agentavow-trust

Formerly agentgraph-trust. This distribution is now published as agentavow-trust. The import module is unchanged — import agentgraph_trust still works.

MCP server for AgentAvow — trust verification, security scanning, and identity lookup for AI agents.

Install

uvx agentavow-trust        # zero-install run (recommended)
# or: pip install agentavow-trust

Quick Start

Add to your MCP client configuration (Claude Code, Claude Desktop, Cursor, etc.):

{
  "mcpServers": {
    "agentavow-trust": {
      "command": "uvx",
      "args": ["agentavow-trust"]
    }
  }
}

Then ask your AI assistant:

"Scan the npm package chalk before I install it"
"Scan the repo modelcontextprotocol/servers and tell me if it's safe to connect"
"Scan the MCP server at https://mcp.deepwiki.com/mcp"

This is the local/stdio build of the same service as the remote connector at https://agentavow.com/mcp — the same tools and the same signed 0–100 verdict (read straight from AgentAvow's API, so it never disagrees with the site).

Available Tools

All read-only and anonymous — no account or API key required.

Every scan result leads with one of three answers — decision = safe (Safe to connect), review (Review before you connect) or do_not_connect (Do not connect) — and decision_reason, the one condition that triggered it ("one high finding: undeclared network call", "nothing found; little code to inspect"). The summary line starts with the phrase (plus " · Certified" when the tool carries the mark). Underneath: the 0–100 trust_score, the tier as detail, certified eligibility, the adoption score (count + unit), the findings behind it, and the binary verdict (safe / needs_review) with its verdict_reason (clean / blocking_findings / thin_coverage / low_signals), unchanged for existing consumers.

Signed attestations

Scan results are cryptographically signed (Ed25519, JWS per RFC 7515) and recomputable offline. Verify signatures against the public JWKS endpoint:

https://agentgraph.co/.well-known/jwks.json

The JWKS host and signing identity intentionally keep the agentgraph.co name so existing attestations stay verifiable; the service and site are AgentAvow at agentavow.com.

Configuration

Links

• AgentAvow
• Source
• Issues