Ten demos, about thirteen minutes end to end. Four cover custody of model weights. Five govern what an agent does at the tool boundary. One governs model calls through an OpenAI-compatible endpoint.
Software mode · CMCP_DEV_MODE=1 · no special hardware
@@ -57,18 +57,20 @@
Don't take the spec on trust. Run it.
Quick start
-
Clone it and run all ten
-
No confidential-computing hardware, no cloud account, no signup. Everything runs in software mode.
+
Start with one demo
+
Use Python 3.11+, Git, and Bash on macOS, Linux, or Windows with WSL for the commands below. No cloud account is needed. These demos use software attestation and do not demonstrate hardware isolation.
Terminal
git clone https://github.com/agentrust-io/demos && cd demos
-pip install -r requirements.txt
-python demo.py # all ten, pausing before each
-python demo.py --no-pause # straight through, no prompts
-python demo.py 6 # just demo 6
The requirements install cMCP for demos 1 to 5, Weight Custody Manifest for demos 6 to 9, and the OpenAI client for demo 10. demo.py sets dev mode and the bearer token for you, so there is nothing to export. Source: github.com/agentrust-io/demos.
+
What to look for: demo 1 routes calls through the local gateway and closes the session into a signed record. Software mode does not pass hardware-attestation verification. To explore weight custody, run python demo.py 6; to run the full set without pauses, use python demo.py --no-pause.
+
Individual commands below: run them from the demos folder with the environment activated. For demos that start cMCP, set export CMCP_BEARER_TOKEN=demo-token first. The demo.py launcher handles this setup for you.
What demo 6 actually prints, verbatim from a run on weight-custody-manifest 0.25.0
python demo-06-weight-custody/run.py
diff --git a/design-system.css b/design-system.css
index d1e8d9b..82cefa0 100644
--- a/design-system.css
+++ b/design-system.css
@@ -1949,3 +1949,44 @@ html:has(body.agentrust-hub) { scroll-behavior: smooth; }
.marketplace-page [hidden] { display:none!important; }.sr-only { position:absolute;width:1px;height:1px;padding:0;margin:-1px;overflow:hidden;clip:rect(0,0,0,0);white-space:nowrap;border:0; }
@media(max-width:860px){.marketplace-callout,.market-section-heading{align-items:flex-start;flex-direction:column}.market-hero-grid,.market-layout,.submit-grid{grid-template-columns:1fr}.market-signal{max-width:440px}.featured-strip,.market-grid{grid-template-columns:1fr}.market-filters{position:static;display:grid;grid-template-columns:1fr 1fr;gap:1rem}.neutrality-note{grid-column:1/-1;margin-top:0}.market-search-row{grid-template-columns:1fr}.market-sort{padding-left:0}.market-card{min-height:315px}}
@media(max-width:560px){.market-hero h1 br{display:none}.market-filters{grid-template-columns:1fr}.neutrality-note{grid-column:auto}.market-search kbd{display:none}}
+/* Reader entry points and architecture share the site's existing palette. */
+.skip-link { position: fixed; top: -5rem; left: 1rem; z-index: 20000; padding: .75rem 1rem; background: var(--at-ink); color: var(--at-paper); }
+.skip-link:focus { top: .5rem; }
+.agentrust-hub .hero { padding-block: clamp(2rem, 4vw, 3.5rem); }
+.agentrust-hub .hero h1 { font-size: clamp(2.6rem, 5.5vw, 4.8rem); line-height: 1.03; max-width: 1000px; margin-block: 1rem; }
+.agentrust-hub .hero > .hero-inner > p:not(.hero-eyebrow) { max-width: 760px; font-family: var(--at-sans); font-size: clamp(1rem, 1.6vw, 1.2rem); line-height: 1.6; }
+.agentrust-hub .hero > .hero-inner > p.hero-scope { font-size: .85rem; margin-top: 1rem; }
+.agentrust-hub .hero .hero-eyebrow { max-width: none; font-size: .78rem; }
+.agentrust-hub .reader-start { padding-block: 2rem 3rem; }
+.agentrust-hub .reader-start h2 { font-size: 2rem; margin-bottom: 1.5rem; }
+.agentrust-hub .ecosystem-card a { display: inline-block; margin-top: 1rem; color: var(--at-ink); font-weight: 650; text-underline-offset: .2em; }
+.architecture { margin: 2rem 0; color: var(--at-ink); }
+.architecture-input { display: flex; align-items: center; gap: 1.5rem; padding: 1.25rem; border: 1px solid var(--at-line); background: var(--at-paper-2); }
+.architecture-input > a { flex-shrink: 0; }
+.architecture a { color: var(--at-ink); text-underline-offset: .2em; }
+.architecture-row { display: grid; grid-template-columns: 1fr auto 1.3fr auto 1fr; gap: .8rem; align-items: stretch; margin-block: 1.25rem; }
+.architecture-node { display: flex; flex-direction: column; justify-content: center; gap: .65rem; padding: 1.25rem; border: 1px solid var(--at-line); background: var(--at-white); min-width: 0; }
+.architecture-boundary { border: 2px dashed var(--at-navy); }
+.architecture-edge { align-self: center; font-size: .8rem; font-weight: 650; white-space: nowrap; }
+.architecture-outcomes { display: grid; grid-template-columns: repeat(3, 1fr); border: 1px solid var(--at-line); background: var(--at-white); }
+.architecture-outcomes > div { padding: 1.25rem; }
+.architecture-outcomes > div + div { border-left: 1px solid var(--at-line); }
+.architecture span, .architecture p, .architecture small, .architecture figcaption { font-size: .9rem; line-height: 1.6; }
+.architecture p { margin-bottom: 0; }
+.architecture figcaption { margin-top: 1rem; color: var(--at-muted); }
+.tutorial-toc { display: flex; flex-wrap: wrap; gap: .75rem 1.25rem; margin: 1.5rem 0; }
+.tutorial-toc a { color: var(--at-ink); padding-block: .4rem; }
+.troubleshooting dt { font-weight: 700; margin-top: 1.25rem; }
+.troubleshooting dd { margin: .5rem 0 0; }
+.at-page .step-body, .at-page .split > *, .at-page .code { min-width: 0; }
+.at-page .code-label { overflow-wrap: anywhere; }
+.at-page .copy { flex-shrink: 0; }
+@media (max-width: 700px) {
+ .architecture-input { flex-direction: column; align-items: start; gap: .5rem; }
+ .architecture-row, .architecture-outcomes { grid-template-columns: 1fr; }
+ .architecture-edge { justify-self: center; margin-block: .25rem; }
+ .architecture-edge .direction { display: inline-block; transform: rotate(90deg); }
+ .architecture-outcomes > div + div { border-left: 0; border-top: 1px solid var(--at-line); }
+ .agentrust-hub .hero-actions { gap: .75rem; }
+ .agentrust-hub .hero-actions .btn { text-align: center; white-space: normal; }
+}
diff --git a/index.html b/index.html
index 01af719..4ab6fff 100644
--- a/index.html
+++ b/index.html
@@ -4,7 +4,7 @@
AgenTrust: An Open Ecosystem for Verifiable AI Agents
-
+
@@ -18,7 +18,7 @@
-
+
@@ -29,7 +29,7 @@
-
+
@@ -56,7 +56,9 @@
"@id": "https://agentrust-io.com/#website",
"name": "AgenTrust",
"url": "https://agentrust-io.com/",
- "publisher": { "@id": "https://agentrust-io.com/#organization" }
+ "publisher": {
+ "@id": "https://agentrust-io.com/#organization"
+ }
}
]
}
@@ -76,7 +78,7 @@
"@type": "TechArticle",
"name": "TRACE",
"url": "https://trace.agentrust-io.com/",
- "description": "Trust, Runtime Attestation, and Compliance Evidence. Hardware-rooted cryptographic receipts for every agent action, signed by the TEE and verifiable by anyone."
+ "description": "TRACE defines portable, signed runtime evidence. Hardware provenance requires attestation verification against a trusted root; software-mode records do not provide that guarantee."
}
},
{
@@ -96,7 +98,7 @@
"@type": "TechArticle",
"name": "Confidential MCP (cMCP)",
"url": "https://cmcp.agentrust-io.com/",
- "description": "An extension to the Model Context Protocol that runs tool calls inside a Trusted Execution Environment so the host process cannot observe inputs, outputs, or intermediate state."
+ "description": "Confidential MCP (cMCP) evaluates routed MCP tool calls against policy and records the decisions. In a hardware deployment, the runtime is inside a Trusted Execution Environment (TEE); the agent and upstream tool server remain separate. Host confidentiality also depends on the egress policy. Software mode provides no hardware isolation."
}
},
{
@@ -132,7 +134,7 @@
"name": "What is TRACE?",
"acceptedAnswer": {
"@type": "Answer",
- "text": "TRACE stands for Trust, Runtime Attestation, and Compliance Evidence. It defines hardware-rooted cryptographic receipts for every agent action, signed by the Trusted Execution Environment and verifiable by anyone."
+ "text": "TRACE defines portable, signed runtime evidence. Hardware provenance requires attestation verification against a trusted root; software-mode records do not provide that guarantee."
}
},
{
@@ -148,7 +150,7 @@
"name": "What is Confidential MCP (cMCP)?",
"acceptedAnswer": {
"@type": "Answer",
- "text": "Confidential MCP is an extension to the Model Context Protocol that runs tool calls inside a Trusted Execution Environment, so the host process cannot read tool-call plaintext from enclave memory. That protection is structural only where the Cedar egress policy denies telemetry and APM endpoints, and it covers the tool-call boundary rather than model inference or the agent's context window."
+ "text": "Confidential MCP (cMCP) evaluates routed MCP tool calls against policy and records the decisions. In a hardware deployment, the runtime is inside a Trusted Execution Environment (TEE); the agent and upstream tool server remain separate. Host confidentiality also depends on the egress policy. Software mode provides no hardware isolation."
}
},
{
@@ -164,7 +166,7 @@
"name": "How do the AgenTrust standards relate to each other?",
"acceptedAnswer": {
"@type": "Answer",
- "text": "Agent Manifest establishes who an agent is and what it is allowed to do, cMCP executes tool calls confidentially inside a Trusted Execution Environment, cA2A carries that trust across agent-to-agent delegation on A2A, and TRACE produces hardware-signed receipts that prove what actually happened. Together they cover identity, intent, delegation, and behavior."
+ "text": "Agent Manifest declares identity and intended authority. cMCP governs tool calls; cA2A governs delegation to another agent. TRACE carries signed runtime evidence for verification against a trust policy. Hardware provenance depends on verified attestation. Use the components required by your trust boundary."
}
},
{
@@ -180,7 +182,7 @@
"name": "What is the secure version of MCP?",
"acceptedAnswer": {
"@type": "Answer",
- "text": "Confidential MCP (cMCP) is the security-hardened way to run the Model Context Protocol. It executes MCP tool calls inside a Trusted Execution Environment (TEE), so tool-call plaintext is not readable from the host, and it emits a signed TRACE receipt for every call that anyone can verify. Two bounds worth stating: the plaintext guarantee holds where the egress policy denies telemetry and APM endpoints, and the receipt is hardware-attested when the gateway runs in a TEE and signed-only in software mode. If you need a secure or confidential MCP deployment, cMCP is the AgenTrust profile for it."
+ "text": "Confidential MCP (cMCP) evaluates routed MCP tool calls against policy and records the decisions. In a hardware deployment, the runtime is inside a Trusted Execution Environment (TEE); the agent and upstream tool server remain separate. Host confidentiality also depends on the egress policy. Software mode provides no hardware isolation."
}
},
{
@@ -194,19 +196,20 @@
]
}
-
+
+Skip to content