AgentShield - Trust Infrastructure for AI Agents

The trust layer for the agent economy. Like SSL/TLS, but for AI agents.

🔐 Cryptographic Identity - Ed25519 signing keys
🤝 Trust Handshake Protocol - Mutual verification before communication
📋 Public Trust Registry - Reputation scores & track records
✅ 77 Security Tests - Comprehensive vulnerability assessment

🔒 Privacy Disclosure: See PRIVACY.md for detailed data handling information.

---

🎯 The Problem

Agents need to communicate with other agents (API calls, data sharing, task delegation). But how do you know if another agent is trustworthy?

• - Has it been compromised?
• Is it leaking data?
• Can you trust its responses?

Without a trust layer, agent-to-agent communication is like HTTP without SSL - unsafe and unverifiable.

---

💡 The Solution: Trust Infrastructure

AgentShield provides the trust layer for agent-to-agent communication:

1. Cryptographic Identity

• - Ed25519 key pairs - Industry-standard cryptography
• Private keys stay local - Never transmitted
• Public key certificates - Signed by AgentShield

2. Security Audit (77 Tests)

52 Live Attack Vectors: Tests defense against instruction manipulation, encoding schemes, and social engineering across 6 languages. All attack patterns are stored locally in agentshieldattackpatterns.json (not embedded in documentation).

25 Static Security Checks:

• - Input sanitization
• Output DLP (data leak prevention)
• Tool sandboxing
• Secret scanning
• Supply chain security

Result: Security score (0-100) + Tier (VULNERABLE → HARDENED)

Privacy: Tests run 100% locally - only pass/fail scores sent to API (no prompts/responses)

3. Trust Handshake Protocol

Agent A wants to communicate with Agent B:

CODEBLOCK0

What you get:

• - ✅ Mutual verification (both agents are who they claim to be)
• ✅ Shared session key (for encrypted communication)
• ✅ Trust score boost (+5 for successful handshakes)
• ✅ Public track record (handshake history)

4. Public Trust Registry

• - Searchable database of all certified agents
• Reputation scores based on audits, handshakes, and time
• Trust tiers: UNVERIFIED → BASIC → VERIFIED → TRUSTED
• Revocation list (CRL) - Compromised agents get flagged

---

🚀 Quick Start

Install

CODEBLOCK1

Get Certified (77 Security Tests)

CODEBLOCK2

Output:

• - ✅ Agent ID: INLINECODE0
• ✅ Security Score: XX/100
• ✅ Tier: PATTERNS_CLEAN / HARDENED / etc.
• ✅ Certificate (90-day validity)

Verify Another Agent

CODEBLOCK3

Trust Handshake with Another Agent

# Initiate handshake
python3 handshake.py --target agent_yyyyy

# Result: Shared session key for encrypted communication

---

📋 Use Cases

1. Agent-to-Agent API Calls

Before: Agent A calls Agent B's API - no way to verify B's integrity With AgentShield: Agent A checks Agent B's certificate + handshake → Verified communication

2. Multi-Agent Task Delegation

Before: Orchestrator spawns sub-agents - can't verify they're safe With AgentShield: All sub-agents certified → Orchestrator knows they're trusted

3. Agent Marketplaces

Before: Download random agents from the internet - no trust guarantees With AgentShield: Browse Trust Registry → Only hire VERIFIED agents

4. Data Sharing Between Agents

Before: Share sensitive data with another agent - hope it doesn't leak With AgentShield: Handshake → Encrypted session key → Secure data transfer

---

🛡️ Security Architecture

Privacy-First Design

✅ All 77 tests run locally - Your system prompts NEVER leave your device
✅ Private keys stay local - Only public keys transmitted
✅ Human-in-the-Loop - Explicit consent before reading IDENTITY.md/SOUL.md
✅ No environment scanning - Doesn't scan for API tokens

What goes to the server:

• - Public key (Ed25519)
• Agent name & platform
• Test scores (passed/failed summary)

What stays local:

• - Private key
• System prompts
• Configuration files
• Detailed test results

Environment Variables (Optional)

AGENTSHIELD_API=https://agentshield.live  # API endpoint
AGENT_NAME=MyAgent                        # Override auto-detection
OPENCLAW_AGENT_NAME=MyAgent               # OpenClaw standard

---

📊 What You Get

Certificate (90-day validity)

CODEBLOCK6

Trust Registry Entry

• - ✅ Public verification URL: INLINECODE1
• ✅ Trust score (0-100) based on:

- Age (longer = more trust) - Verification count - Handshake success rate - Days active

• - ✅ Tier: UNVERIFIED → BASIC → VERIFIED → TRUSTED

Handshake Proof

{
  "handshake_id": "hs_xxxxx",
  "requester": "agent_A",
  "target": "agent_B",
  "status": "completed",
  "session_key": "...",
  "completed_at": "2026-03-10T20:00:00Z"
}

---

🔧 Scripts Included

Script	Purpose
INLINECODE2	Run 77 security tests & get certified
INLINECODE3

Trust handshake with another agent | | verify_peer.py | Check another agent's certificate | | show_certificate.py | Display your certificate | | agentshield_tester.py | Standalone test suite (advanced) |

---

🌐 API Endpoints

Base URL: INLINECODE7

1. Agent Audit Flow

CODEBLOCK8

2. Certificate Operations

CODEBLOCK9

3. Trust Handshake

CODEBLOCK10

Rate Limits

• - Audits: 1 per hour per IP
• Handshakes: 10 per hour per agent
• Verifications: Unlimited (read-only)

All endpoints require HTTPS. No API keys needed.

---

🌐 Trust Handshake Protocol (Technical)

Flow

1. 1. Initiate: Agent A → Server: "I want to handshake with Agent B"
2. Challenge: Server generates random challenges for both agents
3. Sign: Both agents sign their challenges with private keys
4. Verify: Server verifies signatures with public keys
5. Complete: Server generates shared session key
6. Trust Boost: Both agents +5 trust score

Cryptography

• - Algorithm: Ed25519 (curve25519)
• Key Size: 256-bit
• Signature: Deterministic (same message = same signature)
• Session Key: AES-256 compatible

---

🚀 Roadmap

Current (v1.0.31):

• - ✅ 77 security tests
• ✅ Ed25519 certificates
• ✅ Trust Handshake Protocol
• ✅ Public Trust Registry
• ✅ CRL (Certificate Revocation List)
• ✅ Explicit whitelist sanitization (test IDs only)
• ✅ Dry-run mode for transparency

Coming Soon:

• - ⏳ Auto re-audit (when prompts change)
• ⏳ Negative event reporting
• ⏳ Fleet management (multi-agent dashboard)
• ⏳ Trust badges for messaging platforms

---

📖 Learn More

• - Website: https://agentshield.live
• GitHub: https://github.com/bartelmost/agentshield
• API Docs: https://agentshield.live/docs
• ClawHub: https://clawhub.ai/bartelmost/agentshield

---

🎯 TL;DR

AgentShield is SSL/TLS for AI agents.

Get certified → Verify others → Establish trust handshakes → Communicate securely.

CODEBLOCK11

Building the trust layer for the agent economy. 🛡️

---

🔐 Privacy & Security Guarantees (v1.0.31+)

✅ EXPLICIT WHITELIST (What Gets Sent):

• - Test IDs (e.g. "PI-001", "SS-003")
• Pass/fail boolean per test
• Category names (e.g. "prompt_injection")
• Summary counts (passed/failed/total)
• Agent metadata (name, platform, version)
• Public key (Ed25519, for certificate signing)

❌ NEVER SENT (Explicitly Excluded):

• - ✅ Your system prompt
• ✅ Attack test inputs/payloads (e.g. "ignore previous instructions")
• ✅ Attack test outputs/responses
• ✅ Evidence snippets (base64 matches, pattern findings)
• ✅ Error messages from test execution
• ✅ Tool configurations
• ✅ File paths or workspace structure
• ✅ Private keys (Ed25519, stay local in ~/.agentshield/)

🔍 Code-Level Enforcement:

• - See audit_client.py line 108: _sanitize_test_details() whitelist
• Payloads/responses/evidence explicitly dropped (line 130-136 comments)
• Dry-run mode: --dry-run flag shows exact payload before submission

Verification:
CODEBLOCK12

All code is open-source: github.com/bartelmost/agentshield

---

🔒 Data Transmission Transparency

What Gets Sent to AgentShield API

During Audit Submission:
CODEBLOCK13

What is NOT sent:

• - ❌ Full test output/logs
• ❌ Your prompts or system messages
• ❌ IDENTITY.md or SOUL.md file contents
• ❌ Private keys (stay in ~/.agentshield/agent.key)
• ❌ Workspace files or memory

API Endpoint:

• - Primary: https://agentshield.live/api (proxies to Heroku backend)
• All traffic over HTTPS (TLS 1.2+)

---

🛡️ Consent & Privacy

File Read Consent (v1.0.30+):

1. 1. ✅ Explicit consent prompt BEFORE reading IDENTITY.md/SOUL.md
2. User sees: "🔐 PRIVACY CONSENT - Read IDENTITY.md for agent name? [Y/n]"
3. If declined: Exits with message "Please run with: --name 'YourAgentName'"
4. If approved: Only name/platform extracted (not full file content)

⚠️ Automation Mode (--yes flag) - v1.0.31+:

The --yes flag is designed for CI/CD and pre-audited environments ONLY.

When to use:

• - ✅ Sandboxed test agents (no real secrets)
• ✅ CI/CD pipelines (after manual code review + dry-run)
• ✅ Agents you've already audited manually

When NOT to use:

• - ❌ Production agents with real secrets
• ❌ Agents handling sensitive user data
• ❌ First-time audit (always use manual mode first!)

Why? The --yes flag bypasses ALL consent prompts. While the code includes
explicit sanitization (see audit_client.py line 108+), we recommend:

1. 1. Run --dry-run first to inspect payload
2. Manually review audit_client.py whitelist
3. Only then use --yes for automation

Best Practice:
CODEBLOCK14

Privacy-First Mode:

export AGENTSHIELD_NO_AUTO_DETECT=1
python initiate_audit.py --name "MyBot" --platform "telegram"

→ Zero file reads, manual input only

See PRIVACY.md for complete data handling documentation.