AgentAvow Trust

Measured conclusion: Deep-tested. L2 outcome: tools_ok.

Signed, offline-verifiable safety scores for the MCP servers, packages & tools an agent connects to

Measured statistics

Add to your agent

Copy this into your MCP client config:

{
  "mcpServers": {
    "AgentAvow Trust": {
      "url": "https://agentavow.com/mcp",
      "transport": "streamable-http"
    }
  }
}

Measured tools (8)

• scan_repo read-only

  Scan a public GitHub repository with AgentAvow and return whether it is safe for an agent to connect to: one of three answers with its reason (Safe to connect, Review before you connect, or Do not connect), a 0-100 trust score, an adoption score from real usage (stars), the findings behind it (with where and how to fix), and a signed, offline-verifiable attestation. Read-only, no account. Calls the AgentAvow public API at agentavow.com.

  Parameters:

  • repo (required) — string — Repo as 'owner/name' (e.g. 'vercel/next.js'), or just the name when 'owner' is given separately.
  • force — boolean — Re-scan now instead of returning the cached verdict (results cache ~1h). Use after the target has changed.
  • owner — string — Repo owner (optional if 'repo' is already 'owner/name').

  Hints: read-only yes · destructive no · idempotent yes · open-world yes

• scan_package read-only

  Scan a published package (npm, PyPI, crates, Docker, or Hugging Face) with AgentAvow. Returns one of three answers with its reason (Safe to connect, Review before you connect, or Do not connect), a 0-100 trust score, an adoption score from real usage (downloads per week), findings with remediation, and a signed attestation. Also reports published advisories that affect the scanned version, the maintainer's deprecation notice, repo-vs-artifact drift (files shipped that aren't in the source), and AgentAvow's behavioral sandbox results when available. Scans the latest version unless `version` (or a pin in the name) names one. Read-only; calls agentavow.com.

  Parameters:

  • name (required) — string — Package name, e.g. 'chalk' (or 'org/model' for hf).
  • force — boolean — Re-scan now instead of returning the cached verdict (results cache ~1h). Use after a new version ships.
  • surface — string — Alias for registry.
  • version — string — Exact version to scan, e.g. '5.3.0'. Optional: the latest version by default. A pin in the name ('[email protected]', 'requests==2.32.5') works too.
  • registry — string — Package registry: npm, pypi, crates, docker, or hf.
  • ecosystem — string — Alias for registry.

  Hints: read-only yes · destructive no · idempotent yes · open-world yes

• scan_mcp_server read-only

  Scan a live MCP server's tool definitions for tool-poisoning, prompt-injection, invisible-unicode, and manifest-execution risks before your agent connects to it. Returns one of three answers with its reason (Safe to connect, Review before you connect, or Do not connect), a 0-100 trust score, findings, and a signed attestation. Read-only; calls the agentavow.com public API.

  Parameters:

  • endpoint_url (required) — string — The MCP server's https:// URL.
  • force — boolean — Re-scan now instead of returning the cached verdict (results cache ~1h).

  Hints: read-only yes · destructive no · idempotent yes · open-world yes

• verify_trust read-only

  Verify an AgentAvow entity's trust score. Returns trust_score (0-1), trust_score_pct (0-100), trust_tier, and whether it meets a minimum threshold. Read-only, no auth. Use before interacting with an unknown agent.

  Parameters:

  • entity_id (required) — string — UUID of a registered AgentAvow entity (resolve one with lookup_identity; unknown ids return guidance, not an error).
  • min_trust — number — Min score, 0-1.

  Hints: read-only yes · destructive no · idempotent yes · open-world yes

• check_interaction_safety read-only

  Check whether it is safe to interact with another agent by trust threshold. Thresholds: delegate 0.6, trade 0.5, collaborate 0.4, follow 0.1. Returns is_safe, risk_level, the score, and a recommendation. Read-only, no auth.

  Parameters:

  • target_entity_id (required) — string — UUID of a registered target entity (resolve one with lookup_identity).
  • interaction_type (required) — string

  Hints: read-only yes · destructive no · idempotent yes · open-world yes

• lookup_identity read-only

  Look up an AgentAvow entity by W3C DID or display name. Returns the entity's id, name, type, trust score and tier. Read-only, no auth. Use to resolve an identity before checking its trust.

  Parameters:

  • query (required) — string — A did:web:... or a display name.

  Hints: read-only yes · destructive no · idempotent yes · open-world yes

• get_trust_badge read-only

  Get an embeddable AgentAvow trust badge (SVG) for an entity, with ready-to-paste Markdown and HTML. The badge auto-updates as the score changes. Read-only, no auth.

  Parameters:

  • entity_id (required) — string — UUID of a registered AgentAvow entity (resolve one with lookup_identity).

  Hints: read-only yes · destructive no · idempotent yes · open-world yes

• about_agentavow read-only

  What AgentAvow is, which tool to use for what, how to read a verdict, and example scans. Call this for an overview or when getting started. No input, read-only.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

Measured by MCPYP probing. Untested fields are omitted, never estimated. Listing is always free; MCPYP never proxies calls or stores user tokens.