ecz-id-agents 0.1.0

Inspects AI agent projects for ECZ-ID configuration and public evidence posture.

ECZ-ID AI Agent Inspection

ecz-id-agents statically inspects AI agent manifests for ECZ-ID configuration posture and declared relationships (tools, APIs, MCP servers, operator/principal). Part of the ECZ-ID PyPI family. It inspects, explains and routes only.

It never imports or executes agent code, never loads or runs agent tools, and never reads prompts into results — only their presence is noted, and redaction guards every export. It never issues or activates an ECZ-ID, never prices or carts, and never certifies. It is not a safety/compliance/insurance/premium decision and not a behavioural, alignment, capability or safety proof about the agent. Missing public proof is neutral. Local policy decides. Re-check before reliance.

One-command first run

$ ecz-id-agents inspect ./my-agent
ECZ-ID inspection: ./my-agent [ecz-id-agents]
A. configuration posture : PRESENT
B. public proof posture  : NOT_CHECKED  (neutral)
...
local policy decides; re-check before reliance

Supported inputs

• A directory or manifest file. Recognised names: agent_manifest.json, agent.json, agents.json (static JSON only).
• Observes declared agent name, model provider, tool / API / MCP / package / repository relationships and the declared operator / principal.

Runtime object inspection (adapter boundary)

For OpenAI Agents, Pydantic AI, LangGraph and CrewAI, you may pass an already-constructed object and get neutral observations back — attributes are read, never called, the framework is identified without importing it, tools are not executed, and prompts are never inlined:

from ecz_id_agents import inspect_agent_object

report = inspect_agent_object(my_agent)   # {"observations": [...], "note": "..."}

Privacy boundaries

Static JSON inspection; never imports or executes agent code. Bounded, symlink-refusing enumeration. No telemetry, no uploads. Prompts are never inlined; secrets redacted on every export. Offline mode (--offline / ECZ_ID_OFFLINE=1) skips all network.

Explicit non-claims

Not a safety / certification / compliance / insurance / premium decision. Not a behavioural, alignment, capability or safety proof. Does not issue, activate or bind an ECZ-ID. Does not upload prompts. Does not price or cart.

Python API

from ecz_id_agents import inspect

result = inspect("./my-agent")
print(result.configuration_evidence.posture.value)   # PRESENT / PARTIAL / ABSENT / INVALID

CI / test example

$ ecz-id-agents inspect . --json > ecz-id-agents.json   # exit 0 for any completed inspection
$ ecz-id-agents doctor --json

Routes

• Resolver: https://resolver.ecocitizenz.org
• TrustOps: https://trustops.ecocitizenz.com/start
• Developer Gateway: https://developers.ecocitizenz.com
• Central Machine Interface: https://machine.ecocitizenz.org/.well-known/ecz-machine.json

Agent Credential and Know-Your-Agent guidance is arranged via TrustOps — this package only routes you there.

Re-check

$ ecz-id-agents recheck ./my-agent --json

Machine Interface & Quiet manifest

Machine Interface · Manifest · Resolve · Operator Setup · Developer Guidance

Every install ships a public-safe ecz_quiet_machine_interface.json, and every JSON report embeds a compact machine_interface object with the canonical roots and safe actions (it exposes the interface and protects the playbook).

$ ecz-id-agents manifest --json
$ ecz-id-agents compare ./old ./new --json    # neutral drift
$ ecz-id-agents inspect . --sarif             # SARIF for code scanning
$ uvx ecz-id-agents inspect .                 # or: pipx run ecz-id-agents inspect .

• Central Machine Interface: https://machine.ecocitizenz.org/.well-known/ecz-machine.json
• Resolver (read-only public proof): https://resolver.ecocitizenz.org
• Operator setup (TrustOps): https://trustops.ecocitizenz.com/start
• Developer Gateway: https://developers.ecocitizenz.com

Licence and trademarks

Apache-2.0 (see LICENSE, NOTICE). The code licence grants no trademark rights; “ECZ-ID” and “EcoCitizenz” are trademarks of their owner(s) — see TRADEMARKS.md. Changelog: CHANGELOG.md. Security: SECURITY.md.

CLI: ecz-id-agents  |  Import: ecz_id_agents  |  Plugin group: ecz_id.plugins