AskCarX

AgenticSearch is a search engine for AI agents. Not ranked by links. Ranked by cryptographic trust.

  Every result carries dual ECDSA P-256 signatures. Agents search for capabilities, not web pages. Sources without cryptographic identity score zero.                                 
                                                                                                                                                                                      
  https://agentsearch.cybersecai.co.uk                                                                                                                                                
                                                                                                                                                                                      
  Raza Sharif, CyberSecAI Ltd – [email protected]

ATTP is a synchronous request-response protocol for AI agents calling web APIs. Runs over HTTP with mandatory ECDSA P-256 signing, agent identity passports, trust-gated access (L0-L4), and built-in audit trails. No insecure mode.

  npm install @proofxhq/attp -- zero deps. One line server middleware: app.use(attp.verify()). One line client: attp.fetch('attp://api.example.com/v1/data').                         
                                                               
  IETF Internet-Draft submitted: https://datatracker.ietf.org/doc/draft-sharif-attp-agent-trust-transport/                                                                            
                                                               
  Part of 6 IETF drafts covering agent security. OWASP MCP Security Cheat Sheet aligned. OpenAPI extension registered.

I built a deliberately vulnerable MCP (Model Context Protocol) server for security testing and scanner validation. 10 intentional vulnerabilities covering the OWASP MCP Top 10 -- auth bypass, command injection, SSRF, tool definition tampering, unsigned messages, and more.

One-click scan runs 12 tests in your browser with remediation guidance. Docker image available for local testing: docker pull razas/dvmcp

https://cheatsheetseries.owasp.org/cheatsheets/MCP_Security_...

Source: https://github.com/razashariff/dvmcp

Thanks for flagging the email issue -- DNS MX records are being configured now. In the meantime, reach us at [email protected] (that one works) or [email protected] directly.

On your points about env injection and lazy-loaded modules bypassing on-disk hash: you're right that static file hashing alone doesn't cover runtime context manipulation. Our attestation checks the registered code artifact, but a production deployment would need runtime sandboxing (process isolation, restricted imports) as a complementary layer. AgentSign handles identity and trust -- sandboxing is the execution environment's job.

On trust score elevation attacks (benign buildup, then exploit): the trust score factors in execution verification rate and success rate continuously, not just cumulatively. A sudden behavioral shift (failed attestations, anomalous outputs) drops the score dynamically. But you're right that a slow, careful escalation is the harder case. That's where the MCP gate's per-request verification adds defense in depth -- even a high-trust agent gets checked every single call.

Interested in the adversarial run. Let's connect -- [email protected].

This is interesting but the big question nobody's asking: how do you trust the agents NemoClaw deploys?

Nvidia is solving agent deployment and orchestration. But once you have thousands of enterprise agents running autonomously -- making API calls, accessing data, executing code -- who verifies their identity? How do you prove what an agent did? How do you revoke a compromised one instantly?

We built AgentSign for exactly this layer. Cryptographic identity for every agent, signed execution chains, runtime attestation before anything runs. Think of it as the identity infrastructure underneath platforms like NemoClaw.

Deployment without trust verification is how you get another Moltbook situation (went viral for fake agent posts, Meta just acquired it).

https://github.com/razashariff/agentsign

Hi there. The irony here is pretty clear -- Meta acquired an agent social network that went viral specifically because agents were posting fake content. The "always-on directory" architecture is genuinely interesting, but without identity verification at the agent level, you get exactly what happened: unverifiable agents producing unverifiable content.

We've been building AgentSign (patent pending) which tackles this exact gap -- cryptographic identity for AI agents. Every agent gets an identity certificate, every action gets signed into an execution chain, and there's runtime code attestation before anything executes. Think zero trust but for agents, not humans.

The real question isn't whether agent networks will exist (clearly they will, Meta just paid for one). It's whether we'll let them run without any trust infrastructure underneath. Moltbook without trust verification = fake posts. Agent networks with cryptographic identity = agents you can actually hold accountable.

SDK: https://github.com/razashariff/agentsign-sdk

API: https://github.com/razashariff/agentsign

Hi there — you're raising the right questions and these are exactly the attack vectors I built AgentSign to handle. It's not just signing.

AgentSign has 5 subsystems (patent pending) and two of them directly address what you're describing:

Compromised agent scenario: Subsystem 3 is Runtime Code Attestation. Before every execution, the agent's code is SHA-256 hashed and compared against the attested hash from onboarding. If agent A gets injected via a malicious document and its runtime is modified, the hash comparison fails and execution is blocked. This isn't a one-time check at onboarding — it runs continuously, pre-execution. A compromised agent can't sign anything because it fails attestation before it gets to sign.

Replay attacks: Subsystem 2 is Execution Chain Verification — a signed DAG of input/output hashes with unique execution IDs and timestamps bound to each interaction. Replaying a signed payload triggers an execution ID collision. Every agent-to-agent call is a unique, signed, timestamped link in the chain.

Trust delegation: AgentSign deliberately has no delegation mechanism. Each agent presents its own passport independently at the verification gate (we call it THE GATE — POST /api/mcp/verify). There's no "agent A vouches for agent B." Every agent is verified on its own identity, its own code attestation, its own trust score. If an attacker controls agent B, they still need B to pass runtime attestation independently — which it won't if the code has been tampered with.

Behavioral integrity: Subsystem 5 is Cryptographic Trust Scoring. It's not static — it factors in execution verification rate, success history, code attestation status, and pipeline stage. An agent that starts producing anomalous outputs drops in trust score dynamically and gets flagged. Identity without behavioral integrity is exactly the gap trust scoring fills.

The five subsystems working together: identity certs, execution chains, runtime attestation, output tamper detection, and trust scoring. Remove any one and you have the gaps you're describing. Together they close them.

That said — I'd genuinely welcome your findings. Red-teaming is how this gets battle-hardened. You can reach me at [email protected] or check the SDK at github.com/razashariff/agentsign-sdk.

To add some context on why this matters now -- I audited the 12 most popular agent frameworks and found none of them have agent identity, cryptographic signing, or trust scoring:

AutoGPT (182K stars) -- no identity LangChain (100K+) -- no identity MCP ecosystem (80K+ stars) -- no identity (a scan of 2,000 MCP servers found ALL lacking authentication) OpenHands (64K) -- no identity AutoGen (50K) -- no identity (Entra ID for users, not agents) CrewAI (45K) -- RBAC for configs, not agents smolagents (25K) -- sandboxing only OpenAI Agents SDK (19K) -- "does not natively provide security" NeMo Guardrails (5.7K) -- content safety only, not identity

AWS Bedrock and Google Vertex have the most mature security -- but it's IAM-based and cloud-locked. No portable agent identity.

That's 600K+ GitHub stars of agent frameworks where agents have zero cryptographic identity. Okta found 91% of orgs use agents but less than 10% have a strategy to secure them.

AgentSign fills this specific gap: not what agents can do (guardrails handle that), but who agents are + what they did + cryptographic proof.

Hi HN, I built AgentSign because AI agents are now autonomous — they call APIs, access databases, execute code, and spend money. But there's no standard way to verify WHO an agent is, WHAT it did, or revoke it when things go wrong.

AgentSign is a zero trust engine for AI agents. The core idea:

1. Every agent gets a cryptographic passport (self-contained signed JSON, works offline) 2. Every execution is signed into a tamper-proof chain 3. MCP servers verify agent identity before granting tool access 4. Trust scores (0-100) based on actual behavior, not just permissions 5. Revoke a single agent or an entire swarm instantly

The "MCP Trust Layer" is the key feature — it sits between agents and MCP tool servers. Before an agent can use any tool, it presents its passport. AgentSign checks identity, trust score, and pipeline stage, then returns ALLOW or DENY. Every interaction is logged.

Technical stack: - Server: FastAPI + SQLite, Docker/Helm, runs entirely on-prem - SDK: `npm install agentsign` (zero runtime deps, Node 18+) - Signing: HMAC-SHA256 default, optional PKCS#11 / AWS KMS / Azure KV / GCP KMS / HashiCorp Vault - Pipeline: INTAKE -> VETTING -> TESTING -> DEV_APPROVED -> PROD_APPROVED -> ACTIVE

Server: https://github.com/razashariff/agentsign SDK: https://github.com/razashariff/agentsign-sdk npm: https://www.npmjs.com/package/agentsign

Happy to answer questions about the architecture or crypto design.