Skip to content
New kind of attack — caught and fixed before it was publicly known·Read the timeline
How it works

Submit a server. We run it. You get a Trust Receipt.

Commit in, signed verdict out. The Gate clears your agent before it ships. The Runtime keeps it boxed after. One sealed box, every agent protocol. Back to the overview →

01~5s
Submit

Send a manifest and a container image. No shell access, nothing trusted by default. The same path works for MCP servers, A2A agents, and agent skills.

02~75s
Run

We boot the real server in an isolated sealed box and record everything it reads, writes, and reaches out to.

03~10s
Attest

We seal the run into a signed bundle your CI reads directly. Re-verify it offline, on any machine, and get the same answer.

Runs in parallel on instant copy-on-write clones, and only on the agents that changed, so it never bottlenecks your build.

Every Trust Receipt pins
BUILDthe exact build that was tested — nothing swapped before or after
WHAT RANa signed inventory (AIBOM, SPDX 3.0) of the models and code that actually ran
TOOLCHAINthe versions of the box, attack set, and engine that produced the verdict

We produce the evidence and never certify a server “safe.” Re-verify the bundle yourself → What PASS / DEGRADED / FAIL mean →

We bring the attacks

You don't write the exploits. Probity drives your server with its own adversarial corpus and watches how it responds.

30 known CVEsfuzzingSAFE-MCP technique library

SAFE-MCP is a public catalog of known MCP attack techniques.

You set the policy

You decide what counts. Allowlist the files and hosts your agent legitimately uses and choose which severities block. Deterministic verdicts mean no finding on one run and not the next.

The two modes

One box, two modes: check it, then run it.

Everything above is the Gate — a one-time check before an agent ships. Keep the same sealed box on in production and it becomes the Runtime.

the Gate (pre-deploy)

Check it before it ships.

Boot the agent in a sealed box, throw the pinned attack corpus at it, and get a signed pass/fail in CI. Fail blocks the merge; pass hands you a Trust Receipt you re-verify yourself.

the Runtime (always-on)

Keep it boxed in production.

Run your live agent inside the same box, permanently. Every action is gated against the policy you set, signed into a streaming Trust Receipt, and frozen the instant it steps out of bounds.

The same box and signature scheme run all three surfaces — MCP servers, A2A agents, and agent skills. Every Trust Receipt is a real Ed25519 signature you re-verify yourself, offline.

The threat model

We assume the worst case, then bound it.

A checklist of known attacks ages the day it ships. We model the whole state space an agent can reach with the permissions you gave it, design for the worst move in that space — and then prove containment held for the ones we threw.

Assume compromise

The question is not “is this agent malicious?” but “what can it reach, and can we contain the worst thing it could do with that reach?”

One substrate, every surface

Every new protocol — MCP, A2A, agent skills — widens the state space. One sealed box bounds all of them the same way, so the threat model doesn't fork per protocol.

The honest bound

A PASS proves the attacks we ran were contained — not that the state space is empty. We state the coverage and never imply completeness we can't prove.

Protocol-agnostic by architecture

One sealed box gates every agent protocol.

Probity doesn't model a protocol — it models what an agent can actually do. Every protocol runs through the same sealed box — the substrate — and comes out with the same signed verdict, so adding a new one is a drop-in, never a rewrite.

Three signed receipts, one from each protocol surface, converge through one capability model into one sealed box, and come out in one byte-identical signed format that can be re-verified below.

MCPdegraded-demodegraded
sha256 308cc9799cc68b10
A2Aclean-live-agentpass
sha256 fe77bb70f831dd1d
Skillsinvoice-extractorfail · caught
sha256 c62ec29846b1c2d9
next protocol · one new inlet, no rewrite
one capability model
what the agent can do
one sealed box
every protocol, same run
identical bytes in all three bundles · pinned in CI
predicateType
/attestation/adversarial-execution-evidence/v0.7
signing key
ed25519 427a10924489e57a86
payloadType
application/vnd.in-toto+json
verifiedFAIL
the Skills catch above, re-checked
Three real receipts, three different verdicts: a degraded MCP server, a passing A2A agent, and a poisoned demo skill the box caught. Past the junction, protocol identity is gone. What remains is one capability model of what the agent can do, one sealed box, and one signature scheme: the three fields on the right are byte-identical in all three bundles, pinned in CI. See how the box proves it

AWS gives agents the road. Probity is the armored car. We sit between cloud infrastructure and the agents it carries, verifying and signing every integration regardless of where it runs.

What we don't claim

A green check is bounded — here is exactly by what.

The whole moat is that our green means something, so we are precise about what it means: a Trust Receipt proves exactly what was tested and what happened, never a promise the agent is “safe” in the world.

What a Trust Receipt proves
  • The record wasn't tampered with — you re-check it with only a public key.
  • These behaviours did or didn't happen, under these exact conditions.
  • No real secret left the box, and where the agent was allowed to connect.
  • The run was reproducible — the same bytes verify on any host.
What it does not prove
  • That the agent is safe against an attack we didn't throw.
  • That a PASS means “safe in the world” — it means contained under this corpus.
  • Anything about inputs, tools, or conditions outside the tested set.

A PASS is bounded by the attacks we threw — it can still miss one we didn't. And when a check can't even run, we report incomplete rather than fake a green.

The four outcomes
  • FAILA blocking-tier attack got through; the build stops. Some row's containment was a caught label, a label outside the carried vocabulary, or a missing or unrecognized basis or method — fail-closed, never silently dropped.
  • DEGRADEDIt ran and held, but a check couldn't complete. Coverage was incomplete — something was out of scope or routed elsewhere. We report incomplete rather than fake a green.
  • PASS · INDIRECTPassed, but at least one clean result rests on indirect evidence. A clean row declared a basis other than the substrate (the artifact's own account of itself) or a method other than intercepted (reconstructed after the fact, not caught live).
  • PASSNo findings at the severities your policy blocks. Every clean row rested on a direct, live interception at the substrate. It proves what we tested, not that the agent is “safe.”

See it run on your own agent.

Request access to the Gate, put a real agent through it, and get back a signed Trust Receipt you re-verify yourself.

Get access

Run your agents through Probity.

A few details about your setup and we'll get you gating agents fast.