AgentTrust — Pre-invocation Trust Check for AI Agent Endpoints
Pre-invocation trust check for AI agent endpoints
Given an exact AI agent endpoint URL, AgentTrust returns existing reliability evidence, endpoint ownership verification, and a machine-readable trustDecision without contacting the target endpoint during the check.
Example:
check_agent_trust({ "endpointUrl": "https://example.com/agent" })
No AgentTrust API key required · Read-only · MCP
AgentTrust is trust infrastructure for AI agents. It provides
reliability monitoring, endpoint verification, and pre-invocation trust
checks for MCP and A2A agents. An agent registers an identity, gets
continuously health-monitored, optionally proves ownership of its
endpoint, and accumulates a deterministic reliability score from that
observed history. Any external AI agent or system can look up another
agent by its invocation URL and get back a machine-readable
trustDecision — a signal derived from AgentTrust's own observed and
verified data, for the caller to weigh, never a certification or
guarantee of safety — before deciding whether to interact with it.
Official MCP Registry identity: io.github.agenttrust-ai/agenttrust.
Using the API
If you're building an AI agent or system that wants to look up another agent's trust information, you don't need this repository at all — see:
- /docs — full REST and MCP reference, with real request/response examples.
- /llms.txt — the same reference as a single plain-text file, meant for pasting into an LLM's context or fetching programmatically.
Anonymous pre-invocation trust check (MCP)
The fastest way to evaluate an agent before invoking it needs no
AgentTrust account or API key at all — call the check_agent_trust MCP
tool at https://getagenttrust.com/api/mcp/public (no key; also available
at /api/mcp):
check_agent_trust({ "endpointUrl": "https://the-agent-you-are-about-to-call.example.com/invoke" })
- Read-only.
- No AgentTrust account or API key required.
- Checks only AgentTrust's already-stored observations — it does not invoke or otherwise contact the target endpoint during the lookup.
- Returns a machine-readable
trustDecision(recommended,confidence,reasons) for the caller to evaluate.
Try it with a known endpoint
To see the lookup flow work end-to-end without registering anything
yourself, call check_agent_trust against an endpoint AgentTrust
already observes:
check_agent_trust({ "endpointUrl": "https://allagents.app/a2a" })
This endpoint is already tracked by AgentTrust, so the call exercises
the real lookup path against real observed data. Its health status,
reliability score, verification state, and trustDecision can change
over time — the point here is to confirm the flow works, not to check
that endpoint's current standing.
Authenticated REST/MCP operations
Registering an agent, or reading the fuller per-agent record (agent
card, capabilities, health history), requires a human-created API key:
sign up, create a key in the dashboard, then
GET /api/v1/agents?endpoint_url=<the URL you're about to call> with
Authorization: Bearer <API_KEY> — the response includes the same
trustDecision. The authenticated MCP tools (list_agents,
get_agent, get_agent_health, send_heartbeat) mirror the REST API
exactly.
Developing this project
This is a Next.js (App Router) + Drizzle + Supabase app, deployed on Vercel.
npm install
npm run dev
Open http://localhost:3000. You'll need a
.env.local — see .env.example for the required variables (Supabase
credentials, database connection strings, and the server-only secrets
described inline).
Useful scripts:
npm run test # vitest — full suite runs against an embedded pglite DB, no live database needed
npm run typecheck # tsc --noEmit
npm run lint # eslint
npm run db:generate # generate a new Drizzle migration from schema changes (offline)
npm run db:migrate # apply pending migrations to the database in DIRECT_URL