TrustWeave

Deterministic security evidence for declared AI-agent trust boundaries.
Review the configuration before deployment—locally, without running the agent.

Quick start · CLI reference · Product contract · Reviewer workflow · Security

The decision TrustWeave helps you make

A configuration change can create a new sensitive path before any application code changes. TrustWeave turns a declared agent manifest, deterministic policy, and optional local review inputs into stable JSON and Markdown evidence a reviewer can inspect, compare, retain, or export.

Evidence, not enforcement. TrustWeave establishes evidence about the declarations and local artifacts it reads. It does not establish runtime behavior, live MCP-server behavior, authorization correctness, incident conclusions, or that an agent is secure.

Quick start

TrustWeave supports Python 3.11+. Install the published package to inspect the CLI:

python -m pip install --upgrade trustweave
trustweave --help

For a complete, safe first review, clone the repository and run the synthetic example. The workflow reads only checked-in local files; it does not interact with an agent, server, or external system.

git clone https://github.com/MohammadThabetHassan/trustweave.git
cd trustweave
python -m pip install -e .

rm -rf artifacts
trustweave scan \
  --manifest examples/support-agent.manifest.json \
  --policy policies/default-policy.json \
  --output-dir artifacts

trustweave test \
  --policy policies/default-policy.json \
  --scenarios scenarios/default-scenarios.json \
  --output-dir artifacts

trustweave attest --source-revision local --output-dir artifacts
trustweave report --output-dir artifacts
trustweave verify --attestation artifacts/attestation.json

The resulting local evidence is deliberately simple to review:

python -m pip install "trustweave[yaml]"

Review workflows

TrustWeave stays small by keeping every workflow local and deterministic. Start with the question you need to answer, then follow the linked contract for exact inputs, outputs, exit codes, and limitations.

For the full command surface—including framework imports, MCP inventory normalization, SARIF conversion, and unsigned local statements—read the CLI reference.

What TrustWeave will never do

TrustWeave is intentionally non-executing. It does not execute an agent, invoke a tool, connect to an MCP server, call a model, access credentials, send network traffic, scan targets, upload findings, or make a deployment decision. This boundary is a core product property, not a mode to disable.

The project also avoids unsupported security claims. A review finding is a deterministic signal about supplied local evidence; it is not proof of an exploit, a production control, or a conclusion about a deployed system.

Documentation that answers the next question

Built to be inspected

0.1.1 remains the currently published PyPI release. The corrected source target is 0.2.1, which remains subject to owner-approved production publication, tagging, and a GitHub Release. Annotated v0.2.0 is an immutable unpublished audit tag at 7232fe3a23d92f50a693903c0a6b7cb92d0a1426; it was never published to PyPI and has no GitHub Release. The 0.2.1 release path includes formatting, linting, strict type checks, static source-security scanning, a 95% branch-coverage gate, isolated wheel installation, fixed-epoch wheel reproducibility, dependency auditing, CycloneDX SBOM generation, deterministic repository-reality checks, and cross-platform Python 3.11/3.13 compatibility jobs.

Current inputs retain their documented v1alpha1/v1alpha2 contracts. Generated bundles use trustweave.dev/bundle/v1alpha2; risk decisions use canonical trustweave/fingerprint/v3 identities and generated reviews use trustweave.dev/risk-review/v1alpha2. Historical v1alpha1 bundle and review resources remain available for bounded compatibility rather than being silently redefined. Read the compatibility policy before depending on a schema or review identifier outside the documented contract.

The enforced local suite retains a 95% branch coverage gate. The documented twelve-module mutation diagnostic killed 6,044 of 6,140 mutants (98.44%) and preserves an exact 96-survivor inventory with zero untriaged and zero needs_regression records. The hosted mutation workflow enforces exact survivor-identifier and normalized-diff parity on the reviewed commit SHA; no merge or release action is implied by this evidence.

Contribute, get help, or report a concern

Contributions are welcome when they improve a reviewer’s understanding of declared or pre-recorded local evidence without crossing the non-executing boundary. Start with CONTRIBUTING.md for the local quality suite and contribution checklist.

For installation and workflow questions, begin with SUPPORT.md. For reproducible bugs and bounded proposals, use the repository issue forms. Do not report suspected vulnerabilities in a public issue. Follow SECURITY.md for private reporting and safe-reporting limits. Community expectations are in CODE_OF_CONDUCT.md, while release and maintenance decisions are described in GOVERNANCE.md.

License

TrustWeave is distributed under the Apache License 2.0.