Questions, answered.

AgentAvow tells you whether a tool, MCP server, or package is safe for your AI agent to connect to. Paste a URL and get one of three answers with its reason (Safe to connect, Review before you connect, or Do not connect), a signed 0–100 trust score backed by scan evidence anyone can recompute, and an adoption score from real usage.

Yes. Checking any tool is free and requires no account. An account is only needed to watch tools for change-alerts, manage API keys, or claim repositories you own.

No. Checking a tool and browsing the catalog are free and need no signup. The site keeps its own analytics; the privacy policy says what they record.

We read the actual source code across 12 safety categories — exposed secrets, unsafe code execution, data handling, filesystem and network access, prompt-injection surfaces, obfuscation, and dependency health — and produce one of three answers, a 0–100 trust score and a signed attestation.

Every result leads with one of three answers and the reason behind it. Do not connect: a critical finding in the tool's own code, a leaked canary credential in the sandbox, or a known-malicious package. Review before you connect: a hardcoded credential (it exposes the vendor's key, not yours), a high finding, a known advisory on the version you would install, a deprecated package, or a trust score below 51. Safe to connect: none of those. Under the answer sit two scores: the signed 0–100 trust score (higher is safer) and the adoption score. The trust score also maps to a tier (Verified, Trusted, Standard, Minimal, Restricted, Blocked) that sets a recommended rate limit and confirmation posture; the answer, not the tier, says whether to connect. A result reflects a scan at a point in time, so watch anything you depend on.

The behavioral sandbox runs a limited number of tools at once. When every slot is busy, a new run waits its turn and the result shows its place in the queue; the answer from the code scan is shown meanwhile and updates when the run finishes. If no slot frees up for two hours, the result says the sandbox is unavailable and the answer stands on static analysis alone.

Attestation Trust is the signed safety score from our scanner (verifiable now). Adoption reflects how much the ecosystem actually uses a tool — real usage like stars, checks, and watchers, not opinions.

Both. The scan reads the code. For npm and PyPI packages, Docker images and MCP servers published as packages, a behavioral sandbox also installs and runs the tool in a fresh gVisor container: it starts an MCP server, calls every tool with synthetic arguments, and fills the environment variables the tool reads with fake canary credentials. It reports undeclared network hosts, read-only tools that write files, and any canary that leaves the machine (graded critical). Each run is signed as a separate BehavioralObservation and shown beside the score. Remote MCP servers reached by URL are not run, because calling someone else's live server could have real side effects.

If the registry says the maintainer has retired it (npm marks the resolved version deprecated, or PyPI marks the release yanked or the project Development Status :: 7 - Inactive), the scan adds a medium maintenance finding that quotes the maintainer's message. It lowers the score but does not cap it the way a critical finding does. A deprecated package gets no more security fixes, so treat it as "don't adopt for new work" even if the code looks clean.

Yes. Add AgentAvow's MCP server to your agent (Claude Code, Cursor, or your own runtime) and it pulls a tool's signed answer before your agent connects, so an unsafe tool is stopped in the loop rather than found after the fact. It uses the same free, signed scan as the website and needs no account.

Every result is signed with Ed25519 (JWS). You can verify any attestation offline against our public keys — no call back to us required. If a single byte of the score is altered, verification fails. It's a signature, not just a badge.

Use the live verification tool on the How-it-works page, or check any attestation against our public JWKS. The evidence format and conformance vectors are published and versioned in the open.

No. A directory's in-house number and a self-assigned badge are figures you take on faith — they live on one platform and disappear off it. An AgentAvow score is cryptographically signed and recomputable by anyone: it travels with your tool (README, npm, CI) and doesn't depend on us being online. A directory optimizes for discoverability; we grade for safety, and we let you check our work.

Check your repo and copy one line of Markdown. The badge regenerates on every view (never stale), is signed, and links back to a full, verifiable report — no account needed to mint one.

Yes — a REST API, Python and npm SDKs (agentavow-trust) with gates for the Vercel AI SDK, Flue, the Claude Agent SDK and the OpenAI Agents SDK, a local CLI, a GitHub Action, a GitLab CI component, a Bitbucket Pipe, an Azure Pipelines template, an Open Policy Agent policy, and a LiteLLM proxy guardrail for its MCP gateway. The CI gates fail the build when the answer is Do not connect (fail_on: do_not_connect, the default; set review to be stricter). The Action also prints the sandbox result, and with fail_on_behavioral: true it fails the build on a high or critical sandbox finding. See the developer page and docs.

When you add an MCP server that runs from an npm or PyPI package, the plugin's session-start check prints one line per server: the answer and its reason, the trust score, then the sandbox result (for example "sandbox: clean, 9 tool(s) exercised", the number of behavioral findings, or why the server could not be exercised). If the maintainer has deprecated the package, the line says so. The session-start check only warns. Installing something that reads Do not connect asks you first, the per-call gate stops a tool on a server that reads Do not connect, and it asks you before using a tool whose definition changed since it was checked.

Yes. Claim the repository to get private scans (verify ownership with a GitHub topic — no token stored), or scan with a token you supply that's used transiently and never persisted.

We re-scan the tools you watch and alert you — by email, in-app, or webhook — the moment a score drops or a signed definition changes. That's the rug-pull you'd otherwise miss. Definition-change alerts cover GitHub repos, OpenClaw skills and live MCP servers; npm and PyPI packages alert on score. Once the sandbox has run a watched tool, a later run that turns up new behavioral findings (for example a leaked canary or a new undeclared host) sends an in-app and webhook alert too.

Add a GitHub topic we give you to the repo to prove ownership. A verified claim gives you private scans, continuous re-scans with change alerts, and control over how the tool appears in the catalog and search.