Log inSubmit server
AgentAvow logo

AgentAvow

by AgentAvow

Scans MCP servers, packages, tools, and skills for signed trust scores, offline-verifiable attestations, and CI gating.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install AgentAvow

Pick your client, then add it in one click or paste the config.

STDIOPython
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "agentavow-agentavow": {
      "command": "uvx",
      "args": [
        "agentavow-trust"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

We couldn’t confirm it starts correctly

The install command started, but didn't respond the way we expected when we tried to talk to it.

uvx agentavow-trust

initialize succeeded but no response to tools/list.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked 13d ago.

Overview

AgentAvow/AgentAvow exposes read-only MCP tools for evaluating whether tools, MCP servers, packages, and skills are safe for an AI agent to connect to. Scans return a verdict, reason, 0–100 trust score, adoption score, category findings, and a signed attestation that can be verified offline. The hosted endpoint uses unauthenticated Streamable HTTP, while the `agentavow-trust` package provides a local installation. Reach for it when agent connections need preflight checks, change monitoring, or automated blocking in CI.

Use cases

  • Scan an MCP server before adding it to an agent
  • Block CI merges when a dependency receives a Do not connect verdict
  • Verify trust attestations offline in a gateway
  • Monitor tool definitions for rug-pull changes

Key features

  • Signed 0–100 trust scores
  • Offline-verifiable Ed25519 attestations
  • Five-category security findings
  • Adoption scores based on usage signals
  • Tool-definition change alerts
  • Read-only MCP access over Streamable HTTP

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 3d ago

Recent health check succeeded.

6/6 checks healthy over the last 24d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 6d ago via OSV.dev · agentavow-trust (PyPI)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars5Stargazers on the source repository.
Last commit3d agoMost recent push to the default branch.
Install checkInconclusiveStarted but did not complete the MCP handshake in our test.

How AgentAvow works

What AgentAvow/AgentAvow does

AgentAvow evaluates software and agent-facing resources before an AI agent connects to them. It accepts GitHub repositories, MCP servers, npm packages, PyPI packages, OpenClaw skills, and wallet addresses that resolve to one of those resources. Each scan produces one of three decisions: Safe to connect, Review before you connect, or Do not connect.

The result includes a trust score from 0 to 100, a separate adoption score, and the reason for the verdict. Trust is broken down across secret hygiene, code safety, data handling, filesystem access, and dependency health. Individual findings include severity and a reference to the relevant source line or manifest entry.

How it works

The hosted MCP endpoint is available at https://agentavow.com/mcp over Streamable HTTP. It is read-only and does not require authentication. Results are cached for one hour; a forced scan can bypass that cache with force=true.

Each result includes a JWS attestation using Ed25519 signatures and RFC 7515 EdDSA. The verdict is canonicalized with RFC 8785 JCS, allowing consumers to recompute the score and verify the signature offline against the published JWKS. Trust tiers map scores to recommended execution limits, including request rates, token budgets, and confirmation prompts.

Setup and configuration

For a hosted connection, configure an MCP client with the remote URL. Cursor and VS Code provide one-click installation links, and both also support manual MCP configuration. Claude web or desktop can add AgentAvow through its connector directory; Claude Code can connect with claude mcp add --transport http agentavow https://agentavow.com/mcp.

The local connector is installed with:

Terminal
pip install agentavow-trust

The repository also supports Docker Compose and local development. Self-hosting uses Python 3.11 or newer, Node.js 20 or newer, PostgreSQL 16, and Redis 7. Docker Compose starts the backend, frontend, PostgreSQL, and Redis services, with database migrations applied during startup.

Tools and capabilities

  • Scan repositories, MCP servers, packages, and skills before connection.
  • Return trust verdicts, scores, adoption data, tiers, and detailed findings.
  • Provide signed attestations for offline verification.
  • Watch resources for score changes and signed tool-definition changes.
  • Expose a trust badge for repository documentation.
  • Gate GitHub, GitLab, Bitbucket, Azure Pipelines, or local builds when a scan returns Do not connect.

The Claude Code plugin adds a /scan command, a skill for checking servers or packages before installation, a SessionStart check for configured MCP servers, and a PreToolUse gate based on the stored result. Its checks are warn-only and fail-open at session start, while tool calls can be denied when the result is Do not connect or confirmation is needed after a tool-definition change.

Limitations and notes

The hosted service scans anonymously and exposes read-only operations. Its plugin skips localhost and private-network servers during its automatic checks, avoids sending URLs whose paths appear to contain secrets, and removes credentials and query strings before sending a URL for scanning. Private repository scans can use a GitHub token supplied transiently; the token is not persisted or added to the public catalog.

The public catalog contains launch data and community-triggered scans. Watch alerts depend on rescanning and compare signed tool-definition digests to detect changes that may otherwise go unnoticed.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about AgentAvow

AgentAvow/AgentAvow is an MCP server that connects AI clients to AgentAvow’s trust-scanning service. Its read-only tools scan MCP servers, tools, packages, and skills, then return safety verdicts, trust and adoption scores, findings, and signed attestations that can be verified offline before an agent connects.

Install the local connector with `pip install agentavow-trust`, or connect an MCP client to `https://agentavow.com/mcp` without installing anything. Claude Code can use `claude mcp add --transport http agentavow https://agentavow.com/mcp`; Cursor and VS Code support one-click or manual configuration.

Yes, AgentAvow/AgentAvow works with Cursor through its remote Streamable HTTP endpoint. Add the server with the provided Cursor deep link or place a server entry using `https://agentavow.com/mcp` in `~/.cursor/mcp.json` or a project-level `.cursor/mcp.json`.

Yes, AgentAvow/AgentAvow can fail builds when a scan returns `Do not connect`. The repository provides a GitHub Action, GitLab CI component, Bitbucket Pipe, Azure Pipelines template, and local CLI integration, using the `fail_on: do_not_connect` policy.

Yes, each result includes a signed JWS attestation that can be recomputed and checked offline. AgentAvow uses Ed25519 EdDSA signatures and RFC 8785 canonicalization; verification uses the public JWKS published at `agentgraph.co/.well-known/jwks.json`.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewAgentAvow AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/agentavow-agentavow?style=directory)](https://allmcps.com/mcp/agentavow-agentavow)
HTML Embed
<a href="https://allmcps.com/mcp/agentavow-agentavow"><img src="https://allmcps.com/api/badge/agentavow-agentavow?style=directory" alt="AgentAvow on AllMCPs" /></a>