Identity isn't safety: the third axis of agent security

Anthropic's CEO recently described the AI backlash as, more than anything, a crisis of trust. I think that's the right diagnosis. But it has a consequence the industry is mostly avoiding: you cannot solve a trust crisis by asking people to trust you more.

Look at where the money is going. F5 and Skyfire are verifying agent identity for checkout. Incode and Prove are issuing signed agent credentials and co-signing transactions. All of it is real, and all of it answers the same question: who is this agent, and can it act?

That question matters. It's also not the whole problem.

A verified agent can still call a poisoned tool

Give an agent a perfect identity token and full authorization. It can still connect to an MCP server that reads its environment on the first call and ships the token to an attacker. Identity tells you who is knocking. Authorization tells you what they're allowed to do. Neither tells you whether the thing the agent is about to touch — a tool, an MCP server, a package, a skill — is safe.

There are three axes here, not two:

1. Identity — who is the agent?
2. Authorization — what may it do?
3. Tool-safety — is the thing it's connecting to safe?

The industry has poured resources into the first two and left the third mostly open. That's the gap.

Why "we checked it" isn't enough

The obvious fix is a directory or a vendor that says "we scanned it, it's fine." But that's just a new party asking for your trust — the exact move a trust crisis makes worthless. If the answer to "is this safe?" is a number you can't inspect, you haven't closed the trust gap, you've relocated it.

The only durable answer is proof you can check yourself.

What that looks like

That's the thing we build. Point AgentAvow at any MCP server, npm or PyPI package, or tool an agent connects to, and you get:

• a 0-100 trust score across 12 safety categories,
• per-finding detail down to the exact file and line, and
• a signed attestation you can recompute offline against our public keys.

Don't trust the score — recompute it. If a single byte changed, the signature fails. The score is the product; the signature is the proof underneath it, and it doesn't depend on us being online or honest.

Verifiable beats trustworthy, because verifiable doesn't require faith. In a trust crisis, that's the only footing left to build on.

Scan a tool, free and with no account: agentavow.com/check