How Zoro uses ENS
ENS is a public name book. Zoro gives every tool version a name in it and writes “checked: safe” or “checked: unsafe” next to that name, where anyone can read it but only Zoro’s auditor can write it.
Technically: Zoro gives every MCP server, tool and tool version an ENS name, and writes each verdict onto that name as text records that anyone can read, but that only the Auditor key is allowed to write.
Think of it as a public phone book with a safety rating
Every tool gets an entry, like a business in a phone book. Next to each entry is a rating sticker that only the official inspector is allowed to put there.
Without ENS
Ratings live in one company’s private database. You have to trust it, and nobody else can look them up.
With ENS
Anyone, anywhere, can look up a tool by name and see the inspector’s verdict and signature.
From first principles
Why Zoro needs ENS at all.
Five short steps, from the problem to the answer. Each card has a plain version; open “technical version” for the details.
The problem
A tool can quietly change, and there is no public place to check whether today’s version was ever approved.
Show the technical version
Why the obvious fix fails
A private list can be edited secretly, and letting tool makers rate themselves is like students grading their own exams.
Show the technical version
What is actually needed
A public list of names that anyone can read, where the rules about who may write are enforced by the system itself.
Show the technical version
Why ENS provides exactly that
ENS names work like folders (tool.server.zoro.eth), anyone can read them, and the blockchain enforces who may write.
Show the technical version
So Zoro uses ENS as
The public name book of verdicts: one name per tool version, with the result written next to it.
Show the technical version
Inside Zoro
What happens, step by step.
Name every version
Each server, tool and version gets its own address, like a street, house and flat number.
How exactly?
<server>.<root>, each tool <tool>.<server>.<root>, and each audited version fp-<first 8 hex of fingerprint>.<tool>.<server>.<root>. current.<tool>… points at the live version; Lab records live under lab.<root>.Separate who may write
The owner of the names and the inspector who writes verdicts hold different keys, so neither can fake the other.
How exactly?
ROLE_SET_TEXT and ROLE_LINK. The operator who owns the names cannot forge a verdict with the auditor’s key, and the auditor cannot take the names. The auditor address is published on the root as zoro.auditor.Write the verdict
When a tool passes inspection, the result and the inspector’s signature are written onto its name.
How exactly?
zoro.* text records listed below onto its version name, including the auditor’s signature over the verdict and a pointer to the Hedera message.Revoke in public
If a tool turns bad later, its record changes to “revoked” for everyone at once. It can’t be quietly deleted.
How exactly?
zoro.status = revoked. Any client that resolves the name sees the revocation; it cannot be hidden by deleting a row.For developers
Text records written on each version name
You don’t need this to use Zoro. It is the exact data Zoro writes, so anyone can check it independently.
| Record | What it holds |
|---|---|
| zoro.fingerprint | Canonical fingerprint of every field the model can read |
| zoro.verdict | sealed, sealed_with_warnings or unsafe |
| zoro.risk | Risk score from the Sentinel audit |
| zoro.capabilities | What the tool can do (send mail, move money, …) |
| zoro.findings | Number of findings and the verdict hash |
| zoro.attestation | Auditor signature over fingerprint + verdict hash |
| zoro.verdictHash | Hash of the full verdict package |
| zoro.auditor | Address of the key that signed |
| zoro.audited / zoro.expires | When it was audited and when the seal expires |
| zoro.ledger | hedera:<network>:<topic>:<sequence> of the matching ledger message |
| zoro.status | active, or revoked once the version is revoked |
| zoro.serverVersion | Version the server declared |
Where you see it in Zoro
- Verify page: look up a tool by ENS name and check the record against its signature
- Registry explorer: browse servers, tools and versions
- Every gateway: the first gateway to meet a bad version protects everyone who resolves the same name
What it does not do
- By default Zoro writes to ENSv2 on Sepolia, the Ethereum test network (ENS_NETWORK can switch it).
- Records describe tools only: never your prompts, files or identity.
- A record says what the auditor checked and concluded. It never claims a tool is simply “safe”.
Read the code
Try it
See ENS doing its job inside Zoro.
The other tracks