Skip to content

AgentAvow Trust

by agentavow.com · remote · local (pypi) · no sign-in to list tools · v0.6.2 · published by com.agentavow

Signed, offline-verifiable safety scores for the MCP servers, packages & tools an agent connects to

Changes · 6
CompareRegistry entry

8 tools: 6 change things and 2 only read.

Scanned Oct 21, 2026

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http agentavow-trust https://agentavow.com/mcp

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

8 tools

Changes things 6Claude Code: ask
  • about_agentavowWhat AgentAvow is, which tool to use for what, how to read a verdict, and example scans.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    What AgentAvow is, which tool to use for what, how to read a verdict, and example scans. Call this for an overview or when getting started. No input, read-only.

    Annotations the server declares

    • title: About AgentAvow
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • check_interaction_safetyCheck whether it is safe to interact with another agent by trust threshold.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Check whether it is safe to interact with another agent by trust threshold. Thresholds: delegate 0.6, trade 0.5, collaborate 0.4, follow 0.1. Returns is_safe, risk_level, the score, and a recommendation. Read-only, no auth.

    Annotations the server declares

    • title: Check interaction safety
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • scan_mcp_serverScan a live MCP server's tool definitions for tool-poisoning, prompt-injection, invisible-unicode, and manifest-execution risks before your agent connects to it.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Scan a live MCP server's tool definitions for tool-poisoning, prompt-injection, invisible-unicode, and manifest-execution risks before your agent connects to it. Returns one of three answers with its reason (Safe to connect, Review before you connect, or Do not connect), a 0-100 trust score, findings, and a signed attestation. Read-only; calls the agentavow.com public API.

    Annotations the server declares

    • title: Scan an MCP server
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • scan_packageScan a published package (npm, PyPI, crates, Docker, or Hugging Face) with AgentAvow.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Scan a published package (npm, PyPI, crates, Docker, or Hugging Face) with AgentAvow. Returns one of three answers with its reason (Safe to connect, Review before you connect, or Do not connect), a 0-100 trust score, an adoption score from real usage (downloads per week), findings with remediation, and a signed attestation. Also reports published advisories that affect the scanned version, the maintainer's deprecation notice, repo-vs-artifact drift (files shipped that aren't in the source), and AgentAvow's behavioral sandbox results when available. Scans the latest version unless `version` (or a pin in the name) names one. Read-only; calls agentavow.com.

    Annotations the server declares

    • title: Scan a package
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • scan_repoScan a public GitHub repository with AgentAvow and return whether it is safe for an agent to connect to: one of three answers with its reason (Safe to connect, Review before you co…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Scan a public GitHub repository with AgentAvow and return whether it is safe for an agent to connect to: one of three answers with its reason (Safe to connect, Review before you connect, or Do not connect), a 0-100 trust score, an adoption score from real usage (stars), the findings behind it (with where and how to fix), and a signed, offline-verifiable attestation. Read-only, no account. Calls the AgentAvow public API at agentavow.com.

    Annotations the server declares

    • title: Scan a GitHub repo
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • verify_trustVerify an AgentAvow entity's trust score.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Verify an AgentAvow entity's trust score. Returns trust_score (0-1), trust_score_pct (0-100), trust_tier, and whether it meets a minimum threshold. Read-only, no auth. Use before interacting with an unknown agent.

    Annotations the server declares

    • title: Verify an entity's trust score
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Only reads 2Claude Code: allow
  • get_trust_badgeGet an embeddable AgentAvow trust badge (SVG) for an entity, with ready-to-paste Markdown and HTML.No findings

    Why it is in this group

    • The name "get_trust_badge" says "get": a word for reading.
    Description, as the server wrote it
    Get an embeddable AgentAvow trust badge (SVG) for an entity, with ready-to-paste Markdown and HTML. The badge auto-updates as the score changes. Read-only, no auth.

    Annotations the server declares

    • title: Get a trust badge
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • lookup_identityLook up an AgentAvow entity by W3C DID or display name.No findings

    Why it is in this group

    • The name "lookup_identity" says "lookup": a word for reading.
    Description, as the server wrote it
    Look up an AgentAvow entity by W3C DID or display name. Returns the entity's id, name, type, trust score and tier. Read-only, no auth. Use to resolve an identity before checking its trust.

    Annotations the server declares

    • title: Look up an agent or tool
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 0.6.2. Values in angle brackets are yours to fill in.

claude mcp add --transport http agentavow-trust https://agentavow.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__agentavow-trust__lookup_identity",
      "mcp__agentavow-trust__get_trust_badge"
    ],
    "ask": [
      "mcp__agentavow-trust__scan_repo",
      "mcp__agentavow-trust__scan_package",
      "mcp__agentavow-trust__scan_mcp_server",
      "mcp__agentavow-trust__verify_trust",
      "mcp__agentavow-trust__check_interaction_safety",
      "mcp__agentavow-trust__about_agentavow"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as agentavow-trust. Review it before you use it.