Submit a server. We run it. You get a Trust Receipt.
Commit in, signed verdict out. The Gate clears your agent before it ships. The Runtime keeps it boxed after. One sealed box, every agent protocol. Back to the overview →
Send a manifest and a container image. No shell access, nothing trusted by default. The same path works for MCP servers, A2A agents, and agent skills.
We boot the real server in an isolated sealed box and record everything it reads, writes, and reaches out to.
We seal the run into a signed bundle your CI reads directly. Re-verify it offline, on any machine, and get the same answer.
Runs in parallel on instant copy-on-write clones, and only on the agents that changed, so it never bottlenecks your build.
We produce the evidence and never certify a server “safe.” Re-verify the bundle yourself → What PASS / DEGRADED / FAIL mean →
You don't write the exploits. Probity drives your server with its own adversarial corpus and watches how it responds.
SAFE-MCP is a public catalog of known MCP attack techniques.
You decide what counts. Allowlist the files and hosts your agent legitimately uses and choose which severities block. Deterministic verdicts mean no finding on one run and not the next.
One box, two modes: check it, then run it.
Everything above is the Gate — a one-time check before an agent ships. Keep the same sealed box on in production and it becomes the Runtime.
Check it before it ships.
Boot the agent in a sealed box, throw the pinned attack corpus at it, and get a signed pass/fail in CI. Fail blocks the merge; pass hands you a Trust Receipt you re-verify yourself.
Keep it boxed in production.
Run your live agent inside the same box, permanently. Every action is gated against the policy you set, signed into a streaming Trust Receipt, and frozen the instant it steps out of bounds.
The new standards that let agents plug into outside tools, hand work to other agents, and load packaged skills.
Each one is code nobody security-checked — pulled in or built fast — and it only misbehaves when it actually runs, exactly what source scanners can't see. Probity runs all three through the same sealed box.
The same box and signature scheme run all three surfaces — MCP servers, A2A agents, and agent skills. Every Trust Receipt is a real Ed25519 signature you re-verify yourself, offline.
We assume the worst case, then bound it.
A checklist of known attacks ages the day it ships. We model the whole state space an agent can reach with the permissions you gave it, design for the worst move in that space — and then prove containment held for the ones we threw.
The question is not “is this agent malicious?” but “what can it reach, and can we contain the worst thing it could do with that reach?”
Every new protocol — MCP, A2A, agent skills — widens the state space. One sealed box bounds all of them the same way, so the threat model doesn't fork per protocol.
A PASS proves the attacks we ran were contained — not that the state space is empty. We state the coverage and never imply completeness we can't prove.
One sealed box gates every agent protocol.
Probity doesn't model a protocol — it models what an agent can actually do. Every protocol runs through the same sealed box — the substrate — and comes out with the same signed verdict, so adding a new one is a drop-in, never a rewrite.
Three signed receipts, one from each protocol surface, converge through one capability model into one sealed box, and come out in one byte-identical signed format that can be re-verified below.
- predicateType
- …/attestation/adversarial-execution-evidence/v0.7
- signing key
- ed25519 427a109244…89e57a86
- payloadType
- application/vnd.in-toto+json
- predicateType
- …/attestation/adversarial-execution-evidence/v0.7
- signing key
- ed25519 427a109244…89e57a86
- payloadType
- application/vnd.in-toto+json
AWS gives agents the road. Probity is the armored car. We sit between cloud infrastructure and the agents it carries, verifying and signing every integration regardless of where it runs.
A green check is bounded — here is exactly by what.
The whole moat is that our green means something, so we are precise about what it means: a Trust Receipt proves exactly what was tested and what happened, never a promise the agent is “safe” in the world.
- The record wasn't tampered with — you re-check it with only a public key.
- These behaviours did or didn't happen, under these exact conditions.
- No real secret left the box, and where the agent was allowed to connect.
- The run was reproducible — the same bytes verify on any host.
- That the agent is safe against an attack we didn't throw.
- That a PASS means “safe in the world” — it means contained under this corpus.
- Anything about inputs, tools, or conditions outside the tested set.
A PASS is bounded by the attacks we threw — it can still miss one we didn't. And when a check can't even run, we report incomplete rather than fake a green.
- FAILA blocking-tier attack got through; the build stops. Some row's containment was a caught label, a label outside the carried vocabulary, or a missing or unrecognized basis or method — fail-closed, never silently dropped.
- DEGRADEDIt ran and held, but a check couldn't complete. Coverage was incomplete — something was out of scope or routed elsewhere. We report incomplete rather than fake a green.
- PASS · INDIRECTPassed, but at least one clean result rests on indirect evidence. A clean row declared a basis other than the substrate (the artifact's own account of itself) or a method other than intercepted (reconstructed after the fact, not caught live).
- PASSNo findings at the severities your policy blocks. Every clean row rested on a direct, live interception at the substrate. It proves what we tested, not that the agent is “safe.”
See it run on your own agent.
Request access to the Gate, put a real agent through it, and get back a signed Trust Receipt you re-verify yourself.