From 4cf2fcadf778d8e973aeff5d256b1deae96ef279 Mon Sep 17 00:00:00 2001 From: Imran Siddique Date: Sat, 5 Sep 2026 14:03:50 -0700 Subject: [PATCH 1/2] Improve visitor paths, architecture boundaries, and runnable tutorials --- .github/workflows/reader-journey.yml | 29 +++++ demos/index.html | 18 +-- design-system.css | 40 +++++++ index.html | 159 +++++++++++++++------------ quickstart/index.html | 40 +++++-- registry/index.html | 8 +- telemetry/index.html | 25 +++-- tools/check-quickstart.py | 47 ++++++++ tools/check-site.py | 65 +++++++++++ 9 files changed, 328 insertions(+), 103 deletions(-) create mode 100644 .github/workflows/reader-journey.yml create mode 100644 tools/check-quickstart.py create mode 100644 tools/check-site.py diff --git a/.github/workflows/reader-journey.yml b/.github/workflows/reader-journey.yml new file mode 100644 index 0000000..12ea760 --- /dev/null +++ b/.github/workflows/reader-journey.yml @@ -0,0 +1,29 @@ +name: Reader journey +on: + pull_request: + push: + branches: [main] +permissions: + contents: read +jobs: + links: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + with: + persist-credentials: false + - uses: actions/setup-python@v5 + with: + python-version: '3.12' + - run: python tools/check-site.py + quickstart: + runs-on: ubuntu-latest + timeout-minutes: 8 + steps: + - uses: actions/checkout@v4 + with: + persist-credentials: false + - uses: actions/setup-python@v5 + with: + python-version: '3.12' + - run: python tools/check-quickstart.py diff --git a/demos/index.html b/demos/index.html index 570b858..3165beb 100644 --- a/demos/index.html +++ b/demos/index.html @@ -32,7 +32,7 @@ - + @@ -48,7 +48,7 @@
Runnable demos -

Don't take the spec
on trust. Run it.

+

Run a policy check.
Inspect the result.

Ten demos, about thirteen minutes end to end. Four cover custody of model weights. Five govern what an agent does at the tool boundary. One governs model calls through an OpenAI-compatible endpoint.

Software mode · CMCP_DEV_MODE=1 · no special hardware
@@ -57,18 +57,20 @@

Don't take the spec
on trust. Run it.

Quick start -

Clone it and run all ten

-

No confidential-computing hardware, no cloud account, no signup. Everything runs in software mode.

+

Start with one demo

+

Use Python 3.11+, Git, and Bash on macOS, Linux, or Windows with WSL for the commands below. No cloud account is needed. These demos use software attestation and do not demonstrate hardware isolation.

Terminal
git clone https://github.com/agentrust-io/demos && cd demos
-pip install -r requirements.txt
-python demo.py            # all ten, pausing before each
-python demo.py --no-pause # straight through, no prompts
-python demo.py 6          # just demo 6
+python3 -m venv .venv +source .venv/bin/activate +python -m pip install -r requirements.txt +python demo.py 1 # start with tool-call policy enforcement

The requirements install cMCP for demos 1 to 5, Weight Custody Manifest for demos 6 to 9, and the OpenAI client for demo 10. demo.py sets dev mode and the bearer token for you, so there is nothing to export. Source: github.com/agentrust-io/demos.

+

What to look for: demo 1 routes calls through the local gateway and closes the session into a signed record. Software mode does not pass hardware-attestation verification. To explore weight custody, run python demo.py 6; to run the full set without pauses, use python demo.py --no-pause.

+

Individual commands below: run them from the demos folder with the environment activated. For demos that start cMCP, set export CMCP_BEARER_TOKEN=demo-token first. The demo.py launcher handles this setup for you.

What demo 6 actually prints, verbatim from a run on weight-custody-manifest 0.25.0

python demo-06-weight-custody/run.py
diff --git a/design-system.css b/design-system.css index d1e8d9b..a4e82bc 100644 --- a/design-system.css +++ b/design-system.css @@ -1949,3 +1949,43 @@ html:has(body.agentrust-hub) { scroll-behavior: smooth; } .marketplace-page [hidden] { display:none!important; }.sr-only { position:absolute;width:1px;height:1px;padding:0;margin:-1px;overflow:hidden;clip:rect(0,0,0,0);white-space:nowrap;border:0; } @media(max-width:860px){.marketplace-callout,.market-section-heading{align-items:flex-start;flex-direction:column}.market-hero-grid,.market-layout,.submit-grid{grid-template-columns:1fr}.market-signal{max-width:440px}.featured-strip,.market-grid{grid-template-columns:1fr}.market-filters{position:static;display:grid;grid-template-columns:1fr 1fr;gap:1rem}.neutrality-note{grid-column:1/-1;margin-top:0}.market-search-row{grid-template-columns:1fr}.market-sort{padding-left:0}.market-card{min-height:315px}} @media(max-width:560px){.market-hero h1 br{display:none}.market-filters{grid-template-columns:1fr}.neutrality-note{grid-column:auto}.market-search kbd{display:none}} +/* Reader entry points and architecture share the site's existing palette. */ +.skip-link { position: fixed; top: -5rem; left: 1rem; z-index: 20000; padding: .75rem 1rem; background: var(--at-ink); color: var(--at-paper); } +.skip-link:focus { top: .5rem; } +.agentrust-hub .hero { padding-block: clamp(2rem, 4vw, 3.5rem); } +.agentrust-hub .hero h1 { font-size: clamp(2.6rem, 5.5vw, 4.8rem); line-height: 1.03; max-width: 1000px; margin-block: 1rem; } +.agentrust-hub .hero > .hero-inner > p:not(.hero-eyebrow) { max-width: 760px; font-family: var(--at-sans); font-size: clamp(1rem, 1.6vw, 1.2rem); line-height: 1.6; } +.agentrust-hub .hero > .hero-inner > p.hero-scope { font-size: .85rem; margin-top: 1rem; } +.agentrust-hub .hero .hero-eyebrow { max-width: none; font-size: .78rem; } +.agentrust-hub .reader-start { padding-block: 2rem 3rem; } +.agentrust-hub .reader-start h2 { font-size: 2rem; margin-bottom: 1.5rem; } +.agentrust-hub .ecosystem-card a { display: inline-block; margin-top: 1rem; color: var(--at-ink); font-weight: 650; text-underline-offset: .2em; } +.architecture { margin: 2rem 0; color: var(--at-ink); } +.architecture-input { display: flex; align-items: center; gap: 1.5rem; padding: 1.25rem; border: 1px solid var(--at-line); background: var(--at-paper-2); } +.architecture-input > a { flex-shrink: 0; } +.architecture a { color: var(--at-ink); text-underline-offset: .2em; } +.architecture-row { display: grid; grid-template-columns: 1fr auto 1.3fr auto 1fr; gap: .8rem; align-items: stretch; margin-block: 1.25rem; } +.architecture-node { display: flex; flex-direction: column; justify-content: center; gap: .65rem; padding: 1.25rem; border: 1px solid var(--at-line); background: var(--at-white); min-width: 0; } +.architecture-boundary { border: 2px dashed var(--at-navy); } +.architecture-edge { align-self: center; font-size: .8rem; font-weight: 650; white-space: nowrap; } +.architecture-outcomes { display: grid; grid-template-columns: repeat(3, 1fr); border: 1px solid var(--at-line); background: var(--at-white); } +.architecture-outcomes > div { padding: 1.25rem; } +.architecture-outcomes > div + div { border-left: 1px solid var(--at-line); } +.architecture span, .architecture p, .architecture small, .architecture figcaption { font-size: .9rem; line-height: 1.6; } +.architecture p { margin-bottom: 0; } +.architecture figcaption { margin-top: 1rem; color: var(--at-muted); } +.tutorial-toc { display: flex; flex-wrap: wrap; gap: .75rem 1.25rem; margin: 1.5rem 0; } +.tutorial-toc a { color: var(--at-ink); padding-block: .4rem; } +.troubleshooting dt { font-weight: 700; margin-top: 1.25rem; } +.troubleshooting dd { margin: .5rem 0 0; } +.at-page .step-body, .at-page .split > *, .at-page .code { min-width: 0; } +.at-page .code-label { overflow-wrap: anywhere; } +.at-page .copy { flex-shrink: 0; } +@media (max-width: 700px) { + .architecture-input { flex-direction: column; align-items: start; gap: .5rem; } + .architecture-row, .architecture-outcomes { grid-template-columns: 1fr; } + .architecture-edge { justify-self: center; margin-block: .25rem; } + .architecture-outcomes > div + div { border-left: 0; border-top: 1px solid var(--at-line); } + .agentrust-hub .hero-actions { gap: .75rem; } + .agentrust-hub .hero-actions .btn { text-align: center; white-space: normal; } +} diff --git a/index.html b/index.html index 01af719..04ca9e9 100644 --- a/index.html +++ b/index.html @@ -4,7 +4,7 @@ AgenTrust: An Open Ecosystem for Verifiable AI Agents - + @@ -18,7 +18,7 @@ - + @@ -29,7 +29,7 @@ - + @@ -76,7 +76,7 @@ "@type": "TechArticle", "name": "TRACE", "url": "https://trace.agentrust-io.com/", - "description": "Trust, Runtime Attestation, and Compliance Evidence. Hardware-rooted cryptographic receipts for every agent action, signed by the TEE and verifiable by anyone." + "description": "TRACE defines portable, signed runtime evidence. Hardware provenance requires attestation verification against a trusted root; software-mode records do not provide that guarantee." } }, { @@ -132,7 +132,7 @@ "name": "What is TRACE?", "acceptedAnswer": { "@type": "Answer", - "text": "TRACE stands for Trust, Runtime Attestation, and Compliance Evidence. It defines hardware-rooted cryptographic receipts for every agent action, signed by the Trusted Execution Environment and verifiable by anyone." + "text": "TRACE defines portable, signed runtime evidence. Hardware provenance requires attestation verification against a trusted root; software-mode records do not provide that guarantee." } }, { @@ -194,19 +194,20 @@ ] } - + +
- +
@@ -134,13 +134,17 @@

The quickstart

Copy each block. Every file is filled in for you, nothing to hand-author, nothing to hash. Follow along top to bottom.

-

Before you start. Python 3.11+ · pip · macOS or Linux · two terminal windows · about ten minutes · no special hardware.

-

Every command and every output on this page was last run end to end against cmcp-runtime 0.4.0 on 20 August 2026. If a step does not do what it says here, that is a bug and worth reporting.

+

Before you start. Python 3.11+ · pip · curl · macOS, Linux, or Windows with WSL and Bash · two terminal windows · about ten minutes.

+

The install is pinned to cmcp-runtime 0.4.0 so the commands match this walkthrough. Report unexpected results by opening an issue with the failing command and runtime version.

+

Expected finish: the tool request returns 403 POLICY_DENY. The verifier later reports FAIL (partially_verified) and exits 1 because this demo has no hardware attestation. That is the expected software-mode result.

+ + +
-
+
1

Install the runtime

@@ -149,12 +153,12 @@

Install the runtime

Terminal 1
mkdir -p cmcp-quickstart && cd cmcp-quickstart
 python3 -m venv venv && source venv/bin/activate
-pip install cmcp-runtime
+python3 -m pip install cmcp-runtime==0.4.0
-
+
2

Drop in the config and your policy

@@ -241,7 +245,7 @@

Drop in the config and your policy

-
+
3

Start the runtime

@@ -253,7 +257,7 @@

Start the runtime

-
+
4

Fire a bad action, watch it get blocked

@@ -281,7 +285,7 @@

Fire a bad action, watch it get blocked

✓ What just happened
-

Your policy stopped a PII record from leaving on a tool call, before it reached Salesforce, decided by the rule you wrote, enforced where the agent can't tamper with it. That's the barrier most teams can't cross today: shipping an agent you can actually prove is governed.

+

Your policy rejected a call to a tool tagged pii before forwarding. No Salesforce server runs in this demo, and no personal data is fetched. The decision uses the catalog tag; it does not inspect the request for personal data.

Keep an eye on that call_id. The same id lands in the audit chain, so the deny you just watched is the deny you can hand to someone else in step 5. A refusal nobody can check afterwards is just a log line.

@@ -314,7 +318,7 @@

Walk away with proof

hardware_attestationFAIL: software-only mode
ResultFAIL (partially_verified)
-

Every cryptographic check passes. The one FAIL is hardware attestation, which dev mode can't provide, and that is the honest answer: overall verification only reports verified when the claim is hardware-backed, so the CLI prints FAIL (partially_verified) and exits 1 here. Run the same runtime on a hardware TEE and that last check passes, the result becomes verified, and that is the version you hand a regulator.

+

Every cryptographic check passes. The one FAIL is hardware attestation, which dev mode can't provide, and that is the honest answer: overall verification only reports verified when the claim is hardware-backed, so the CLI prints FAIL (partially_verified) and exits 1 here. A hardware deployment must also supply valid attestation, trusted keys, and the expected policy and catalog bindings. Moving the runtime to a TEE alone does not establish those checks or legal compliance.

@@ -334,6 +338,18 @@

Walk away with proof

Stuck? Every block above is copy-paste: the file blocks write themselves via cat > … EOF, the rest are commands. Keep your first terminal (the runtime) running while you work in the second. Full walkthrough and troubleshooting: cMCP quickstart · debugging guide.

+
+ If a step fails

Get back to the expected result

+
+
Connection refused
Keep Terminal 1 running. Confirm startup completed and the address is 127.0.0.1:8443.
+
Command not found or missing files
Activate the virtual environment in both terminals. Run commands from the cmcp-quickstart folder.
+
The tool call is forwarded instead of denied
Check enforcement_mode: enforcing, the catalog's pii tag, and the forbid rule. Restart the runtime after configuration changes.
+
FAIL (partially_verified), exit 1
Expected only when the listed software checks pass and hardware attestation is the missing check. Other failures need investigation.
+
+

Finish: stop the runtime with Ctrl+C in Terminal 1. Keep claim.json to inspect the record.

+

Next: run an example with a real local tool server →

+
+
You did it

Tell the community how it went

diff --git a/registry/index.html b/registry/index.html index 3dc5368..bcff283 100644 --- a/registry/index.html +++ b/registry/index.html @@ -44,7 +44,7 @@ } - + @@ -159,9 +159,12 @@

The verification runs on your machine, not ours

1

Install the verifier

+

Use Python 3.11+, Git, and Bash on macOS, Linux, or Windows with WSL. Create an isolated environment before installing.

Terminal
-
python -m pip install trace-verify
+
python3 -m venv trace-verify-env
+source trace-verify-env/bin/activate
+python -m pip install trace-verify
@@ -189,6 +192,7 @@

Verify the checkpoint chain

python tools/verify_checkpoint_chain.py \
   registry/2026/06/12.ndjson \
   registry/2026/09/01.ndjson
+

Expected: OK: with the verified checkpoint count, MMR size, and root, then exit 0. FAIL: exits 1. "No entries with mmr_checkpoint" means nothing was verified. This command checks the two named historical files, not every later registry entry.

diff --git a/telemetry/index.html b/telemetry/index.html index 8b440f5..de2a8c2 100644 --- a/telemetry/index.html +++ b/telemetry/index.html @@ -47,7 +47,7 @@ } - + @@ -75,7 +75,7 @@

Portable governance telemetry
for AI-agent runtimes

Where it fits

One correlation layer across the trust chain

AgenTrust Telemetry sits across the four AgenTrust standards. It records runtime facts in a backend-neutral contract, correlates them with the application's existing OpenTelemetry context, and can finalize a complete durable evidence set into a TRACE record.

-
+
01ManifestDeclared identity and authority
02cMCP / cA2APolicy and delegated actions
03TelemetryCorrelated governance facts
@@ -105,17 +105,21 @@

Six event families

Keep the stack you already operate

The reference SDK uses the caller's current OpenTelemetry span. It does not install a provider, processor, exporter, collector, or global propagator. Standard OpenTelemetry fields take precedence over AgenTrust extensions.

+

Before you start: Python 3.11+, Git, and Bash on macOS, Linux, or Windows with WSL. Commands run from the repository root. No telemetry backend is needed for the first example.

+
1

Install the Python SDK

-

Registry publication is being prepared, so install from a checkout while the project is pre-release. This page switches to a pip install after the first release.

+

Install from the source checkout so the SDK and runnable examples use the same revision.

Terminal
git clone https://github.com/agentrust-io/agentrust-telemetry
 cd agentrust-telemetry
+python3 -m venv .venv
+source .venv/bin/activate
 python -m pip install -e ".[otel]"
@@ -124,14 +128,11 @@

Install the Python SDK

2
-

Emit a normalized event

-

The client validates against the bundled schemas and the privacy profile before anything leaves your process. A caller may additionally supply a structured-log emitter.

+

Run a complete event example

+

Run the included synthetic policy event. It defines every required field, validates the event, and prints it through a local log emitter.

-
Python
-
from agentrust_telemetry import SchemaValidator, TelemetryClient
-
-client = TelemetryClient(SchemaValidator.bundled())
-result = client.emit(normalized_event)
+
Terminal
+
python examples/manual_governance.py
@@ -140,6 +141,7 @@

Emit a normalized event

3

Carry correlation across process boundaries

+

Integration sketch: this block assumes your application already defines tracer and event. For a complete runnable version, use python examples/governed_workflow.py after installing ".[test]" as shown below.

For synchronous cross-process agent calls, propagate the caller's W3C context and the durable AgenTrust identifiers, then use the extracted context as the receiving span's remote parent. For asynchronous queue handoffs, start a new trace with links=[remote.link()] instead: that preserves causality without representing queued work as a synchronous child span.

Python
@@ -160,6 +162,7 @@

Carry correlation across process boundaries

4

Or use the TypeScript SDK

+

Use a separate terminal at the repository root, with Node.js and npm installed. Return to the root for the Python examples below.

The pre-alpha Node package validates the same fixtures and the same privacy profile as Python, and preserves nanosecond wire timestamps as decimal strings. It installs no OTel provider, exporter, or global propagator either.

Terminal · packages/typescript
@@ -172,6 +175,8 @@

Or use the TypeScript SDK

+

Expected first result: a printed policy event and an EmitResult with accepted=True and log_emitted=True. A missing span is expected without an active OpenTelemetry span. This synthetic event does not enforce a policy.

+

Two runnable examples

Both ship in the repository. The second walks the complete governance, OpenTelemetry, durable-evidence, and TRACE reference workflow.

diff --git a/tools/check-quickstart.py b/tools/check-quickstart.py new file mode 100644 index 0000000..ca45108 --- /dev/null +++ b/tools/check-quickstart.py @@ -0,0 +1,47 @@ +"""Run the published Bash quickstart in a temporary directory, including exit 1.""" +from html.parser import HTMLParser +from pathlib import Path +import subprocess +import tempfile + + +class Blocks(HTMLParser): + def __init__(self): + super().__init__(convert_charrefs=True) + self.blocks, self.current = [], None + + def handle_starttag(self, tag, attrs): + if tag == "pre": + self.current = "" + + def handle_data(self, data): + if self.current is not None: + self.current += data + + def handle_endtag(self, tag): + if tag == "pre": + self.blocks.append(self.current) + self.current = None + + +parser = Blocks() +parser.feed((Path(__file__).resolve().parents[1] / "quickstart/index.html").read_text(encoding="utf-8")) +install, config, policy, catalog, validate, start, deny, verify, *_ = parser.blocks +script = "set -eu\n" + "\n".join([install, config, policy, catalog, validate]) +script += "\n" + start + " >runtime.log 2>&1 &\nruntime_pid=$!\n" +script += "trap 'kill $runtime_pid 2>/dev/null || true' EXIT\n" +script += ''' +ready=0 +for attempt in $(seq 1 60); do + if curl -s -o /dev/null http://localhost:8443/health; then ready=1; break; fi + if ! kill -0 "$runtime_pid" 2>/dev/null; then cat runtime.log; exit 1; fi + sleep 1 +done +if [ "$ready" != 1 ]; then cat runtime.log; exit 1; fi +''' +script += "\n" + deny + " >denial.txt\ncat denial.txt\ngrep -q '403' denial.txt\ngrep -q 'POLICY_DENY' denial.txt\n" +script += "set +e\n" + verify + " >verification.txt 2>&1\nresult=$?\nset -e\ncat verification.txt\n" +script += "test $result -eq 1\ngrep -q 'partially_verified' verification.txt\ngrep -q 'CRYPTO-001' verification.txt\n" +with tempfile.TemporaryDirectory(prefix="agentrust-quickstart-") as temp: + subprocess.run(["bash", "-c", script], cwd=temp, check=True, timeout=240) +print("PASS published quickstart: 403 POLICY_DENY, signed session record, expected software-mode verification exit 1") diff --git a/tools/check-site.py b/tools/check-site.py new file mode 100644 index 0000000..1e7e0cd --- /dev/null +++ b/tools/check-site.py @@ -0,0 +1,65 @@ +"""Check local HTML destinations, fragments, IDs, and structured data.""" +import json +from html.parser import HTMLParser +from pathlib import Path +from urllib.parse import unquote, urlsplit + +ROOT = Path(__file__).resolve().parents[1] + + +class Page(HTMLParser): + def __init__(self, path): + super().__init__(convert_charrefs=True) + self.ids, self.links, self.duplicates = set(), [], [] + self.structured, self.json_text = [], None + self.feed(path.read_text(encoding="utf-8")) + + def handle_starttag(self, tag, attrs): + attrs = dict(attrs) + if "id" in attrs: + if attrs["id"] in self.ids: + self.duplicates.append(attrs["id"]) + self.ids.add(attrs["id"]) + if tag in ("a", "link", "script", "img"): + target = attrs.get("href", attrs.get("src")) + if target: + self.links.append(target) + if tag == "script" and attrs.get("type") == "application/ld+json": + self.json_text = "" + + def handle_data(self, data): + if self.json_text is not None: + self.json_text += data + + def handle_endtag(self, tag): + if tag == "script" and self.json_text is not None: + self.structured.append(json.loads(self.json_text)) + self.json_text = None + + +pages = {p: Page(p) for p in ROOT.rglob("*.html") if ".git" not in p.parts} +errors = [] +checked = 0 +for path, page in pages.items(): + errors.extend(f"{path.relative_to(ROOT)}: duplicate id {id}" for id in page.duplicates) + for href in page.links: + url = urlsplit(href) + if url.scheme and url.scheme not in ("http", "https"): + continue + if url.netloc and url.netloc != "agentrust-io.com": + continue + if not url.path: + dest = path + else: + dest = (ROOT / unquote(url.path).lstrip("/") if url.path.startswith("/") + else path.parent / unquote(url.path)).resolve() + if dest.is_dir(): + dest /= "index.html" + checked += 1 + if not dest.is_file(): + errors.append(f"{path.relative_to(ROOT)}: missing destination {href}") + elif url.fragment and dest in pages and unquote(url.fragment) not in pages[dest].ids: + errors.append(f"{path.relative_to(ROOT)}: missing fragment {href}") +if errors: + raise SystemExit("\n".join(errors)) +print(f"PASS {len(pages)} HTML pages; {checked} local links/assets; unique IDs and valid JSON-LD") From 7c5215231ded26112cfd29c9005ce2dfbf817251 Mon Sep 17 00:00:00 2001 From: Imran Siddique Date: Sat, 5 Sep 2026 14:05:44 -0700 Subject: [PATCH 2/2] Align boundary descriptions and verify every software check --- design-system.css | 1 + index.html | 24 +++++++++++++----------- quickstart/index.html | 2 +- tools/check-quickstart.py | 2 ++ 4 files changed, 17 insertions(+), 12 deletions(-) diff --git a/design-system.css b/design-system.css index a4e82bc..82cefa0 100644 --- a/design-system.css +++ b/design-system.css @@ -1985,6 +1985,7 @@ html:has(body.agentrust-hub) { scroll-behavior: smooth; } .architecture-input { flex-direction: column; align-items: start; gap: .5rem; } .architecture-row, .architecture-outcomes { grid-template-columns: 1fr; } .architecture-edge { justify-self: center; margin-block: .25rem; } + .architecture-edge .direction { display: inline-block; transform: rotate(90deg); } .architecture-outcomes > div + div { border-left: 0; border-top: 1px solid var(--at-line); } .agentrust-hub .hero-actions { gap: .75rem; } .agentrust-hub .hero-actions .btn { text-align: center; white-space: normal; } diff --git a/index.html b/index.html index 04ca9e9..4ab6fff 100644 --- a/index.html +++ b/index.html @@ -56,7 +56,9 @@ "@id": "https://agentrust-io.com/#website", "name": "AgenTrust", "url": "https://agentrust-io.com/", - "publisher": { "@id": "https://agentrust-io.com/#organization" } + "publisher": { + "@id": "https://agentrust-io.com/#organization" + } } ] } @@ -96,7 +98,7 @@ "@type": "TechArticle", "name": "Confidential MCP (cMCP)", "url": "https://cmcp.agentrust-io.com/", - "description": "An extension to the Model Context Protocol that runs tool calls inside a Trusted Execution Environment so the host process cannot observe inputs, outputs, or intermediate state." + "description": "Confidential MCP (cMCP) evaluates routed MCP tool calls against policy and records the decisions. In a hardware deployment, the runtime is inside a Trusted Execution Environment (TEE); the agent and upstream tool server remain separate. Host confidentiality also depends on the egress policy. Software mode provides no hardware isolation." } }, { @@ -148,7 +150,7 @@ "name": "What is Confidential MCP (cMCP)?", "acceptedAnswer": { "@type": "Answer", - "text": "Confidential MCP is an extension to the Model Context Protocol that runs tool calls inside a Trusted Execution Environment, so the host process cannot read tool-call plaintext from enclave memory. That protection is structural only where the Cedar egress policy denies telemetry and APM endpoints, and it covers the tool-call boundary rather than model inference or the agent's context window." + "text": "Confidential MCP (cMCP) evaluates routed MCP tool calls against policy and records the decisions. In a hardware deployment, the runtime is inside a Trusted Execution Environment (TEE); the agent and upstream tool server remain separate. Host confidentiality also depends on the egress policy. Software mode provides no hardware isolation." } }, { @@ -164,7 +166,7 @@ "name": "How do the AgenTrust standards relate to each other?", "acceptedAnswer": { "@type": "Answer", - "text": "Agent Manifest establishes who an agent is and what it is allowed to do, cMCP executes tool calls confidentially inside a Trusted Execution Environment, cA2A carries that trust across agent-to-agent delegation on A2A, and TRACE produces hardware-signed receipts that prove what actually happened. Together they cover identity, intent, delegation, and behavior." + "text": "Agent Manifest declares identity and intended authority. cMCP governs tool calls; cA2A governs delegation to another agent. TRACE carries signed runtime evidence for verification against a trust policy. Hardware provenance depends on verified attestation. Use the components required by your trust boundary." } }, { @@ -180,7 +182,7 @@ "name": "What is the secure version of MCP?", "acceptedAnswer": { "@type": "Answer", - "text": "Confidential MCP (cMCP) is the security-hardened way to run the Model Context Protocol. It executes MCP tool calls inside a Trusted Execution Environment (TEE), so tool-call plaintext is not readable from the host, and it emits a signed TRACE receipt for every call that anyone can verify. Two bounds worth stating: the plaintext guarantee holds where the egress policy denies telemetry and APM endpoints, and the receipt is hardware-attested when the gateway runs in a TEE and signed-only in software mode. If you need a secure or confidential MCP deployment, cMCP is the AgenTrust profile for it." + "text": "Confidential MCP (cMCP) evaluates routed MCP tool calls against policy and records the decisions. In a hardware deployment, the runtime is inside a Trusted Execution Environment (TEE); the agent and upstream tool server remain separate. Host confidentiality also depends on the egress policy. Software mode provides no hardware isolation." } }, { @@ -269,9 +271,9 @@

Where policy runs. Where evidence goes.

Agent ManifestDeclares identity, artifacts, and intended authority. A runtime must verify and enforce those declarations.
Your agentRequests a tool action
-
request →
+
request
cMCP runtimeCatalog lookup + policy decisionTEE boundary in hardware deployments; software process in the demo.
-
allow →
+
allow
MCP tool serverRuns the allowed call outside the runtime's boundary
@@ -727,7 +729,7 @@

Read the field guide. Then run the companion examples.

What is AgenTrust?

AgenTrust is an open ecosystem for verifiable AI agent governance. It connects reusable technology with the people and practices needed to adopt it: maintainers, implementers, researchers, enterprise operators, conformance testing, integration guidance, and transparent community governance.

-

Four specifications cover different trust boundaries. Agent Manifest declares who an agent is and what it is allowed to do. Confidential MCP (cMCP) enforces that by evaluating tool calls against policy inside a Trusted Execution Environment, so tool-call plaintext is not readable from the host. Confidential A2A (cA2A) carries attenuated authority and attested provenance when work is delegated to another agent. TRACE proves what actually happened with signed receipts, hardware-attested when the gateway runs in a TEE. All four are open source, under Apache 2.0 for Agent Manifest, MIT for cMCP and cA2A, and CC BY 4.0 plus Apache 2.0 for TRACE.

+

Agent Manifest declares identity and intended authority. cMCP governs tool calls; cA2A governs delegation to another agent. TRACE carries signed runtime evidence for verification against a trust policy. Hardware provenance depends on verified attestation. Use the components required by your trust boundary. Explore each project's specification, reference implementation, and license through the technology links above.

AgenTrust Telemetry is the integration layer across that chain. It gives runtimes a common, metadata-only contract for governance facts, projects those facts into caller-owned OpenTelemetry, and can turn a complete durable evidence set into TRACE. It does not replace a policy engine, collector, observability backend, or dashboard.

@@ -754,7 +756,7 @@

Frequently Asked Questions

What is Confidential MCP (cMCP)?
-
Confidential MCP is an extension to the Model Context Protocol that runs tool calls inside a Trusted Execution Environment, so the host process cannot read tool-call plaintext from enclave memory. That protection is structural only where the Cedar egress policy denies telemetry and APM endpoints, and it covers the tool-call boundary rather than model inference or the agent's context window.
+
Confidential MCP (cMCP) evaluates routed MCP tool calls against policy and records the decisions. In a hardware deployment, the runtime is inside a Trusted Execution Environment (TEE); the agent and upstream tool server remain separate. Host confidentiality also depends on the egress policy. Software mode provides no hardware isolation.
What is Confidential A2A (cA2A)?
@@ -762,7 +764,7 @@

Frequently Asked Questions

What is the secure version of MCP?
-
Confidential MCP (cMCP) is the security-hardened way to run the Model Context Protocol. It executes MCP tool calls inside a Trusted Execution Environment (TEE), so tool-call plaintext is not readable from the host, and it emits a signed TRACE receipt for every call that anyone can verify. Two bounds worth stating: the plaintext guarantee holds where the egress policy denies telemetry and APM endpoints, and the receipt is hardware-attested when the gateway runs in a TEE and signed-only in software mode. If you need a secure or confidential MCP deployment, cMCP is the AgenTrust profile for it.
+
Confidential MCP (cMCP) evaluates routed MCP tool calls against policy and records the decisions. In a hardware deployment, the runtime is inside a Trusted Execution Environment (TEE); the agent and upstream tool server remain separate. Host confidentiality also depends on the egress policy. Software mode provides no hardware isolation.
What is the secure version of A2A?
@@ -770,7 +772,7 @@

Frequently Asked Questions

How do the AgenTrust standards relate to each other?
-
Agent Manifest covers identity, cMCP covers confidential execution, and TRACE covers verifiable behavior. Manifest says who an agent is and what it may do, cMCP runs its tool calls confidentially, and TRACE produces hardware-signed receipts of what actually happened.
+
Agent Manifest declares identity and intended authority. cMCP governs tool calls; cA2A governs delegation to another agent. TRACE carries signed runtime evidence for verification against a trust policy. Hardware provenance depends on verified attestation. Use the components required by your trust boundary.
Are the AgenTrust standards open source?
diff --git a/quickstart/index.html b/quickstart/index.html index 9bca173..2cb96ac 100644 --- a/quickstart/index.html +++ b/quickstart/index.html @@ -369,7 +369,7 @@

Join the AgenTrust Discord

AgenTrust
Open standards for AI agent governance
-
cMCP, Confidential MCP, is an open standard from AgenTrust: the confidential, security-hardened way to run the Model Context Protocol, MIT-licensed. It evaluates tool calls against policy inside a Trusted Execution Environment and emits a signed TRACE receipt for every call. Software-rooted in dev mode; hardware-attested when the runtime runs in a TEE. Part of the AgenTrust family alongside TRACE, Agent Manifest, and cA2A, at agentrust-io.com.
+
cMCP, Confidential MCP, is an open standard from AgenTrust: the confidential, security-hardened way to run the Model Context Protocol, MIT-licensed. It evaluates routed tool calls against policy and emits a signed TRACE session record when the session closes. Software-rooted in dev mode; hardware-attested when the runtime runs in a TEE. Part of the AgenTrust family alongside TRACE, Agent Manifest, and cA2A, at agentrust-io.com.
© 2026 AgenTrust Contributors · cMCP is open source (MIT) · agentrust-io.com
diff --git a/tools/check-quickstart.py b/tools/check-quickstart.py index ca45108..8659e7a 100644 --- a/tools/check-quickstart.py +++ b/tools/check-quickstart.py @@ -42,6 +42,8 @@ def handle_endtag(self, tag): script += "\n" + deny + " >denial.txt\ncat denial.txt\ngrep -q '403' denial.txt\ngrep -q 'POLICY_DENY' denial.txt\n" script += "set +e\n" + verify + " >verification.txt 2>&1\nresult=$?\nset -e\ncat verification.txt\n" script += "test $result -eq 1\ngrep -q 'partially_verified' verification.txt\ngrep -q 'CRYPTO-001' verification.txt\n" +for check in ("schema", "signature", "policy_bundle.hash", "tool_catalog.hash", "attestation_freshness", "audit_chain"): + script += f"grep -Eq '{check.replace('.', '[.]')} +PASS' verification.txt\n" with tempfile.TemporaryDirectory(prefix="agentrust-quickstart-") as temp: subprocess.run(["bash", "-c", script], cwd=temp, check=True, timeout=240) print("PASS published quickstart: 403 POLICY_DENY, signed session record, expected software-mode verification exit 1")