Agent Verify

Know what your AI agent can do before you deploy it.

Agent Verify inspects an AI agent or agent package — its permissions, tools, MCP connections, execution controls, secrets, runtime configuration, and dependencies — and issues a VERIFIED or NOT VERIFIED result with evidence, before the agent reaches production.

Traditional security tools scan software. Agent Verify also examines what an AI agent is connected to and what those connections may let it actually do — a legitimate credential, valid API access, and an approved tool can still combine into an action the agent should never be able to take.

Agent Verify provides open-source CLI, CI, web integration, and API tooling backed by a proprietary verification engine — see Privacy & proprietary scanner boundary.

Architecture

Dashboard ─┐
CLI ───────┼──► Worker API ──► server-side entitlement & scan quota ──► private scanner engine
API ───────┘         │
                      └──► D1 (billing/quota) · Firestore (reports, orgs, audit log)

Every scan — from the dashboard, the CLI, or a direct API call — goes through the same authenticated Worker route and the same server-owned monthly quota; there is no client-only or local-storage-based scan counter anywhere in the product, and no browser code ever runs the detection engine directly. See Web App and Privacy & proprietary scanner boundary for how that boundary is enforced and verified.

What this repo contains — open source vs. proprietary

Component	Location	License
Web app (dashboard, reports, landing page)	apps/web	Open source (this repo, MIT)
CLI / SDK (agentverify on npm)	packages/cli	Open source (this repo, MIT)
Cloudflare Worker API	workers/api	Open source (this repo, MIT)
Detection engine (@agentverify/scanner)	packages/scanner	Proprietary — not in this repository

Quick Start — CLI

npm install -g agentverify
agentverify scan ./agents --key av_your_key

Get an API key from Dashboard → API access after signing in at https://aimodularity.com/agentverify/. Full docs, including the API contract, CI/CD integration, and JSON output shape: https://aimodularity.com/agentverify/docs/

agentverify --help
agentverify --version
agentverify scan ./agents --key av_your_key           # scan a directory
agentverify scan --file agent.json --key av_your_key   # scan a single file
agentverify scan ./agents --key av_your_key --ci        # CI mode, strict exit codes
agentverify scan ./agents --key av_your_key --ci --policy standard  # + policy evaluation

CI exit codes distinguish a real security failure from an execution problem:

Code	Meaning
0	All scanned files verified
1	NOT_VERIFIED — a real security/verification failure
2	NOT_ASSESSED — insufficient evidence for a verdict
3	Execution error — bad/missing API key, network failure, missing file (not a security finding)

GitHub Action

- uses: AI-Blockchain-Ventures/[email protected]
  with:
    path: ./agents
    api-key: ${{ secrets.AGENTVERIFY_API_KEY }}

See docs/github-action.md for the full reference — Markdown/JSON output modes, PR comment posting, branch protection, and policy evaluation in CI.

Web App

The dashboard (apps/web) provides scan history, report sharing, a check catalog, policy profiles, and organization/team management (roles: Owner/Admin/Member/Viewer) on top of the same Worker API the CLI uses — every dashboard scan is server-metered exactly like a CLI or API scan, never run or counted client-side.

What Agent Verify analyzes

Permissions and tool access, MCP server connections and what they expose, execution/authorization controls, secrets and credential handling, runtime configuration, and dependencies — static analysis of submitted content, not a live sandbox execution.

Verification output

• VERIFIED — sufficient execution context was assessed and the required trust controls passed.
• NOT VERIFIED — sufficient execution context was assessed and one or more security or protocol controls failed.
• NOT ASSESSED — the submitted content didn't contain enough agent execution context to make a decision. This is not a security failure, and it must never be read as VERIFIED.

Every finding is also labeled by how it was derived: definite (a concrete pattern was matched), heuristic (inferred from context — could be a false positive/negative), or informational (a neutral observation). Agent Verify does static analysis — it never executes submitted code — so it is honest about what it cannot see: see Limitations below.

Artifact fingerprinting / signed attestations

Every scan computes a SHA-256 artifact fingerprint over the exact scanned content — identical content always produces the same fingerprint, independent of when it ran or whether the ruleset changed since. When server-side signing is configured, a scan result can carry a signed attestation (ECDSA P-256 / ES256) over the verdict, score, and fingerprint — independently verifiable by any third party with nothing more than the published public key, with no shared secret and no need to trust Agent Verify's API at verification time.

Policies

Built-in policy profiles (standard, high-security, financial-agent, production-infrastructure) can be evaluated against a scan's evidence in addition to — never instead of — the base verdict: a scan can be VERIFIED and still fail a stricter policy, but a policy can never turn a NOT_VERIFIED scan into a pass. Pass --policy <id> on the CLI or the policy input on the GitHub Action.

This is the beginning of the README. Read the rest at the original. Read the full README ↗