Nobulex README

Every person has a credit score. Every business has one. AI agents have nothing.

Nobulex is the credit and trust protocol for autonomous AI agents.
Agents earn trust score through verified behavior. Higher trust, more access.
Autonomy earned, not granted.

Website · Try it live · Quickstart · Spec · PyPI · npm

_{Reference implementation of the OWASP Agentic Skills Top 10 (AST09) execution-receipt pattern · listed in the OWASP solutions catalog · in the Microsoft Agent Governance Toolkit adopters · merged to the Dify marketplace}

pip install nobulex

npm install @nobulex/core

from nobulex.agent import Agent
agent = Agent("my-agent")
receipt = agent.act("send_email", scope="user@example.com")
assert receipt.verify()  # signature valid, chain unbroken

generated 3 receipts
  allow: 141ca2947a7e819b8bdebbf8... verified=True
  allow: f3377758ac94d812535cbb99... verified=True
  deny:  85b2dfd6b87f2678795726e4... verified=True
trust score: 23.26

tamper test:
  modified receipt verified=False   (tamper detected)

pip install nobulex

from nobulex import track

@track(agent_id="my-agent")
def send_email(to, subject, body):
    # your existing code, unchanged
    return smtp.send(to, subject, body)

# Every call now produces a signed receipt automatically
send_email("user@example.com", "Hello", "Report attached")

# Success = receipt. Exception = DENY receipt. Trust score accumulates.
print(send_email.receipts)     # signed, tamper-evident
print(send_email.trust_score)  # earned over time

from nobulex import Agent

agent = Agent("my-agent")
receipt = agent.act("send_email", scope="user@example.com")
assert receipt.verify()       # any third party can check
print(agent.trust_score)      # builds with every action

from nobulex.integrations.langchain import NobulexAuditHandler

handler = NobulexAuditHandler(agent_id="my-agent")
agent.invoke({"input": "..."}, config={"callbacks": [handler]})
handler.export("audit.json")  # signed, hash-chained audit trail

from nobulex.integrations.crewai import NobulexCrewAudit

audit = NobulexCrewAudit(agent_id="my-crew")
audit.record_task("credit_check", "loan-app-4821")
audit.export("audit.json")

from nobulex.integrations.google_adk import NobulexADKCallback

cb = NobulexADKCallback(agent_id="my-agent")

@cb.wrap_tool("web_search")
def search(query):
    return do_search(query)

cb.export("audit.json")

from nobulex.integrations.pydantic_ai import NobulexPydanticAIAudit

audit = NobulexPydanticAIAudit(agent_id="typed-agent")
audit.record_tool("get_weather", {"city": "Berlin"}, {"temp": 22})
audit.export("audit.json")

from nobulex.integrations.haystack import NobulexHaystackAudit

audit = NobulexHaystackAudit(agent_id="my-pipeline")
audit.record_component("Retriever", {"query": "test"}, {"docs": 5})
audit.export("audit.json")

from nobulex.integrations.llama_index import NobulexLlamaIndexAudit

audit = NobulexLlamaIndexAudit(agent_id="llama-agent")
audit.record_tool("web_search", {"query": "test"}, {"results": 5})
audit.export("audit.json")

from nobulex.chain import verify_audit_trail
report = verify_audit_trail("audit.json", authorized_keys=AGENT_PUBLIC_KEY)
assert report["chain_intact"] and report["authenticated"]

npm install @nobulex/core
npx tsx examples/trust-capital-demo.ts

Agent starts at RESTRICTED tier (trust score: 0)

Action 1: read_data        - ALLOWED   (trust score: 12)
Action 2: read_data        - ALLOWED   (trust score: 24)
Action 3: process_payment  - BLOCKED   (insufficient trust)
Action 4: read_data        - ALLOWED   (trust score: 36)
Action 5: read_data        - ALLOWED   (trust score: 48)

Agent promoted to STANDARD tier
Action 6: process_payment  - ALLOWED   (trust score: 65)

Agent promoted to TRUSTED tier (trust score: 89)
Action 8: approve_contract  - ALLOWED

from nobulex import Agent, OperatorRegistry, VerificationLevel

registry = OperatorRegistry()
registry.register("acme", "Acme Corporation", VerificationLevel.KYB)
registry.bind_agent("acme", agent.public_key)

# The question a relying party actually asks:
registry.is_accountable(agent.public_key, VerificationLevel.KYB)  # True
registry.operator_for(agent.public_key).legal_name                # "Acme Corporation"

python packages/python/examples/sybil_resistance.py

DECLARE ──► ENFORCE ──► PROVE ──► ACCUMULATE

Covenant      Pre-execution     Receipt chain     trust score
defines       receipt blocks    verified by       earned over
the rules     violations        third parties     time
              before they
              happen                              ──► more access
                                                      ──► more receipts
                                                           ──► higher trust

import { createDID, parseSource, EnforcementMiddleware, verify } from '@nobulex/core';

const agent = await createDID();
const spec = parseSource(`
  covenant SafeTrader {
    permit read;
    permit transfer (amount <= 500);
    forbid transfer (amount > 500);
    forbid delete;
  }
`);

const mw = new EnforcementMiddleware({ agentDid: agent.did, spec });

await mw.execute(
  { action: 'transfer', params: { amount: 300 } },  // allowed
  async () => ({ success: true }),
);

await mw.execute(
  { action: 'transfer', params: { amount: 600 } },  // BLOCKED before execution
  async () => ({ success: true }),                    // never runs
);

const result = verify(spec, mw.getLog());
console.log(result.compliant);   // true

from nobulex.agent import Agent

agent = Agent("billing-bot")
receipt = agent.act("charge", scope="invoice:042")
assert receipt.verify()   # recomputes action_ref + checks the Ed25519 signature, offline

git clone https://github.com/arian-gogani/nobulex.git
cd nobulex && npm install
npx vitest run              # tests
npx tsx examples/demo.ts    # end-to-end
npx tsx benchmarks/bench.ts # benchmarks

Website · Try it · npm · Spec · X @nobulexlabs

Curated resource: Awesome AI Agent Accountability: standards, regulations, and tools for verifiable agent behavior.

Star this repo to follow the project

MIT License