# CoverBureau

> CoverBureau is a pay-per-call compliance-checking service for US Certificates of Insurance (ACORD 25). It reads a certificate, judges it against your requirements, and returns a signed verdict anyone can verify. It is built for AI agents: the endpoint is a remote MCP server, calls are paid per request in USDC on Base via the x402 protocol, and no account, API key, or signup is required.

CoverBureau checks certificates against requirements and reports what it finds. It does not make, file, advise on, or publish insurance rates.

## How to call it

The service is a remote MCP server. Send JSON-RPC 2.0 over HTTP POST to the MCP endpoint. An unpaid call returns HTTP 402 with a payment challenge describing the price, the asset, and the recipient; pay it and retry the same request to receive the result. This is the standard x402 flow, and any x402-capable client handles it. Prices are per call, settled in USDC on Base mainnet: extract_coi $0.02, validate_coi $0.075, check_carrier $0.01.

## Verifying a response signature

Every response is returned inside a signed envelope containing the payload, an Ed25519 signature over the canonical JSON of that payload, the key id, and an issued-at timestamp. Fetch the public key from the JWKS URL and verify the signature yourself; verification does not require trusting CoverBureau or calling it again. Canonicalization follows RFC 8785 (JCS).

## What to know before relying on it

Decisions are made by a deterministic rules engine, not by a language model: a model reads the document, and code makes the pass/fail determination and computes the risk score. Low-confidence readings are reported as review rather than guessed.

Carrier reference data is a curated seed dataset. NAIC numbers, ratings, and licensing are best-effort and may be stale or incorrect. Every check_carrier response reports its datasetStatus so the data's status travels with the answer, and adverse conclusions drawn from unverified data are routed to human review rather than returned as a hard failure.

CoverBureau checks what a certificate says and whether it meets your requirements. It does not assess whether the document is genuine. That is a separate discipline, document forensics, and a well-made fake that satisfies your requirements will pass here. If artifact authenticity matters for your use case, run a document-authenticity tool alongside it.

Extraction accuracy is gated rather than advertised as a headline number: a release cannot ship unless every material field scores at least 95% against our own hand-labelled golden set, and unless every material field on a severely degraded document is either correct or carries low self-reported confidence. That corpus is internal, not an independent benchmark.

Scope is US ACORD 25 certificates. Other ACORD forms and non-US jurisdictions are out of scope.

## Endpoints

- [MCP endpoint](https://coverbureau.com/mcp): POST JSON-RPC 2.0. Returns HTTP 402 with an x402 payment challenge until paid.
- [Signing public key (JWKS)](https://coverbureau.com/.well-known/jwks.json): Ed25519 public key for verifying every response.

## Tools

Which one to call: extract_coi gives you the fields and no judgment, for callers applying their own rules. validate_coi reads the certificate and judges it against requirements you supply; it extracts as part of its work, so calling both on one document pays for the same read twice. check_carrier needs no document at all, so use it when you have a carrier but no certificate - validate_coi already checks the carrier when you do.

- [extract_coi](https://coverbureau.com/#extract_coi): $0.02 per call. Reads a certificate into structured data. Extraction only, no validation, for callers that just want the fields.
- [validate_coi](https://coverbureau.com/#validate_coi): $0.075 per call. Judges a certificate against your requirement profile check by check: required coverages in force on the date you specify (default today) and not expiring inside your notice window, limits at or above your minimums, general liability on an occurrence basis, additional insured and waiver of subrogation with the evidence source recorded (the ADDL INSR / SUBR WVD column, or endorsement wording such as CG 20 10 in the Description of Operations), named insured and certificate holder matches, carrier rating against your threshold, and ACORD edition. Every failure states what was required, what the certificate showed, and why it fails; anything it cannot read cleanly returns review rather than a guessed pass. The verdict records the evaluation date it used, so an as-of result cannot be mistaken for valid today.
- [check_carrier](https://coverbureau.com/#check_carrier): $0.01 per call. Given an NAIC number or carrier name plus a US state, returns recognition status, financial-strength rating, and whether it meets a minimum threshold.