How it works

A trust score you don't have to trust.

Most "trust scores" are a black box — you take the number on faith. Ours is different: it's an aggregate over signed evidence. The score is one recognizable, portable number, but underneath sits a cryptographic receipt anyone can recompute and verify.

Two axes, one signed record.

Attestation Trust is the signed safety score from our scanner — live and verifiable now. Adoption reflects how much the ecosystem actually uses a tool. Together they tell you both "is it safe?" and "is it real?"

Example — a widely-used, safe toolillustrative

Safe to connect — nothing found in its shipped code

94/100

Trusted

Attestation Trust

12.4k★

Established

Adoption

Paste → scan → run → sign.

You paste a URL

A repo, MCP server, npm/PyPI package, or skill. No signup, no install.

We read the actual code

Not metadata or self-claims — the real source, across the categories below.

We run it in a sandbox

Packages and MCP servers are installed and run in isolation, every tool called, with fake credentials planted.

You get a signed score

A 0–100 trust score plus a cryptographic attestation you can verify offline. The sandbox run is signed separately.

Behavioral sandbox: what the tool actually does.

gVisor · canary credentials · signed

Reading code misses what only shows up at runtime. So we install npm, PyPI and Docker packages in a fresh gVisor container, start MCP servers and call every tool with synthetic arguments, and fill the environment variables a tool reads with canary credentials. If a canary leaves the machine, that is credential exfiltration, rated critical. We also flag undeclared network hosts and read-only tools that write files. Each run is signed as a BehavioralObservation and shown beside the score. Watches alert you when a later run turns up new sandbox findings, and the GitHub Action can fail a build on a high or critical sandbox finding.

12,955 sandbox runs29,596 tools called0 canary leaks caught267 behavioral findings

How the behavioral sandbox works →

Or run it in CI — on private code.

same engine · same score · offline

The exact scanner runs in your own runner or terminal, so a private repo never leaves your machine. Fail a PR when the answer is Do not connect and get findings as inline annotations — the signed attestation is the one part that stays with us.

# CI (private repos, runs in the runner)
- uses: AgentAvow/AgentAvow/local-scan-action@main
  with: { fail-on: "do_not_connect" }

# or locally
agentavow scan . --fail-on do_not_connect

Run locally & in CI →

What we check

The engine runs 12 detection categories — a score page shows the ones that applied to that surface. The main ones:

Secret hygiene

Exposed API keys, tokens, and credentials in the code.

Code safety

Unsafe execution — shell-outs, eval, dynamic code paths.

Data handling

Where your data goes and how it's treated.

Filesystem access

What files it can read and write, and whether that's scoped.

Network & exfiltration

Calls out to external hosts that could leak data.

Lethal trifecta

The exfiltration setup: a tool (or a server’s tools together) that can read private data + reach the internet + take actions. Any one is fine; all three is how data walks out. We flag it as a blocking critical.

Prompt injection

Surfaces where a malicious input could hijack the agent.

Obfuscation

Hidden or deliberately unreadable payloads.

Dependency health

Outdated or known-vulnerable dependencies.

For your agent

Give your own agent this check, built in.

The same scan runs as an MCP server. Add it to your agent and it can ask "is this safe to install?" — getting a signed safety score before it connects any tool, package, or server. Free, no account. One line: uvx agentavow-trust

Add to Cursor →Add to VS Code →Claude Code & full setup →

Verify

Signed, so a tool can't show one score and be another.

Each result is signed with Ed25519 (JWS): the score and the tool's definition, captured the moment we scanned it. Nobody can hand you a doctored number, and if a tool swaps its definition after you trusted it, the signed digest no longer matches and we flag it. Verify any attestation offline against our public keys — a signature, not just a badge: you don't have to trust AgentAvow, you can check the math.

Public keys (JWKS) ↗Test vectors ↗

Live verification

Verify a real attestation, right here.

This runs entirely in your browser against our public keys — no server round-trip for the check. Try any tool:

verifying: sigstore/cosign · loading…

Built in the open

Open standards & interoperability

The evidence format and conformance vectors are public and versioned, developed alongside the wider agent-trust standards community. Reproducibility across independent implementations is the whole point.

Safety Model spec (v1)

↗

Exactly how a scan composes into the 0–100 score, the tiers, and the Certified gate — the model published separately from the code, so anyone can recompute a score from the same findings.

Tool manifest — .agentavow.yml

↗

Declare the hosts your tool contacts and the capabilities it uses; the sandbox holds it to its own declaration. Undeclared egress is a finding.

CTEF — Cryptographic Trust Evidence Format

↗

The signed, reproducible evidence envelope any implementer can recompute byte-for-byte. Versioned in the open.

Published test vectors

↗

Conformance vectors served at /.well-known so anyone can validate their own implementation against ours.

ERC-8004 reader

↗

Reader for ERC-8004 identity and reputation records; not yet used in any answer or score.

AIPOU cross-fixture

↗

A shared conformance fixture proving two independent implementations agree.

Independently cross-run in the LF DT lab

↗

Our CTEF conformance vectors, positive and adversarial/fail-closed, were reproduced byte-for-byte in the Linux Foundation Decentralized Trust Agent Authority Conformance lab, by a party other than us.

MCP & AIP bridges

↗

Adapters so the trust layer plugs into the frameworks agents already use.

How we're different

Everyone can give you a number. One row is ours alone.

There are good MCP scanners and trust registries now — the ecosystem needs them. Here's the honest landscape and the one property none of them have.

Property	Directory scores (Smithery, mcp registries)	Trust checkers (mcpskills, others)	AgentAvow
Free public safety score + README badge	~	✓	✓
You can recompute it yourself	✕	✓	✓
Independent (not a vendor grading its own gateway/listings)	✕	~	✓
Cryptographically SIGNED — tamper-evident, offline-verifiable	✕	✕	✓

Recompute proves the math. A signature proves who issued the score, when, and that the number in your README wasn't altered — the audit trail a live-fetched badge structurally can't give. (Signing covers the safety score; adoption is a separate directional signal.)

Check a tool now →