AgentAvow

AgentAvow (formerly AgentGraph) is a security rating and attestation service for the AI agent tool ecosystem, with the core goal of answering "is this tool safe for my agent to connect to". It works for any tool, MCP server, npm or PyPI package, and OpenClaw skill, and also supports entering a wallet address that resolves to one of the above objects.

Main capabilities

• Three-tier conclusions with reasons: Each scan first gives one of "Safe to connect", "Review before you connect", or "Do not connect", along with the reason.
• Dual scoring system: After the conclusion, it gives a trust score from 0–100 (including the trust tier as detail) as well as an adoption score built from real usage (downloads, stars, installs). The trust score is calculated from scan findings and comes with sub-scores across five independent dimensions: secret hygiene, code security, data handling, filesystem access, and dependency health. Each finding has a severity level and points to a specific line of code or manifest entry.
• Signed verifiable attestation: Each result comes with a JWS attestation (EdDSA / Ed25519, RFC 7515) based on the canonicalized verdict (RFC 8785 JCS). Anyone can recompute and verify it offline against the public JWKS at agentgraph.co/.well-known/jwks.json.
• Trust tiers and recommended limits: Each trust score maps to a trust tier (from verified to blocked) and gives a recommended execution posture (requests per minute, token budget, confirmation prompts), making it easy for gateways or agent frameworks to enforce automatically.
• Trust badge: A one-line shields.io-compatible SVG badge that can be placed in a README, showing the repository's current conclusion and signed trust score, and linking to the full verifiable report. The badge is served with open CORS and refreshes from the hourly scan cache.
• Monitoring and change alerts: You can monitor a tool, and AgentAvow will rescan and alert when its score drops or its signed tool definition changes (tool_manifest_digest drift), helping detect "rug pull"-style changes.
• Claim a repository: Prove ownership of a public repository by adding a GitHub topic (no token is stored), or use a temporarily provided GitHub token to run a private scan (not persisted, and not added to the public directory).
• Public trust directory: A paginated, filterable scan directory (launch corpus plus community on-demand scans) that can be browsed by surface, severity level, and score.

How to use

• Free anonymous scan: No account and no installation required. Point AgentAvow at any GitHub repository, MCP server, npm or PyPI package, OpenClaw skill, or wallet address to get one of the three-tier conclusions and the reason. Results are cached for 1 hour, and ?force=true can be used to force a rescan.
• Use from Claude Code: An MCP server is provided (see sdk/mcp-server/). The recommended Claude Code plugin is listed in the Anthropic plugin directory and bundles an MCP connector, a /scan command, a skill that scans servers or packages before Claude adds or installs them, a SessionStart hook (checks when a configured MCP server is first seen; warning only, fail open), and a PreToolUse gate (checks the result in the file before each MCP tool call: denies calls to servers read as "Do not connect", and asks first for tools whose definitions have changed since the check). You can also install the plugin directly from the repository, then try /scan npm chalk. The hook skips servers on localhost or private networks, redacts URLs whose paths appear to carry secrets, and strips credentials and query strings before the URL leaves the local machine.
• Connector only: Add AgentAvow from the connector directory in Claude (web or desktop); it can also be configured manually in Claude Code without using the plugin.
• Connect from an editor: The remote MCP server is at https://agentavow.com/mcp（Streamable HTTP, no authentication, read-only), no installation required. One-click installation links for Cursor and VS Code are provided, and it can also be added manually to ~/.cursor/mcp.json, project-level .cursor/mcp.json, or .vscode/mcp.json. The local stdio server can be installed via pip install agentavow-trust.
• CI gates: A GitHub Action, GitLab CI component, Bitbucket Pipe, Azure Pipelines template, or local CLI can fail the build when the verdict is "do not connect" (fail_on: do_not_connect). The npm package agentavow-trust adds per-call gates for the Vercel AI SDK, Flue, Claude Agent SDK, and OpenAI Agents SDK; Python gates for LangChain, Google ADK, Claude Agent SDK, and OpenAI Agents SDK are located in src/bridges/. For policy engines and gateways, integrations/opa/ provides Open Policy Agent policies (including an Envoy ext_authz example), and integrations/litellm/ provides guardrails for the LiteLLM MCP gateway. A runnable rug-pull demo is available in demos/rugpull/.

Deployment and Development

• Environment requirements: Python 3.11+ (3.12 for production), optional Docker and Docker Compose.
• Docker Compose (recommended): The backend API is at http://localhost:8000，前端位于 http://localhost（端口 80), PostgreSQL is at localhost:5432, Redis is at localhost:6379, and database migrations run automatically at startup.
• Local development: The backend runs at http://localhost:8000，前端运行于 http://localhost:5173（将 API requests are proxied to the backend).
• Configuration: Required items are in .env, optional items are in .env, secrets are in .env.secrets, and frontend configuration is in web/.env.
• API: The public scan API requires no authentication. All application endpoints use the /api/v1 prefix; interactive API documentation is at /api/v1/docs (Swagger) and /api/v1/redoc (/docs is the product documentation). GET /health (no prefix) checks database and Redis connectivity.
• Code standards: Use from future import annotations for union types; ruff checks (E, F, I, N, W, UP rules), line width 100; all Python files must be parseable by AST; new or changed code requires unit tests.
• Security features: CORS with configurable origins, rate limiting (separate limits for reads, writes, and authentication), security response headers (HSTS, X-Frame-Options, X-Content-Type-Options, etc.), request ID correlation tracking, content filtering with HTML sanitization, HMAC-SHA256 webhook signatures, bcrypt password hashing, JWT token blacklisting on logout, and audit trails for sensitive operations.

Architecture and Limitations AgentAvow is a layered scanning and attestation pipeline: scans produce evidence, evidence is scored and normalized, and verdicts are signed into attestations that anyone can recompute and verify offline. Monitoring forms a closed loop: a background rescan job compares each monitored tool's new score and signed definition digest with the previous one, and any change triggers an HMAC-signed webhook alert. This software is proprietary, all rights reserved. Information not provided in the materials regarding specific fees, pricing, platform coverage, or effectiveness is not currently available.