AgentTrust
github.com/eulogik/agenttrust- Category
- Cybersecurity
- Rank
- No. 1546Tools index
Previous survey · No. 1497 ·
- Pricing
- Freemium
- Type
- TOOL
- Use case
- Security & Identity
- Interfaces
- CLI
- GitHub
- 13 stars
- Latest release
- v0.1.3
- Date
About
AgentTrust is a free CLI that statically scans AI agents, MCP servers, and npm packages for security issues, mapping findings to the OWASP Agentic AI Top 10 and LLM Top 10 2025. It outputs a letter-graded, shareable Trust Card plus SARIF and Markdown reports, running entirely locally with no telemetry or account required.
What it does
A command-line checker for code that drives AI agents. Point it at a local folder, a public GitHub repository or an npm package and it reads the source with pattern matching, never running it. Eight rules hunt for hardcoded keys, shell commands built from input, dynamic code evaluation, unguarded recursive deletion and similar risks, and each hit carries a severity, a fix and a security-list code. Five weighted dimensions roll up into an A to F grade written out as JSON, a GitHub code-scanning report and a readable summary. When too much of the project sits outside what the rules can read, it withholds the grade and prints U instead.
Why it's ranked here
The case for it is honesty about its own limits. The project states that its rules are regular expressions with no syntax tree, that the attack command only relabels scan findings, and that workflow evaluation parses test suites without executing anything. It refuses to grade when coverage is thin rather than inflating a score. Apache 2.0 licensing, defined exit codes for CI and a ready GitHub Action make it cheap to try. Against that, eight rules is a small net. Note the naming: the catalogue lists it as AgentTrust, but the repository now ships as OpenTrustBench.
What's good
The grade is withheld, not inflated: unsupported source files, hitting scan limits or finding nothing analyzable all produce a U and exit code 2, while the report files still get written. Finding IDs are deterministic hashes, so repeat scans give byte-stable output that diffs cleanly between CI runs. The dependency check runs npm's own audit against the lockfile without installing anything. Server detection looks through subfolders rather than only the top level, so an MCP (Model Context Protocol) server kept in a source directory is still recognised.
Tradeoffs
Detection is plain text matching. A project gets classed as a generic agent if any file contains words as common as tools or agent, and the rules cannot follow data through code the way a syntax-aware analyzer does. Only JavaScript, TypeScript and Python are analyzed; JSON and YAML get just the credential check. The attack and eval commands sound like dynamic testing but execute nothing. The registry command prints sample data, labelled as such. The Python package is a thin wrapper that still needs Node 18 and npm.
How to use it well
Use it as a quick first pass in CI for a JavaScript, TypeScript or Python agent or MCP server: set the severity gate to high, upload the code-scanning report, and treat a U as a prompt to check coverage, not as a pass. It suits maintainers who want a fast look for leaked keys and shell injection before publishing. It does not replace runtime testing, a prompt-injection red team or a syntax-aware static analyzer, and its badge is not a certification, as the project itself says.
Technical notes+
packages/cli/src/index.ts dispatches scan, attack, eval, init, badge and registry; the scan handler always writes the SARIF, Markdown and Trust Card JSON artifacts to --output-dir, sets exit code 2 when the score is withheld, and exits 1 when any finding meets the --fail-on severity. packages/core/src/analysis/detector.ts classifies targets by substring search over files up to 512 KB, falling back to generic-agent on strings such as openai or tools. packages/core/src/analysis/dependency-scanner.ts runs npm audit --json --package-lock-only only when a lockfile exists and covers runtime dependencies only. packages/core/src/types/index.ts models TrustScore as a union whose status is either scored or withheld, and a nullable overall. Fixed weights for the five scoring dimensions are documented in web/public/methodology.html.
Observed
- License
- Apache-2.0
- Language
- TypeScript, compiled with tsc; requires Node 18 or newer
- Interfaces
- CLI with scan, attack, eval, init, badge and registry commands
- CI integration
- Composite GitHub Action with target, format, output-dir and fail-on inputs
- Output formats
- terminal, json, sarif, md
- Install surface
- npm, npx, PyPI, Homebrew, Docker, VS Code extension, GitHub Action, source
- Python package
- Wrapper with no Python dependencies; README states it requires Node 18+ and the npm CLI engine
- Analysis method
- Regex-based static rules, no AST; attack and eval commands do not execute code
- Analyzed languages
- JavaScript, TypeScript and Python; JSON/YAML receive only the credential rule
- Tests
- node --test run over compiled core tests
- Security policy
- SECURITY.md present with private advisory reporting path
Read from README.md, package.json, packages/cli/package.json, packages/cli/src/index.ts, packages/core/src/index.ts, packages/core/src/analysis/detector.ts, packages/core/src/analysis/dependency-scanner.ts, packages/core/src/types/index.ts, packages/action/action.yml, packages/pypi/pyproject.toml, web/public/methodology.html, LICENSE, SECURITY.md.
What it can do
Statically scan AI agent, MCP server, and npm package code for security issues
Codebase or npm package → Security findings
Map security findings to OWASP Agentic AI Top 10 and LLM Top 10 2025
Scan findings → OWASP-mapped categories
Generate a letter-graded Trust Card
Scan results → Shareable Trust Card
Generate SARIF report
Scan results → SARIF file
Generate Markdown report
Scan results → Markdown document
Provide a CI gate check
Scan results → Pass/fail CI status
Tags
Tech Stack
Media
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.