Certification
Automated via MCP server
Your AI agent takes your product through the audit. NOCIP measures for itself, writes every step to a signed log, and a person signs the label.
Applications are open. The lab currently tests Linux programs (x86-64); Windows, macOS and cloud services go the way With documents for now. You can still send the self-assessment and evidence through the interface.
The same criteria, the same audit checklist and the same audit report apply as in the audit with documents. Only the way differs: self-assessment, evidence and answers come through an interface, the tests run in our lab as soon as your agent requests them, and you can see the state at any time.
Everything your agent sends is a claim. What can be measured, we measure ourselves: we download the program, fetch your pages and record the network traffic.
Why automated via MCP server
- No forms: self-assessment and evidence arrive as data; the interface reports missing items at once.
- No appointment for the test: the lab tests your release as soon as your agent requests it; the result is there within minutes.
- The state at any time: get_status says what has been received and checked and what to do next.
- New versions without paperwork: your build system announces them, a green re-check extends the label.
- Traceable: every step is in the signed case log, which you can verify yourself.
Automated via MCP server or with documents
| With documents | Automated via MCP server recommended | |
|---|---|---|
| Self-assessment | fill in a DOCX, send it by e-mail | JSON through the interface, checked at once |
| Evidence | as attachments by e-mail | an address is enough, NOCIP fetches it; files up to 25 MB |
| Technical test | agree test access, appointment | on request in the lab, result within minutes |
| State of the audit | on request by e-mail | at any time, with the next steps |
| Record of the audit steps | audit report | audit report and signed case log |
| New versions | report by e-mail, re-check by NOCIP | announced by the build system, a green re-check extends the label |
| Platforms | all | Linux programs for now; Windows, macOS and cloud services follow |
| Criteria, audit report, cost | the same, free of charge | the same, free of charge |
Who is active in which step
| Step | Your agent | NOCIP systems | Person at NOCIP | Decided by | Duration |
|---|---|---|---|---|---|
| S0 Access | active | active | active | person at NOCIP | once; reply by e-mail |
| S1 Prove the domain | active | active | program code | 1 to 2 minutes | |
| S2 Self-assessment | active | active | program code | at once and after about 2 minutes | |
| S3 Evidence and connection manifest | active | active | program code | 1 to 2 minutes | |
| S4 Test target | active | active | program code | depends on the file size, usually under 5 minutes | |
| S5 Technical test in the lab | active | active | program code | a few minutes (LexITanon: under one minute) | |
| S6 Review of the documents | active | active | person at NOCIP | working days, depending on the scope | |
| S7 Findings | active | active | only when needed | program code | minutes; with a person, working days |
| S8 Draft report | active | active | active | program code | 1 to 2 minutes |
| S9 Award | active | active | person at NOCIP | working days | |
| S10 Seal and disclosure | active | active | only when needed | program code | ongoing |
| S11 New versions | active | active | only when needed | program code | a few minutes |
active only when needed
Every step in full detail: the process in detail. To read and pass on: the handbook (PDF).
For AI agents: the MCP server
At https://nocip.com/mcp/, every step is available as a tool for AI agents (Model Context Protocol, Streamable HTTP). The token names the case. Your agent starts with get_status; its “next” list says what to do next. For example in Claude Code:
claude mcp add --transport http nocip https://nocip.com/mcp/ \ --header "Authorization: Bearer nct_..."
Tools: get_status, prove_domain, submit_self_assessment, add_evidence, set_test_target, request_test, list_findings, answer_finding, get_case_log, get_report_draft, get_seal, notify_release, get_criteria, withdraw. There is no tool to award, score or change results.
REST interface
The same steps for build systems and your own scripts at https://nocip.com/api/v1/, described in the OpenAPI file. The formats as JSON Schema: self-assessment, connection manifest, test target.
curl -H "Authorization: Bearer nct_..." https://nocip.com/api/v1/cases/NOCIP-A-2026-0001
The connection manifest
Every destination your software connects to, with purpose and frequency (index group I-5), at https://your-domain/.well-known/nocip.json. The lab compares every recorded connection attempt with it, in the audit and in every re-check. An example:
{
"schema": "nocip-connections/1",
"product": "LexITanon Desktop (Linux)",
"version": "0.5.0",
"connections": [
{"host": "lexitanon.com", "port": 443, "purpose": "licence-check",
"when": "once a day", "volume_per_day_kb": 5},
{"host": "lexitanon.com", "port": 443, "purpose": "update-download",
"when": "only when the user clicks"}
],
"ai_processing": [{"function": "recognition", "location": "customer", "network": false}]
}The case log
Every step, whether by your agent, the lab or the auditor, is an entry with time, actor, the files used (as SHA-256) and the result. Every entry contains the hash of the one before and is signed by NOCIP with Ed25519; a removed or changed entry shows. You read your log at any time with get_case_log and verify it with the public key. The audit report names the case number and the last hash.
Confidentiality
Your documents and test results stay on the servers of NOCIP. No document goes to a cloud AI service: what NOCIP audits applies to NOCIP itself. The test corpus with the canary values stays private and is different for every case.
Access for your agent
Name the product, tier and domain in the contact form. We set up the case and send you the token.