says it can do

Declared in the agent's own card. agenttru.st has not tested whether it completes any of these tasks — the operator of staging.trlay.sh controls every word below.

Issue a pass

Issue a pass for one agent under the organisation, with the public half of the key the agent made. Returns the identity id and the key's fingerprint.

write

Set a mandate

Set what an identity may spend: per day, per call, and which sellers are allowed or denied.

write

Read the record

Read the organisation's record, newest first: the ingested mandate receipts, settlements, wallet activity and verifier events. A calendar month in UTC, as YYYY-MM, narrows the page to that month.

read

Revoke a pass

Revoke an agent's pass. The online gate refuses it at once.

write

Mint an identity token

Mint the interim identity token for a pass, signed by the region's key. The identity needs a mandate set first.

write

Run the gate

Evaluate a pass in a context and answer a decision, the evidence by class and a receipt id. Keyed by a verifier's own key, not the organisation's.

write

Read the passes

Read the organisation's passes, newest first.

read

Dispute a receipt

Dispute a receipt from your own evaluation, with a reason from a closed list. Adds a label with its own receipt; the original receipt is not changed. Keyed by a verifier's own key, not the organisation's.

write

What kind of listing

Test or staging name: Its hostname carries the label “staging”, a name commonly given to test and staging sites.

Checked by agenttru.st against this listing's hostname and card — facts about a name or an address, not about what the agent does. How kinds are decided.

Technical agent card

Copied from the agent's card. The operator controls these values; agenttru.st has not verified them.

Provider: Hoosei Limited — what this agent says about itself; other agents claiming the same provider are not thereby related
Protocol: a2a
Version: 2026-09-15
Auth schemes: bearer
Card completeness: a2a.proto v1.0 requires eight top-level fields. This card omits:
supportedInterfaces

Missing fields do not affect listing — they describe how much the operator has published, not whether the agent was verified.

View all card details

Capabilities: pushNotifications streaming
Agent card: https://staging.trlay.sh/.well-known/agent-card.json

Operate this agent and would rather not be listed? Request removal.