agentrust-io.com trace manifest cmcp ca2a governance agt ↗
Now hiring AgenTrust Fellowship 2026. A six-month paid, part-time programme for three to five fellows working on verifiable AI agent infrastructure. Applications open 1 August and close 29 August 2026; the cohort starts in September. Read the announcement →

Open Standards & Tools

Govern AI Agents
at the Hardware Boundary

New · Hands-on Don't just read the spec: run cMCP yourself. Write a policy, watch it block a data leak, verify a signed receipt. Try cMCP in under 10 minutes →

AgenTrust provides open specifications, test infrastructure, and attestation tooling for organizations deploying AI agents in production, with cryptographic proof of identity, intent, and behavior. It is home to the confidential, security-hardened way to run MCP (cMCP) and the secure profile for agent-to-agent delegation on A2A (cA2A).

Explore TRACE Spec → View on GitHub
Open Specifications
Standards & Protocols
Attestation Standard
TRACE
Trust, Runtime Attestation, and Compliance Evidence. Hardware-rooted cryptographic receipts for every agent action — signed by the TEE, verifiable by anyone.
trace.agentrust-io.com
Live
Identity Standard
Agent Manifest
A structured declaration of an agent's capabilities, permissions, and data access policies. Machine-readable identity that operators and orchestrators can verify before invocation.
manifest.agentrust-io.com
Live
Protocol Extension
Confidential MCP
The confidential, security-hardened way to run the Model Context Protocol. MCP tool calls are evaluated against policy inside a Trusted Execution Environment, so tool-call plaintext is not readable from the host. The guarantee is bounded: it holds where the egress policy denies telemetry endpoints, and it covers the tool boundary, not model inference.
cmcp.agentrust-io.com
Live
Delegation Profile
Confidential A2A
The secure, confidential profile for the Agent2Agent (A2A) protocol. Adds attested, attenuated delegation, a sealed peer channel, and offline-verifiable provenance per hop, so agent-to-agent delegation is verifiable and confidential, not just authenticated at the front door.
ca2a.agentrust-io.com
Live
Curated Resource
Awesome AI Governance
A community-curated list of tools, frameworks, standards, and research for governing autonomous AI agents. Covers policy engines, audit frameworks, risk assessments, and deployment guidance.
governance.agentrust-io.com
Live
Infrastructure
Test Suite & Tooling
Test Infrastructure
TRACE Test Suite
Conformance tests and integration harness for TRACE implementations. Verify that your attestation receipts meet the spec before shipping to production.
tests.agentrust-io.com
OSS
Microsoft Open Source
Agent Governance Toolkit
GitHub Actions, policy checks, and CI integrations for governing agent behavior in software repositories. Contributor reputation, workflow provenance, and supply-chain verification.
github.com/microsoft/agt
External ↗
Source Code
GitHub Organization
All spec source, examples, registry entries, and integration guides. TRACE spec, Agent Manifest schema, cMCP protocol, cA2A profile, and the full awesome-ai-governance curated list.
github.com/agentrust-io
OSS
At a Glance
What's Launched
Attestation Standard
TRACE v0.2
Identity Standard
Agent Manifest spec v0.1
Protocol Extension
cMCP v0.3.0
Delegation Profile
cA2A v0.1 · preview
Launched
June 23, 2026
License
Apache 2.0, MIT, CC BY 4.0
Standardization
CoSAI / AAIF
Get Involved

AgenTrust Fellowship 2026

A six-month paid, part-time fellowship (20 hours per week) for three to five fellows working on open infrastructure for verifiable AI systems. It is aimed at security engineers, distributed systems researchers, AI governance and compliance professionals, and Ph.D. students. Fellows contribute code and specifications across the AgenTrust projects and complete a public technical artifact, such as a paper or a conference talk. Mentored by Imran Siddique, Chief Platform Officer at OPAQUE and creator of the Agent Governance Toolkit.

Applications open 1 August 2026 and close 29 August 2026, with the cohort starting in September. Selection is based on a technical proposal describing what you plan to contribute, so it is worth looking at the work before you apply: issues labelled fellowship across trace-spec, cmcp, cA2A, and agent-manifest are real, currently-open work rather than exercises.

Read the announcement → Browse fellowship issues
Overview
What is AgenTrust?

AgenTrust is a set of open standards, tools, and specifications for governing AI agents at runtime. It gives operators cryptographic proof of an agent's identity, intent, and behavior, so that an agent running in production can be verified independently of the party that deployed it.

Three specifications work together. Agent Manifest establishes who an agent is and what it is allowed to do. Confidential MCP (cMCP) evaluates tool calls against policy inside a Trusted Execution Environment, so tool-call plaintext is not readable from the host. TRACE produces signed receipts that prove what actually happened, hardware-attested when the gateway runs in a TEE. All three are open source, under Apache 2.0 for Agent Manifest, MIT for cMCP, and CC BY 4.0 plus Apache 2.0 for TRACE.

FAQ
Frequently Asked Questions
What is TRACE?
TRACE stands for Trust, Runtime Attestation, and Compliance Evidence. It defines hardware-rooted cryptographic receipts for every agent action, signed by the Trusted Execution Environment and verifiable by anyone.
What is Agent Manifest?
Agent Manifest is a structured, machine-readable declaration of an agent's capabilities, permissions, and data access policies. Operators and orchestrators can verify an agent's manifest before invocation.
What is Confidential MCP (cMCP)?
Confidential MCP is an extension to the Model Context Protocol that runs tool calls inside a Trusted Execution Environment, so the host process cannot read tool-call plaintext from enclave memory. That protection is structural only where the Cedar egress policy denies telemetry and APM endpoints, and it covers the tool-call boundary rather than model inference or the agent's context window.
What is Confidential A2A (cA2A)?
Confidential A2A is a trust profile on the Agent2Agent (A2A) protocol. Where A2A's Signed Agent Card verifies only the domain owner, cA2A adds attested, attenuated delegation, a sealed peer channel that binds the task payload to the peer's attested measurement, and an offline-verifiable provenance record per hop. It is a developer preview.
What is the secure version of MCP?
Confidential MCP (cMCP) is the security-hardened way to run the Model Context Protocol. It executes MCP tool calls inside a Trusted Execution Environment (TEE), so tool-call plaintext is not readable from the host, and it emits a signed TRACE receipt for every call that anyone can verify. Two bounds worth stating: the plaintext guarantee holds where the egress policy denies telemetry and APM endpoints, and the receipt is hardware-attested when the gateway runs in a TEE and signed-only in software mode. If you need a secure or confidential MCP deployment, cMCP is the AgenTrust profile for it.
What is the secure version of A2A?
Confidential A2A (cA2A) is the security profile for the Agent2Agent (A2A) protocol. A2A authenticates a peer's domain but not what it does with a delegated task. cA2A adds attested, attenuated delegation (each hop's authority is a provable subset of its parent's), runtime attestation of the peer, a sealed peer channel, and offline-verifiable provenance, so agent-to-agent delegation is secure and confidential end to end, not just authenticated at the front door.
How do the AgenTrust standards relate to each other?
Agent Manifest covers identity, cMCP covers confidential execution, and TRACE covers verifiable behavior. Manifest says who an agent is and what it may do, cMCP runs its tool calls confidentially, and TRACE produces hardware-signed receipts of what actually happened.
Are the AgenTrust standards open source?
Yes, though not all under one licence. Agent Manifest and the TRACE conformance suite are Apache 2.0, cMCP and cA2A are MIT, and the TRACE specification text is CC BY 4.0 with its reference code under Apache 2.0. Source, schemas, and examples are on GitHub at github.com/agentrust-io.