OpenTrustBench

The trust and evidence layer for AI agents and MCP servers. Scan any agent, skill, or MCP tool server and get a graded Trust Card (A–F) — backed by static analysis, OWASP-mapped findings, and a machine-readable evidence trail.

pip install opentrustbench
opentrustbench scan ./my-agent

Trust Grade: F (33/100) | Findings: 5 (3 critical, 1 high) | Scope: excessive
  [CRITICAL] Direct Prompt Concatenation (Injection Vulnerability) (server.ts:24) AT-SEC-001 LLM01
  [CRITICAL] Hardcoded Credential or API Secret (server.ts:11) AT-SEC-002 LLM02
  [CRITICAL] Unbounded Dynamic Shell Execution (server.ts:16) AT-SEC-003 ASI02
  [HIGH] Unrestricted Recursive File Deletion / Modification (server.ts:31) AT-SEC-005 ASI02
  [MEDIUM] Raw Secret Leakage in Debug Logging (server.ts:25) AT-SEC-007 LLM02

Why OpenTrustBench

AI agents run code, touch files, call APIs, and spend money. Before you install an MCP server or deploy an agent, you deserve to know what it can do and where it's fragile. OpenTrustBench answers that in seconds, with zero configuration:

• 8 detection rules (AT-SEC-001–007 + AT-COMP-001), each mapped to the OWASP LLM Top 10 2025 and the OWASP Agentic Top 10 — prompt injection, hardcoded secrets, shell escape, excessive agency, destructive operations, secret leakage, and more.
• Trust Cards graded A–F — a single score plus a full breakdown (security, permissions, provenance, reliability, stability) in trust-card.json.
• Permission manifests — network, filesystem, shell, secrets, and capability scope (minimal → excessive) extracted automatically.
• Adversarial attack analysis — OWASP-aligned heuristic checks (injection override, command execution, exfiltration, memory poisoning, destructive ops) with concrete fixes.
• SARIF + Markdown reports — drop straight into GitHub code scanning or publish as docs.
• Shareable grade badges — embed a live badge in any README (see the public registry).
• Honest by design — static analysis only. No code is executed, no payloads fire, no invented narratives. Reports say exactly what was found and where.

Installation

pip install opentrustbench

Prerequisites: Node.js 18+ and the OpenTrustBench CLI engine:

npm install -g @opentrustbench/cli

This package installs the opentrustbench command and connects it to the scan engine.

Quickstart

# Scan a local agent, skill, or MCP server (writes trust-card.json + reports)
opentrustbench scan ./my-agent

# Scan a GitHub repo or npm package directly
opentrustbench scan owner/repo --github
opentrustbench scan express --npm

# Adversarial attack analysis (static-heuristic: nothing executes)
opentrustbench attack ./my-agent

# Validate a workflow suite (simulation mode: steps are parsed, never run)
opentrustbench eval ./workflow.yaml

# Generate an embeddable README badge
opentrustbench badge ./my-agent

# Browse the public verified registry
opentrustbench registry

Gate CI on severity — fail the build when findings meet your bar:

opentrustbench scan . --fail-on high --quiet --format sarif --output-dir ./trust

# .github/workflows/trust.yml
- run: pip install opentrustbench && npm install -g @opentrustbench/cli
- run: opentrustbench scan . --fail-on high --format sarif --output-dir ./trust
- uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: trust/opentrustbench-report.sarif

Command reference

scan flags: --github, --npm, --fail-on info|low|medium|high|critical, --format terminal|json|sarif|md, --output-dir <dir>, --quiet, --no-color.

A Trust Card looks like this

{
  "schema": "opentrustbench/trust-card/v1",
  "subject": { "type": "agent-skill", "name": "Secure Data Auditor Skill" },
  "trustScore": {
    "overall": 88,
    "grade": "B",
    "breakdown": { "security": 100, "permissions": 100, "provenance": 50 }
  },
  "compatibility": ["claude-code", "cursor", "codex"]
}

Links

• Site & registry: opentrustbench.com · methodology
• Source: github.com/eulogik/OpenTrustBench
• Issues: github.com/eulogik/OpenTrustBench/issues
• npm engine: @opentrustbench/cli · @opentrustbench/core

License

Apache-2.0 — see LICENSE.