SRN0129/Agenttrust

AgentTrust

Verifiable Zero-Trust Control Plane, Cryptographic Black Box, and Post-Quantum Policy Gateway for Autonomous AI Agents

    [!

PQC NIST FIPS 204-8B5CF6.svg)](server/services/pqcAttestation.ts)   

The Problem: Autonomous AI agents are being granted bash shells, SQL credentials, cloud infrastructure access, and corporate credit cards. Without a deterministic policy boundary, a single indirect prompt injection or runaway hallucination can delete production tables, exfiltrate API keys, or drain financial budgets. The Solution: AgentTrust sits between autonomous LLM agent runtimes and external tool execution environments. It intercepts every proposed action, screens parameters for prompt injections and data leaks, checks real-time blast radius, enforces fine-grained capability policies, gates dangerous actions behind 1-click human approvals, and records every event into an immutable, hardware-sealed (TPM 2.0 / Nitro Enclave) audit ledger anchored by NIST FIPS 204 (ML-DSA) post-quantum Merkle proofs.

Key Highlights & Architectural Guarantees

Visual Architecture

                                  [ Autonomous Agent Runtime ]
                     (LangChain / LangGraph / CrewAI / AutoGen / OpenAI)
                                                │
                                                │ 1. Direct Authenticated Tool Execution Request
                                                ▼
┌────────────────────────────────────────────────────────────────────────────────────────┐
│                        AGENTTRUST DIRECT AUTHENTICATED GATEWAY                         │
│                                                                                        │
│   ┌──────────────────────────────┐     ┌───────────────────────────────────────────┐   │
│   │ Socket-Level Egress Guard    │     │ Prompt Injection & Secret Leak Scanner    │   │
│   │ • Loopback & RFC1918 Defense │ ──► │ • 16-Pattern Prompt Hijack Detection      │   │
│   │ • Cloud IMDS (169.254) Shield│     │ • PCI/API Token / Private Key Redaction   │   │
│   └──────────────────────────────┘     └───────────────────────────────────────────┘   │
│                                                       │                                │
│   ┌──────────────────────────────┐     ┌──────────────┴────────────────────────────┐   │
│   │ Blast Radius Scoring Engine  │     │ Sliding-Window Spend & Velocity Limiter   │   │
│   │ • Reversibility Evaluation   │ ──► │ • Autonomous Micro-Budgeting ($/run)      │   │
│   │ • Target Tier Classification │     │ • 30 RPM Velocity Circuit Breaker         │   │
│   └──────────────────────────────┘     └───────────────────────────────────────────┘   │
│                                                       │                                │
│                                        ┌──────────────▼────────────────────────────┐   │
│                                        │ Deny-by-Default Policy Authorization      │   │
│                                        │ • Fine-Grained Capability Glob Matching   │   │
│                                        │ • Lineage Attenuation for Subagent Swarms │   │
│                                        └───────────────────────────────────────────┘   │
└───────────────────────────────────────────────────────┬────────────────────────────────┘
                                                        │
                         ┌──────────────────────────────┴──────────────────────────────┐
                         │                                                             │
                         ▼ (Blast Radius > 0.7 OR Sensitive)                           ▼ (Authorized)
       ┌──────────────────────────────────────────┐                  ┌──────────────────────────────────┐
       │   Human-in-the-Loop Callback Gateway     │                  │  Cryptographic Execution Sandbox │
       │   • 1-Click Mobile / Slack Signed URLs   │                  │  • Hard Process Isolation        │
       │   • Single-Use Ephemeral Nonce (Anti-409)│                  │  • 3,000ms Watchdog Timeout      │
       └──────────────────────────────────────────┘                  └──────────────────────────────────┘
                         │                                                             │
                         └──────────────────────────────┬──────────────────────────────┘
                                                        │
                                                        ▼ 2. Cryptographic Proof of Execution
┌────────────────────────────────────────────────────────────────────────────────────────┐
│                              VERIFIABLE AUDIT ENGINE & NOTARY                          │
│                                                                                        │
│   [ SHA-256 Backward Hash Chaining ] ──► [ Binary Merkle Tree Inclusion Receipts ]     │
│   [ TPM 2.0 PCR-Sealed Hardware Key] ──► [ NIST FIPS 204 (ML-DSA) Post-Quantum Proofs] │
└────────────────────────────────────────────────────────────────────────────────────────┘

3-Second Terminal Demo: Rogue Action Intercepted

$ curl -X POST http://localhost:4000/api/v1/proxy \
  -H "Authorization: Bearer at_live_8f3a..." \
  -H "Content-Type: application/json" \
  -d '{
    "targetUrl": "http://169.254.169.254/latest/meta-data/iam/security-credentials/",
    "method": "GET"
  }'

# 1.2ms Later: Trapped and Anchored to Merkle Ledger
HTTP/1.1 403 Forbidden
Content-Type: application/json

{
  "success": false,
  "decision": "BLOCKED",
  "reason": "SSRF_PROHIBITED: Outbound destination resolved to prohibited cloud metadata IP (169.254.169.254)",
  "blastRadiusTier": "CRITICAL",
  "auditProof": {
    "entryId": "audit_84f9a0c2",
    "merkleRoot": "0x98f2b380d1e3458c01b44aa7...",
    "pqcManifest": "FIPS-204-ML-DSA-v1.0"
  }
}

Sleek Web Dashboard & Live SecOps Center

AgentTrust includes a dark-mode Security Operations Center (SOC) dashboard built with React and Tailwind CSS:

• Executive HUD: Real-time stats on active agent enclaves, verifiable audit blocks, and post-quantum attestation status.
• 1-Click Interactive Threat Simulator: Live simulation buttons for Cloud SSRF attacks (169.254.169.254), prompt injections, runaway spend spikes, and financial wire approvals.
• Direct Authenticated Operator Session: Fully authenticated control plane (x-admin-key / Bearer token) with zero insecure proxy bypass.
• Swarm Delegation Tree: Visual parent-child lineage tree with strict capability attenuation.
• Cryptographic Merkle Explorer: Interactive SHA-256 hash-chain block inspector and NIST FIPS 204 attestation verifier.

Run Locally:

# 1. Clone repository
git clone https://github.com/SRN0129/Agenttrust.git
cd Agenttrust

# 2. Install dependencies
npm install
npm --prefix client install

# 3. Build & Launch
npm run build:client
npm run server

Access the dashboard at http://localhost:4000.

Polyglot SDK Quickstarts

1. Python (sdk-python) — LangChain & CrewAI

from agenttrust import wrap_agent, AgentTrustClient
from langchain.agents import AgentExecutor

# Authenticated Direct Gateway
client = AgentTrustClient(
    api_key="at_live_8f3a9e...",
    endpoint="https://gateway.agenttrust.io"
)

# Intercept tool calls with automatic policy screening & blast radius check
@wrap_agent(client=client, rate_limit_rpm=30, blast_radius_tier="HIGH")
def run_autonomous_agent(prompt: str):
    executor = AgentExecutor(...)
    return executor.run(prompt)

2. TypeScript (sdk)

import { AgentTrustClient } from "@srn0129/agenttrust";

const client = new AgentTrustClient({
  apiKey: "at_live_8f3a9e...",
  endpoint: "https://gateway.agenttrust.io"
});

const result = await client.executeProtectedTool({
  toolName: "database_query",
  parameters: { query: "SELECT * FROM orders WHERE id = 1" }
});

3. Go (sdk-go)

client := agenttrust.NewClient(agenttrust.Config{
    APIKey:   "at_live_8f3a9e...",
    Endpoint: "https://gateway.agenttrust.io",
})

res, err := client.Authorize(ctx, agenttrust.AuthorizationRequest{
    Action:   "cloud:instance:terminate",
    Resource: "i-098234abcdef",
})

4. Rust (sdk-rust)

use agenttrust_sdk::AgentTrustClient;

let client = AgentTrustClient::new("at_live_8f3a9e...", "https://gateway.agenttrust.io");
let decision = client.authorize_tool("system:exec_bash", "server:root").await?;

Enterprise Defense Assurances: Scoping, Cognitive Audit & Continuous Runtime Visibility

AgentTrust implements three critical guarantees that distinguish autonomous zero-trust gateways from naive reverse proxies:

1. Action-Specific & Verb Scoping (Beyond Binary Allow/Deny)

Prevents CWE-863 (Broken Authorization). Rather than coarse Allow or Deny on an entire resource, AgentTrust performs syntactic AST/verb extraction across SQL, REST, and Cloud APIs. - Example: An agent scoped with database:orders:SELECT is allowed to execute SELECT * FROM orders WHERE status = 'pending', but is strictly rejected with SCOPE_VIOLATION if it attempts DROP TABLE orders or `UPDAT

... (truncated at the site's per-page length limit; see the source link below for the full text.)