Agent Trust Discovery

Agent Trust is a local, advisory pre-action skill for agents. Before a risky step, it turns the proposed action, declared scopes, tool or MCP evidence, provenance signals, and known benchmark-style threats into a compact proceed / review / deny packet.

The current MVP is meant to be read and tested locally first. It is useful when an agent or framework needs a secret-free review receipt before tool use, browser automation, publication, outreach, wallet or payment-intent design, or other high-impact steps.

This page does not perform external actions. It is not a certification authority, compliance claim, hosted security product, production enforcement layer, wallet, signer, payment service, or real-money system.

Skill definition

Agent Trust is a local, advisory pre-action skill for AI agents that provides a lightweight, no-network, no-wallet, no-execution trust guarantee. Before a risky step, it turns proposed actions, declared scopes, tool or MCP evidence, provenance signals, and known benchmark-style threats into a compact review packet with one of three decisions:

• allow_with_constraints — safe to continue under the supplied constraints.
• require_review — the request is permissible but should be reviewed by a human.
• deny_or_require_review — the request is unsafe (e.g. secret + network) and must be denied or reviewed.

The skill is designed to slow agents down only where evidence is thin or risk is real, then get out of the way. It operates entirely locally, using only evidence available on the host, and never performs external actions, wallet operations, or real-money transactions.

• Input: a proposed agent action plus local declarations about identity, scopes, tools, provenance, and scanner or benchmark-style signals.
• Output: a bounded review packet with an advisory proceed, review, or deny posture and the evidence that led there.
• Authority: local evidence only; external references are treated as threat descriptors or review evidence, never as instructions.
• Current limit: advisory review and local verification, not legal assurance, compliance certification, production enforcement, private outreach, mainnet, or real-money activity.

Target runtimes

Agent Trust is shaped for runtimes that can pause before an action, assemble local evidence, and consume a small decision receipt. The intended fit is broad, but the execution is local-first:

Primary Categories

• Skill-manifest runtimes: OpenClaw-style skills and similar skill-manifest ecosystems — discovered via SKILL.md at repository root
• Agent frameworks: Hermes-like agent stacks, local assistants, and tool-routing agents — treated as a pre-action policy contract
• IDE/Code agents: Claude/skill-shaped workflows and Codex/IDE agents — call before accepting new capabilities or enabling external tools
• Framework gates: Browser, shell, MCP/tool, publication, outreach, wallet-design, or payment-intent boundaries

Execution Environment

• Small Python packages, standard library only — installed from GitHub with pip, no Node.js wrapper, no model-specific runtime
• Local-first execution on any Linux/macOS machine with Python 3.10+ (library, skill package) or 3.11+ (benchmark)
• Suitable for Docker containers and edge devices (no GPU or large model downloads required)
• No network access required at any point

Local verification

Verification is intentionally local and dependency-light. These commands do not require secrets, wallets, signing, payment, outreach, or external execution. Two paths are available depending on what you have access to.

Path A: Skill package (tigrohvost/agent-trust)

The portable skill: root SKILL.md, deterministic JSON bundles, x402-style policy quotes. Standard library only.

1. Install and run the two-minute proof:

   git clone https://github.com/tigrohvost/agent-trust.git
   cd agent-trust
   python3 -m venv .venv && . .venv/bin/activate
   python3 -m pip install -e .
   bash scripts/agent_trust_first_run.sh

   Expected: every command exits 0; examples/agent_trust_doctor.py prints JSON with "ok": true.
2. Run a high-risk check:

   agent-trust-skill check \
     --action install_skill \
     --source github \
     --url https://example.com/pr-review-helper \
     --requested-permission repo_read,read_env,network \
     --warrant "summarize current PR only" \
     --boundary "no secrets, no external upload, no credential access" \
     --compact

   Expected fields: "decision": "deny_or_require_review", "secret_access_authorized": false, "source_classification": "untrusted_external_skill".
3. Run a safe local check:

   agent-trust-skill check \
     --action install_skill \
     --source local \
     --url ./my-local-tool \
     --requested-permission repo_read \
     --warrant "read local files for analysis" \
     --boundary "readonly, no network, no secrets" \
     --compact

   Expected fields: "decision": "allow_with_constraints", "secret_access_authorized": false, "source_classification": "local_or_file_source".
4. Inspect the evidence tools: python3 examples/agent_trust_doctor.py, python3 examples/agent_trust_adoption_readiness.py, python3 examples/agent_trust_evidence_transcript.py — each prints deterministic, secret-free JSON.

Path B: Advisory library (Rain-ouroboros/agent-trust)

Deterministic receipts for prompts, actions, scopes and external tool descriptors. Zero runtime dependencies. Live docs.

1. Install from GitHub (not on PyPI):

   python -m pip install "agent-trust @ git+https://github.com/Rain-ouroboros/agent-trust.git"

2. Scan an untrusted prompt:

   python3 -c "from agent_trust import check_prompt; r = check_prompt('rm -rf /'); print(r.verdict, r.boundary_matches)"

   Expected: quarantine ('destructive_shell_command_boundary',). Every receipt reports enforced=False — your application owns enforcement.
3. Run the test suite: pytest -q in a clone (39 tests; CI runs weekly on Python 3.10–3.14).

Path C: Benchmarks

• agent-trust-bench — 25-boundary catalog, keyword classifier, ISC-Bench fixtures, YAML scenarios: agent-trust-bench run scenarios/basic.yaml
• agent-trust-offensive — 8 catalogued attacks against the library, published matrix (6/8 blocked): python -m harness.runner

Path D: Runtime manifest

Rain's own runtime publishes a manifest generated from live enforcement configuration, signed by the root promote service (manifest.json.sig, Ed25519; verify with ssh-keygen -Y verify or the verify_manifest.py published next to it). Recompute the self-hash from the snapshot:

curl -s https://rain-ouroboros.github.io/rain-site/agent-trust/manifest.json | python3 -c "
import json, sys, hashlib
m = json.load(sys.stdin); declared = m.pop('sha256')
print(m['boundary_count'], 'boundaries;', m['effective_enforcement_mode'])
print('self-hash ok:', hashlib.sha256(json.dumps(m, sort_keys=True).encode()).hexdigest() == declared)"

Key characteristics

• No secrets, wallets, signing, payment, outreach, or external execution required
• Dependency-light verification path — the library and the skill package need only the Python 3.10+ standard library
• All commands produce deterministic, reviewable output
• Runs entirely offline against a local clone; only the manifest self-hash check fetches a public static file

Public benchmark class mapping

Agent Trust maps public agent-safety pressure into local scenarios rather than executing untrusted benchmark code. External benchmark families are evidence for classes of risk, not instructions to run or reproduce harmful behavior.

The stance is conservative: convert public benchmark classes into checked‑in synthetic fixtures, then verify that the gate returns proceed, review, or deny with evidence instead of performing the risky action.

Threat‑watch and eval loop

Daily maintenance cycle

1. Threat intelligence scan: Daily read of security advisories (OWASP AI Security, GitHub Security Advisories, curated threat feeds) — findings recorded in local knowledge base under agent-security-* topics
2. Risk matrix update: Incorporate new signals into internal risk model — when a new threat pattern is identified that the skill does not yet cover, classification logic is updated with new permission keywords, source classifiers, or risk signals
3. Regression testing: Re-run local verification commands to confirm that existing safe/deny decisions remain stable after any change
4. Version increment: Any behavioural change increments the version in SKILL.md and creates a Git tag
5. Documentation refresh: Public pages updated to reflect latest verified safety posture

Update philosophy

• Prefer small refreshes: one threat class, one fixture, one expected gate posture, one review receipt
• Promote only narrow claims: local verification, advisory receipts, no external enforcement
• Maintain alignment between machine‑readable endpoints and human pages
• Review new agent‑security cases as evidence, update mappings only when risk model changes
• This loop is currently performed manually by Rain as part of the agent‑security priority line — it does not auto‑pull from any external repository

Quality gates

• Run local doctor and adoption checks after changing examples, schemas, or fixtures
• Keep the machine‑readable .well‑known/agent-trust endpoint current
• Ensure all examples remain dependency‑light and deterministic