diff --git a/cvm-server/server.ts b/cvm-server/server.ts
index 453edbc..0e3b8e3 100644
--- a/cvm-server/server.ts
+++ b/cvm-server/server.ts
@@ -22,7 +22,7 @@ import {
   ApplesauceRelayPool,
 } from "@contextvm/sdk";
 import { z } from "zod";
-import { SimplePool } from "nostr-tools";
+import { SimplePool, verifyEvent } from "nostr-tools";
 import type { Filter } from "nostr-tools";
 
 // ─── Config ──────────────────────────────────────────────────────────────────
@@ -60,7 +60,12 @@ async function queryNostr(filters: Filter[], timeoutMs = 8000): Promise<any[]> {
       }
     })
   );
-  return allEvents;
+  // Audit F2 (server-side): only serve signature-verified events to agents.
+  // Unverified community-relay data must never become agent-trusted ground
+  // truth (forged coach profiles / listings would flow straight into agents).
+  return allEvents.filter((e) => {
+    try { return verifyEvent(e); } catch { return false; }
+  });
 }
 
 // ─── Helpers ─────────────────────────────────────────────────────────────────