Skip to content

v0.1.0 — Trust Cards for AI agents & MCP servers

Latest
Latest

Choose a tag to compare

View all tags
@gautamkishore gautamkishore released this 09 Sep 07:47
· 12 commits to main since this release
v0.1.0
0d497c3

What is AgentTrust?

A free, local-first trust and security scanner for AI agents and MCP (Model Context Protocol) servers. It answers three questions: can I trust this agent, what is it allowed to do, and can I prove it.

What's inside

  • 8-rule static suite (AT-SEC-001–007 + AT-COMP-001) mapped to OWASP Agentic Top 10 (ASI) and OWASP LLM Top 10 2025
  • Trust Card (agenttrust/trust-card/v1) with A–F grade, 0–100 score, permission manifest, and inferred host compatibility
  • SARIF 2.1.0 + Markdown reports, --fail-on CI gate, drop-in GitHub Action
  • Shareable grade badges and an attack (static-heuristic) + eval (simulation) lab with honest mode labels
  • State of MCP Permissions: 50 popular public MCP servers scanned (avg 64.6/C, 38% D-or-F) — see docs/STATE-OF-MCP-2026.md

Quickstart (source until the npm package lands)

git clone https://github.com/eulogik/AgentTrust.git && cd AgentTrust
npm install
node packages/cli/dist/index.js scan ./examples/vulnerable-mcp-server --quiet

Live demo and badges: https://eulogik.github.io/AgentTrust

Honesty notes

Static analysis only (regex-based, no AST yet); attack analysis is heuristic (no payloads execute); workflow eval is simulated (nothing runs). Trust Cards are evidence input — not a certification. Deterministic finding IDs keep SARIF diffs stable.

Assets 2
Loading