agentrust.io
Runnable demos

Don't take the spec
on trust. Run it.

Ten demos, about thirteen minutes end to end. Four cover custody of model weights. Five govern what an agent does at the tool boundary. One governs model calls through an OpenAI-compatible endpoint.

Software mode · CMCP_DEV_MODE=1 · no special hardware
Quick start

Clone it and run all ten

No confidential-computing hardware, no cloud account, no signup. Everything runs in software mode.

Terminal
git clone https://github.com/agentrust-io/demos && cd demos
pip install -r requirements.txt
python demo.py            # all ten, pausing before each
python demo.py --no-pause # straight through, no prompts
python demo.py 6          # just demo 6

The requirements install cMCP for demos 1 to 5, Weight Custody Manifest for demos 6 to 9, and the OpenAI client for demo 10. demo.py sets dev mode and the bearer token for you, so there is nothing to export. Source: github.com/agentrust-io/demos.

What demo 6 actually prints, verbatim from a run on weight-custody-manifest 0.25.0

python demo-06-weight-custody/run.py
Weight Custody Manifest: possession is not provenance.
Real WCM code with a software (mock) attestation provider, no hardware.
1. The builder signs a manifest binding the exact weight hash
weights_hash bound : sha256:99b3e4e724d0aa75528b5b2214…
manifest signature : True (jointly signed builder + custodian)
2. Attestation gate: the key releases only into the certified stack
gate released key  : True
3. A tampered checkpoint fails before it ever loads
certified hash     : sha256:99b3e4e724d0aa75528b5b2214…
downloaded hash    : sha256:b3a36b547da3babd1dc9f2b900…
matches manifest   : False -> REFUSE to load
no human reads 2.8T parameters; the hash does the reading.
4. The fine-tune is the real IP: lineage back to the signed base
lineage verified   : True  depth 1  root is a base: True
honest scope       : accountability-grade against an operator who physically
                      owns the silicon (see TEE.fail), not silicon-proof custody.

Hashes are truncated here for width; the run prints them in full. Every demo ends with a scope statement like that last one.

Model weights

Securing model weights

A fine-tune trained on your own data is IP that never existed publicly, and the weights are where it lives. These four demos treat the weights as the asset: bind the exact checkpoint, release the decryption key only into a serving stack that proves what it is, and keep the lineage of every derivative verifiable back to its base.

The honest limit, stated up front. Against an adversary who physically owns the silicon, no current confidential-computing platform is custody-grade. TEE.fail and BadRAM are the reason. What these demos give you is accountability-grade custody under an operator-trust model, plus a threshold scheme (demo 9) for when one operator's word is not enough. Anyone selling you weight protection "without operator trust assumptions" is overstating what the hardware does.

Demo 6 Weight custody ~60 seconds

A Weight Custody Manifest binds the checkpoint's exact weights_hash, gates the decryption key behind attestation, and carries the fine-tune's lineage.

  • a manifest jointly signed by builder and custodian binds the exact weights_hash, and the signature verifies
  • the attestation gate releases the key only for the certified serving stack: genuine nonce, approved platform, signed image measurement
  • a tampered checkpoint's hash does not match, so it is refused before it ever loads
  • a fine-tune verifies as a derivative back to the signed base
python demo-06-weight-custody/run.py
Demo 7 Closed-weight custody ~60 seconds

The mirror of demo 6. Here the base model is closed, a frontier lab shipping weights into a customer's or a sovereign's own enclave, so the weights themselves are the secret and the job is keeping the key off the operator.

  • a manifest with base_confidentiality: confidential, jointly signed by lab and customer
  • the key releases only into the attested, lab-signed serving stack
  • an unapproved stack, one that could export plaintext weights, is refused the key
  • same protocol as demo 6, different job
python demo-07-closed-weight/run.py
Demo 8 Derivative lineage ~60 seconds

Fine-tune inside the enclave on private data and the result is novel IP. It gets its own signed manifest with a derived_from pointer and a rights_holder split.

  • a base permitting fine-tune-only, and a derivative permitting none
  • verify_lineage resolves the derivative back to the base: chain, depth, root
  • the rights_holder records the base and derivative IP split
  • rights are monotone, so a fork of the no-derivatives derivative is rejected
python demo-08-derivative-lineage/run.py
Demo 9 Sovereign threshold ~90 seconds

This is the answer to the limit in the callout above. If a hardware owner who forges one attestation could release a key, then never let one release be enough.

  • the model key is split 2-of-3 across the lab, the sovereign authority, and the customer
  • a single share reconstructs nothing, so one forged attestation sits below threshold
  • two independent shareholders each attest and release their share
  • forging now means forging attestation to a quorum of independent roots, not one
python demo-09-sovereign-threshold/run.py
Agent governance

Governing what an agent does

Demos 6 to 9 protect the weights. These six put the policy at the boundary the agent has to cross: five at the tool call, and demo 10 at the model call. What is it allowed to invoke, under which workflow, with what compliance attributes, and what evidence survives afterwards. Cedar is enforced on every call and each session closes with a signed TRACE claim.

Demo 1 cMCP in action ~90 seconds

An agent calls three tools through the cMCP gateway. Cedar is enforced on every call, and the session closes with a signed TRACE claim carrying the policy bundle hash.

  • write_file and read_file allowed, real files written to workspace/
  • list_dir denied by policy: HTTP 403, POLICY_DENY
  • the claim carries runtime.platform, runtime.measurement, policy.bundle_hash
  • on real Intel TDX the bundle hash flows into RTMR[2] at startup
python demo-01-cmcp-in-action/run.py
Demo 2 Policy swap is an attestation failure ~90 seconds

The operator quietly loads a different policy bundle. The claim's hash changes, and a verifier pinned to the old hash rejects it.

  • v1 and v2 bundle hashes printed, visibly different
  • write_file now denied under v2
  • verifying a v2 claim against the pinned v1 hash fails with POLICY_HASH_MISMATCH
  • on real TDX the measurement itself changes, not just a field
python demo-02-policy-swap/run.py
Demo 3 Offline TRACE verification ~60 seconds

Verify the signed claim with no gateway, no server, and no network call at all.

  • schema, signature, policy hash, catalog hash and audit chain all check out
  • hardware_attestation stays in unverified_fields in software mode, so the status reads partially_verified
  • on real TDX that field verifies too and the status becomes verified
  • no connection is made to anything
python demo-03-offline-trace/run.py
Demo 4 Context-aware enforcement ~90 seconds

The same tool, the same arguments, allowed in one workflow and denied in another. Authorization tracks the declared call context, not the tool's name and not the model's stated intent.

  • write_file under workflow_id="invoice-run": allowed
  • the identical call under workflow_id="chat-freeform": denied, default-deny holds
  • read_file still allowed in both, so only the write capability is scoped
  • both the allow and the deny land in the signed audit chain
python demo-04-context-enforcement/run.py
Demo 5 Attribute-based enforcement ~90 seconds

Deny on the tool's compliance attributes rather than its name. A tool that is not BAA-covered is refused by one guardrail rule, whatever it is called.

  • tools tagged compliance_domain=clinical, baa_covered=true: allowed
  • a tool tagged baa_covered=false: denied
  • the deny comes from forbid ... when { context.baa_covered == false }, overriding the baseline permit
  • one rule covers every non-covered tool in the catalog, present and future
python demo-05-compliance-domain/run.py
Demo 10 Governed model calls ~90 seconds

Put policy in front of an OpenAI-compatible model endpoint and route each request according to its data class.

  • public prompts can use the shared model route
  • PII leaves only after identifiers are stripped
  • confidential and PHI prompts stay on approved regional infrastructure
  • the same governance boundary applies to model calls, not only MCP tools
python demo-10-model-gateway/run.py
Keep going

Where to go next

Clone the demos Write the policy yourself