From 088077ca0399790233c31f524d1be62cd852ca4f Mon Sep 17 00:00:00 2001 From: Imran Siddique Date: Mon, 14 Sep 2026 14:48:06 -0700 Subject: [PATCH] feat(site): make /quickstart/ a Get started page for every spec /quickstart/ was the cMCP tutorial, titled "cMCP Quickstart: Block a Tool Call and Verify the Receipt", while the header, footers and 404 page called it the site's "10-minute quickstart". It is now a short Get started page: six cards labelled with the chain steps, each linking to that specification's own start page, and the in-browser TDX check for readers who install nothing. The cMCP tutorial lives in the cMCP docs, so the quickstart CI job and tools/check-quickstart.py go, and the links that meant the tutorial point at cmcp.agentrust-io.com/quickstart/. The menu, footers, 404 page, catalog footer and llms.txt say Get started. The About section of /community/ is removed. It described AgenTrust as an ecosystem for agent governance, omitted WCM, and repeated the homepage chain and /telemetry/. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_013aK3gVWzNdcM3hZ2o2awK2 --- .github/workflows/reader-journey.yml | 11 - 404.html | 4 +- community/index.html | 15 +- demos/index.html | 8 +- extensions/ca2a/v0.1/index.html | 2 +- go/agent-anomaly-detection/index.html | 2 +- go/agent-circuit-breaker/index.html | 2 +- go/agent-identity-credential/index.html | 2 +- go/agent-key-binding/index.html | 2 +- go/agent-purpose-declaration/index.html | 2 +- go/agent-rate-limiting/index.html | 2 +- go/agent-session-revocation/index.html | 2 +- go/agent-state-rollback/index.html | 2 +- go/agent-termination/index.html | 2 +- go/attested-a2a-channel/index.html | 2 +- go/behavioural-baseline/index.html | 2 +- go/blast-radius-containment/index.html | 2 +- go/capability-attenuation/index.html | 2 +- go/capability-manifest/index.html | 2 +- go/context-provenance/index.html | 2 +- go/continuous-usage-control/index.html | 2 +- go/evidence-transparency-anchoring/index.html | 2 +- go/graceful-degradation/index.html | 2 +- go/index.html | 4 +- go/input-schema-validation/index.html | 2 +- go/model-weight-custody/index.html | 2 +- go/output-encoding/index.html | 2 +- go/output-personal-data/index.html | 2 +- go/policy-verdict-rationale/index.html | 2 +- go/prompt-injection-prevention/index.html | 2 +- go/resource-allowlist/index.html | 2 +- go/runtime-attestation-evidence/index.html | 2 +- go/structured-action-logging/index.html | 2 +- go/tool-authorization/index.html | 2 +- go/transaction-limits/index.html | 2 +- go/verifiable-evidence-record/index.html | 2 +- index.html | 6 +- llms.txt | 2 +- marketplace/catalog/index.html | 4 +- marketplace/index.html | 2 +- quickstart/index.html | 380 +++--------------- registry/index.html | 4 +- telemetry/index.html | 4 +- tools/build-controls.py | 2 +- tools/build-discovery.py | 2 +- tools/check-quickstart.py | 49 --- tools/site_header.py | 2 +- verify/index.html | 4 +- 48 files changed, 123 insertions(+), 442 deletions(-) delete mode 100644 tools/check-quickstart.py diff --git a/.github/workflows/reader-journey.yml b/.github/workflows/reader-journey.yml index 94dacf8..2c1bd7d 100644 --- a/.github/workflows/reader-journey.yml +++ b/.github/workflows/reader-journey.yml @@ -20,14 +20,3 @@ jobs: - run: python tools/build-header.py --check - run: python tools/build-discovery.py --check - run: python tools/check-discovery.py - quickstart: - runs-on: ubuntu-latest - timeout-minutes: 8 - steps: - - uses: actions/checkout@v4 - with: - persist-credentials: false - - uses: actions/setup-python@v5 - with: - python-version: '3.12' - - run: python tools/check-quickstart.py diff --git a/404.html b/404.html index 05e91f8..d5cf66a 100644 --- a/404.html +++ b/404.html @@ -24,7 +24,7 @@
  • TRACE conformance suite
  • Build diff --git a/community/index.html b/community/index.html index c88d031..1c3491b 100644 --- a/community/index.html +++ b/community/index.html @@ -53,7 +53,7 @@
  • TRACE conformance suite
  • Build @@ -273,18 +272,6 @@

    Read the field guide. Then run the companion examples.

    -
    - -
    -
    -
    Overview
    -

    What is AgenTrust?

    -
    -

    AgenTrust is an open ecosystem for verifiable AI agent governance. It connects reusable technology with the people and practices needed to adopt it: maintainers, implementers, researchers, enterprise operators, conformance testing, integration guidance, and transparent community governance.

    -

    Agent Manifest declares identity and intended authority. cMCP governs tool calls; cA2A governs delegation to another agent. TRACE carries signed runtime evidence for verification against a trust policy. Hardware provenance depends on verified attestation. Use the components required by your trust boundary. Explore each project's specification, reference implementation, and license through the chain on the homepage.

    -

    AgenTrust Telemetry is the integration layer across that chain. It gives runtimes a common, metadata-only contract for governance facts, projects those facts into caller-owned OpenTelemetry, and can turn a complete durable evidence set into TRACE. It does not replace a policy engine, collector, observability backend, or dashboard.

    -
    - diff --git a/demos/index.html b/demos/index.html index c2dc0b8..f4f8a86 100644 --- a/demos/index.html +++ b/demos/index.html @@ -55,7 +55,7 @@
  • TRACE conformance suite
  • Build
    Clone the demos - Write the policy yourself + Write the policy yourself
    @@ -291,7 +291,7 @@

    Where to go next

    Home - Quickstart + Get started Telemetry GitHub
    diff --git a/extensions/ca2a/v0.1/index.html b/extensions/ca2a/v0.1/index.html index 68cbbdd..026bcdb 100644 --- a/extensions/ca2a/v0.1/index.html +++ b/extensions/ca2a/v0.1/index.html @@ -55,7 +55,7 @@
  • TRACE conformance suite
  • Build
      -
    • 10-minute quickstart
      • +
    • Get started
    • Demos
    • Telemetry
    • Marketplace
      • diff --git a/go/agent-anomaly-detection/index.html b/go/agent-anomaly-detection/index.html index 19f8f23..3cb7264 100644 --- a/go/agent-anomaly-detection/index.html +++ b/go/agent-anomaly-detection/index.html @@ -46,7 +46,7 @@

      Anomaly detection on agent behaviour

      Home - Quickstart + Get started Demos GitHub
      diff --git a/go/agent-circuit-breaker/index.html b/go/agent-circuit-breaker/index.html index b332723..b9d8521 100644 --- a/go/agent-circuit-breaker/index.html +++ b/go/agent-circuit-breaker/index.html @@ -46,7 +46,7 @@

      Circuit breaker on agent loops

      Home - Quickstart + Get started Demos GitHub
      diff --git a/go/agent-identity-credential/index.html b/go/agent-identity-credential/index.html index fa364c2..8464503 100644 --- a/go/agent-identity-credential/index.html +++ b/go/agent-identity-credential/index.html @@ -46,7 +46,7 @@

      Agent identity credential

      Home - Quickstart + Get started Demos GitHub
      diff --git a/go/agent-key-binding/index.html b/go/agent-key-binding/index.html index a098e96..2df5cec 100644 --- a/go/agent-key-binding/index.html +++ b/go/agent-key-binding/index.html @@ -46,7 +46,7 @@

      Agent key binding and custody

      Home - Quickstart + Get started Demos GitHub
      diff --git a/go/agent-purpose-declaration/index.html b/go/agent-purpose-declaration/index.html index 6bb96ca..54d33fe 100644 --- a/go/agent-purpose-declaration/index.html +++ b/go/agent-purpose-declaration/index.html @@ -46,7 +46,7 @@

      Declared agent purpose and scope

      Home - Quickstart + Get started Demos GitHub
      diff --git a/go/agent-rate-limiting/index.html b/go/agent-rate-limiting/index.html index dce9765..c7da2b5 100644 --- a/go/agent-rate-limiting/index.html +++ b/go/agent-rate-limiting/index.html @@ -46,7 +46,7 @@

      Rate limiting on agent actions

      Home - Quickstart + Get started Demos GitHub
      diff --git a/go/agent-session-revocation/index.html b/go/agent-session-revocation/index.html index 37d91dd..f62577b 100644 --- a/go/agent-session-revocation/index.html +++ b/go/agent-session-revocation/index.html @@ -46,7 +46,7 @@

      Agent session revocation

      Home - Quickstart + Get started Demos GitHub
      diff --git a/go/agent-state-rollback/index.html b/go/agent-state-rollback/index.html index e3518e8..bc1e2e4 100644 --- a/go/agent-state-rollback/index.html +++ b/go/agent-state-rollback/index.html @@ -46,7 +46,7 @@

      State rollback after an agent action

      Home - Quickstart + Get started Demos GitHub
      diff --git a/go/agent-termination/index.html b/go/agent-termination/index.html index 1b25ab9..2541c75 100644 --- a/go/agent-termination/index.html +++ b/go/agent-termination/index.html @@ -46,7 +46,7 @@

      Terminate a running agent

      Home - Quickstart + Get started Demos GitHub
      diff --git a/go/attested-a2a-channel/index.html b/go/attested-a2a-channel/index.html index bf6f53a..708d5bf 100644 --- a/go/attested-a2a-channel/index.html +++ b/go/attested-a2a-channel/index.html @@ -46,7 +46,7 @@

      Attested agent-to-agent channel

      Home - Quickstart + Get started Demos GitHub
      diff --git a/go/behavioural-baseline/index.html b/go/behavioural-baseline/index.html index aff95f8..4c164c6 100644 --- a/go/behavioural-baseline/index.html +++ b/go/behavioural-baseline/index.html @@ -46,7 +46,7 @@

      Behavioural baseline for an agent

      Home - Quickstart + Get started Demos GitHub
      diff --git a/go/blast-radius-containment/index.html b/go/blast-radius-containment/index.html index 70a80ba..9dc246c 100644 --- a/go/blast-radius-containment/index.html +++ b/go/blast-radius-containment/index.html @@ -46,7 +46,7 @@

      Blast radius containment for agent execution

      Home - Quickstart + Get started Demos GitHub
      diff --git a/go/capability-attenuation/index.html b/go/capability-attenuation/index.html index 1c4fb1d..84d52f5 100644 --- a/go/capability-attenuation/index.html +++ b/go/capability-attenuation/index.html @@ -46,7 +46,7 @@

      Capability attenuation across the delegation chain

      Home - Quickstart + Get started Demos GitHub
      diff --git a/go/capability-manifest/index.html b/go/capability-manifest/index.html index dde5c30..509f5a0 100644 --- a/go/capability-manifest/index.html +++ b/go/capability-manifest/index.html @@ -46,7 +46,7 @@

      Declared capability manifest

      Home - Quickstart + Get started Demos GitHub
      diff --git a/go/context-provenance/index.html b/go/context-provenance/index.html index 91d5cb3..5be2536 100644 --- a/go/context-provenance/index.html +++ b/go/context-provenance/index.html @@ -46,7 +46,7 @@

      Context provenance for agent working memory

      Home - Quickstart + Get started Demos GitHub
      diff --git a/go/continuous-usage-control/index.html b/go/continuous-usage-control/index.html index 70cd0dd..0b688df 100644 --- a/go/continuous-usage-control/index.html +++ b/go/continuous-usage-control/index.html @@ -46,7 +46,7 @@

      Continuous usage control after grant

      Home - Quickstart + Get started Demos GitHub
      diff --git a/go/evidence-transparency-anchoring/index.html b/go/evidence-transparency-anchoring/index.html index 0e66d6f..79f2b8b 100644 --- a/go/evidence-transparency-anchoring/index.html +++ b/go/evidence-transparency-anchoring/index.html @@ -46,7 +46,7 @@

      Transparency-log anchoring of evidence

      Home - Quickstart + Get started Demos GitHub
      diff --git a/go/graceful-degradation/index.html b/go/graceful-degradation/index.html index bf844c1..061fcf3 100644 --- a/go/graceful-degradation/index.html +++ b/go/graceful-degradation/index.html @@ -46,7 +46,7 @@

      Graceful degradation on policy engine failure

      Home - Quickstart + Get started Demos GitHub
      diff --git a/go/index.html b/go/index.html index c69c797..f287b75 100644 --- a/go/index.html +++ b/go/index.html @@ -61,7 +61,7 @@
    • TRACE conformance suite
  • Build
      -
    • 10-minute quickstart
      • +
    • Get started
    • Demos
    • Telemetry
    • Marketplace
      • @@ -397,7 +397,7 @@

      What this page does not do

      Home - Quickstart + Get started Demos GitHub
      diff --git a/go/input-schema-validation/index.html b/go/input-schema-validation/index.html index 13cb18d..355bb4e 100644 --- a/go/input-schema-validation/index.html +++ b/go/input-schema-validation/index.html @@ -46,7 +46,7 @@

      Schema validation of agent input

      Home - Quickstart + Get started Demos GitHub
      diff --git a/go/model-weight-custody/index.html b/go/model-weight-custody/index.html index 577c4e9..34bba11 100644 --- a/go/model-weight-custody/index.html +++ b/go/model-weight-custody/index.html @@ -46,7 +46,7 @@

      Model weight custody against the hosting operator

      Home - Quickstart + Get started Demos GitHub
      diff --git a/go/output-encoding/index.html b/go/output-encoding/index.html index b680fbc..f7bd505 100644 --- a/go/output-encoding/index.html +++ b/go/output-encoding/index.html @@ -46,7 +46,7 @@

      Encoding and injection prevention

      Home - Quickstart + Get started Demos GitHub
      diff --git a/go/output-personal-data/index.html b/go/output-personal-data/index.html index 3e0f7db..009c0ad 100644 --- a/go/output-personal-data/index.html +++ b/go/output-personal-data/index.html @@ -46,7 +46,7 @@

      Personal data protection in agent output

      Home - Quickstart + Get started Demos GitHub
      diff --git a/go/policy-verdict-rationale/index.html b/go/policy-verdict-rationale/index.html index 6d0ee45..8e6ffbe 100644 --- a/go/policy-verdict-rationale/index.html +++ b/go/policy-verdict-rationale/index.html @@ -46,7 +46,7 @@

      Policy verdict rationale

      Home - Quickstart + Get started Demos GitHub
      diff --git a/go/prompt-injection-prevention/index.html b/go/prompt-injection-prevention/index.html index 380bc1c..ca555b8 100644 --- a/go/prompt-injection-prevention/index.html +++ b/go/prompt-injection-prevention/index.html @@ -46,7 +46,7 @@

      Prompt injection prevention

      Home - Quickstart + Get started Demos GitHub
      diff --git a/go/resource-allowlist/index.html b/go/resource-allowlist/index.html index a6df017..6211b0e 100644 --- a/go/resource-allowlist/index.html +++ b/go/resource-allowlist/index.html @@ -46,7 +46,7 @@

      Resource allowlist

      Home - Quickstart + Get started Demos GitHub
      diff --git a/go/runtime-attestation-evidence/index.html b/go/runtime-attestation-evidence/index.html index 8a22150..d5e4c9a 100644 --- a/go/runtime-attestation-evidence/index.html +++ b/go/runtime-attestation-evidence/index.html @@ -46,7 +46,7 @@

      Runtime attestation evidence

      Home - Quickstart + Get started Demos GitHub
      diff --git a/go/structured-action-logging/index.html b/go/structured-action-logging/index.html index c10c8d5..74544a4 100644 --- a/go/structured-action-logging/index.html +++ b/go/structured-action-logging/index.html @@ -46,7 +46,7 @@

      Structured action logging

      Home - Quickstart + Get started Demos GitHub
      diff --git a/go/tool-authorization/index.html b/go/tool-authorization/index.html index 51a1a0a..946f62f 100644 --- a/go/tool-authorization/index.html +++ b/go/tool-authorization/index.html @@ -46,7 +46,7 @@

      Tool authorization decision

      Home - Quickstart + Get started Demos GitHub
      diff --git a/go/transaction-limits/index.html b/go/transaction-limits/index.html index d59d4f4..8ed4b27 100644 --- a/go/transaction-limits/index.html +++ b/go/transaction-limits/index.html @@ -46,7 +46,7 @@

      Transaction and spend limits

      Home - Quickstart + Get started Demos GitHub
      diff --git a/go/verifiable-evidence-record/index.html b/go/verifiable-evidence-record/index.html index 9293278..a933edd 100644 --- a/go/verifiable-evidence-record/index.html +++ b/go/verifiable-evidence-record/index.html @@ -46,7 +46,7 @@

      Signed, third-party-verifiable evidence record

      Home - Quickstart + Get started Demos GitHub
      diff --git a/index.html b/index.html index 9484f4d..359ed7b 100644 --- a/index.html +++ b/index.html @@ -148,7 +148,7 @@
    • TRACE conformance suite
  • Build
      -
    • 10-minute quickstart
      • +
    • Get started
    • Demos
    • Telemetry
    • Marketplace
      • @@ -295,7 +295,7 @@

      What this proves, and what it does not.

    • A signature shows who signed a record and that it has not changed. It says nothing about where the signer ran.
    • Hardware origin needs a verified attestation that binds the signing key.
    • Memory-bus attacks such as TEE.fail and BadRAM defeat current confidential-computing silicon against an operator who physically owns the machine. Weight custody is scoped to match.
      • -
    • The quickstart and demos run in software mode, with no hardware isolation.
      • +
    • The start pages and demos run in software mode, with no hardware isolation.
    • Conformance vectors are self-tests. They are not certification.
    • A registry entry shows a record was anchored. It does not validate the record's claims.
    @@ -373,7 +373,7 @@

    Anyone can read it, run it and check it.

    Build with it

    - Quickstart, 10 minutes, software mode + Get started, software mode Demos Telemetry Marketplace diff --git a/llms.txt b/llms.txt index d9d1b21..ffb24a8 100644 --- a/llms.txt +++ b/llms.txt @@ -8,7 +8,7 @@ AgenTrust is the ecosystem at https://agentrust-io.com and the GitHub organizati - [Overview](https://agentrust-io.com/): The verifiable AI supply chain from model weights to agent actions, the hardware it is validated on, and what the evidence does and does not prove. - [Verify an Intel TDX quote](https://agentrust-io.com/verify/): Runs the four-step DCAP check on a genuine GCP confidential VM quote in the browser, ending at the pinned Intel SGX Root CA, then checks that the quote's REPORTDATA commits to the signing key of a TRACE record published beside it. A pass proves genuine Intel TDX silicon signed the quote and bound that key. The check does not appraise TCB currency or revocation, or show that the measured image is the one anyone intended. -- [10-minute tool-call tutorial](https://agentrust-io.com/quickstart/): Write a policy, observe a denied call, and inspect a signed session record on a laptop. Software mode provides no hardware isolation or hardware-backed provenance. +- [Get started](https://agentrust-io.com/quickstart/): One start page per specification, in chain order: Weight Custody Manifest, Agent Manifest, cMCP, cA2A, TRACE and the TRACE conformance suite, plus the in-browser TDX quote check, which needs no install. The linked start pages run in software mode with no hardware isolation. - [Weight Custody Manifest (WCM)](https://wcm.agentrust-io.com/): Bind model-weight identity and custody terms to key-release policy. The local walkthrough uses synthetic evidence and a placeholder key; it does not load a real model or demonstrate hardware protection. - [Runnable demos](https://agentrust-io.com/demos/): Software examples for policy decisions, evidence verification, delegation, and model-weight custody. Follow each demo's stated prerequisites and limits. - [Marketplace search](https://agentrust-io.com/marketplace/): Find integrations by framework, technology, and use case. diff --git a/marketplace/catalog/index.html b/marketplace/catalog/index.html index 8d6a9f5..6cedde6 100644 --- a/marketplace/catalog/index.html +++ b/marketplace/catalog/index.html @@ -25,7 +25,7 @@
  • TRACE conformance suite
  • Build
  • Build
      -
    • 10-minute quickstart
      • +
    • Get started
    • Demos
    • Telemetry
    • Marketplace
      • diff --git a/quickstart/index.html b/quickstart/index.html index 909f2a7..c7ddb47 100644 --- a/quickstart/index.html +++ b/quickstart/index.html @@ -3,8 +3,8 @@ -cMCP Quickstart: Block a Tool Call and Verify the Receipt | AgenTrust - +Get Started with the AgenTrust Specifications | AgenTrust + @@ -15,10 +15,10 @@ - + - - + + @@ -28,31 +28,30 @@ - - + + @@ -79,7 +78,7 @@
    • TRACE conformance suite
  • Build
      -
    • 10-minute quickstart
      • +
    • Get started
    • Demos
    • Telemetry
    • Marketplace
      • @@ -94,301 +93,56 @@
      -
      -
      - 03 · Actions · cMCP software-mode quickstart -

      Set policy on your agent. Watch it block a bad action.

      -

      Deny a request to a tool tagged as personal data, then verify its signed session record. About ten minutes on your laptop, using a mock tool and software attestation.

      -
      Start the quickstartHow it works
      -
      -
      -

      Preview · simulated, a 30-second look at the block

      -
      -
      agent → runtime
      -
      -
      $ agent calls salesforce.contacts
        catalog tag: compliance_domain: "pii"
      - - -
      -
      -

      Policy overhead target: p50 under 1ms per tool call (documented targets, not a measurement on your machine)

      -
      -
      + Weights · Agent · Actions · Evidence · Start pages +

      Get started

      +

      Each specification has its own start page. Pick the step in the chain your trust boundary needs; no step requires the others.

      +
      Python 3.11 or newer · Git and Bash on Linux, macOS or Windows with WSL · Software mode, no hardware isolation
      - -
      -
      - The problem -

      Allow is not the same as proof

      -
      -
      -

      A customer-service agent pulls records from Salesforce to do its job: names, accounts, PII. What stops it leaking sensitive data on a tool call it shouldn't make, and could you prove to a regulator it didn't?

      -
      -
      -

      An agent calls a tool. Your policy engine says allow. The call goes through. None of that proves the engine itself wasn't tampered with, or that your audit log reflects what actually happened.

      -

      cMCP checks calls at the tool boundary. The runtime evaluates routed tool calls against policy and records its decisions. This local demo demonstrates denial and signing; isolation from the host requires a hardware TEE deployment.

      -
      -
      -
      - -
      - How it works -

      Five steps from install to a blocked leak

      -

      Everything leads to step four, the moment you watch your own policy stop something it shouldn't allow.

      -
      -
      01InstallOne pip install. The runtime, that's it.
      -
      02Write your policyA few lines of Cedar. Your rules, not ours.
      -
      03Wire it inPoint one call at the runtime. Nothing else changes.
      -
      04Watch it blockFire a bad action. Watch the policy return 403.
      -
      05Prove itGet a signed, verifiable record of what happened.
      -
      -
      - -
      - Ten minutes -

      The quickstart

      -

      Copy each block. Every file is filled in for you, nothing to hand-author, nothing to hash. Follow along top to bottom.

      - -
      -

      Before you start. Python 3.11+ · pip · curl · macOS, Linux, or Windows with WSL and Bash · two terminal windows · about ten minutes.

      -

      The install is pinned to cmcp-runtime 0.5.0 so the commands match this walkthrough. Report unexpected results by opening an issue with the failing command and runtime version.

      -
      - -

      Expected finish: the tool request returns 403 POLICY_DENY. The verifier later reports FAIL (partially_verified) and exits 1 because this demo has no hardware attestation. That is the expected software-mode result.

      - - - -
      - -
      -
      1
      -
      -

      Install the runtime

      -

      Creates a project folder, an isolated Python environment, and installs the cmcp runtime, the enforcement engine. (The venv is why pip install won't get blocked on recent macOS.) No tool server needed: in step 4 your policy blocks the call before it forwards, so salesforce.contacts is a placeholder for your real MCP server. Open source (MIT): github.com/agentrust-io/cmcp

      -
      -
      Terminal 1
      -
      mkdir -p cmcp-quickstart && cd cmcp-quickstart
-python3 -m venv venv && source venv/bin/activate
-python3 -m pip install cmcp-runtime==0.5.0
      -
      -
      +
      + The chain +

      Pick a step

      +
      +
      +
      01 · Weights Weight Custody Manifest
      +

      Install the reference SDK from source, sign a manifest as builder and custodian, verify it, and gate a key release. It runs on software test doubles, with no GPU or cloud account.

      +

      Getting started →

      - -
      -
      2
      -
      -

      Drop in the config and your policy

      -

      Paste each block into the same Terminal 1, top to bottom. You're already inside cmcp-quickstart from step 1. The cat > … EOF wrapper writes each file for you, no editor needed. Your policy (block 2) is what decides what's allowed. Any *.cedar filename works; manifest.json and schema.cedarschema are the two names the runtime requires.

      -
      -
      1 · Creates cmcp-config.yaml
      -
      mkdir -p policies
-cat > cmcp-config.yaml << 'EOF'
-attestation:
-  provider: auto
-  enforcement_mode: enforcing   # enforcing | advisory | silent
-policy_bundle_path: ./policies/
-catalog_path: ./catalog.json
-listen_addr: "127.0.0.1:8443"   # dev mode runs without a bearer token, so stay on loopback
-EOF
      -
      -
      -
      2 · Creates your policy bundle, your rules
      -
      cat > policies/manifest.json << 'EOF'
-{ "version": "0.1.0", "authored_at": "2026-06-05T00:00:00Z",
-  "author_identity": "you@example.com", "commit_sha": "quickstart-demo" }
-EOF
-
-cat > policies/agent.cedar << 'EOF'
-// Cedar is default-deny: anything these rules don't permit is denied.
-
-// Rule 1: let the demo-agent workflow call tools at all
-permit ( principal, action == cMCP::Action::"call_tool", resource )
-when { context.workflow_id == "demo-agent" };
-
-// Rule 2: but never let it call a tool the catalog tags as PII.
-// forbid always wins over permit in Cedar, so this is the rule
-// that produces the 403 in step 4.
-forbid ( principal, action == cMCP::Action::"call_tool", resource )
-when { context.compliance_domain == "pii" };
-EOF
-
-cat > policies/schema.cedarschema << 'EOF'
-{"cMCP":{"entityTypes":{"Principal":{"memberOfTypes":[],"shape":{"type":"Record","attributes":{"session_id":{"type":"String","required":true},"workflow_id":{"type":"String","required":true}}}},"Resource":{"memberOfTypes":[],"shape":{"type":"Record","attributes":{"tool_name":{"type":"String","required":true}}}}},"actions":{"call_tool":{"appliesTo":{"principalTypes":["cMCP::Principal"],"resourceTypes":["cMCP::Resource"],"context":{"type":"Record","attributes":{"compliance_domain":{"type":"String","required":true},"session_max_sensitivity":{"type":"String","required":true},"workflow_id":{"type":"String","required":true}}}}}}}}
-EOF
      -
      -
      -
      3 · Creates catalog.json, the approved tool tagged compliance_domain: "pii" (hash pre-computed)
      -
      cat > catalog.json << 'EOF'
-[
-  {
-    "tool_name": "salesforce.contacts",
-    "server": {
-      "display_name": "Salesforce Contacts MCP Server (mock)",
-      "url": "http://localhost:9001/mcp",
-      "tls_fingerprint": "SHA256:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=",
-      "transport": "http-sse"
-    },
-    "approved_definition": {
-      "description": "Query Salesforce contacts by account name or contact ID.",
-      "input_schema": {
-        "type": "object",
-        "required": ["query"],
-        "properties": {
-          "query": {"type": "string", "description": "Account name or contact ID"},
-          "max_records": {"type": "integer", "default": 50}
-        }
-      },
-      "output_schema": {
-        "type": "object",
-        "properties": { "contacts": {"type": "array"}, "total_count": {"type": "integer"} }
-      }
-    },
-    "definition_hash": "sha256:b42ecf14612f23456b5b0794864a00288d4038ac444cedb87fc214cefee89e35",
-    "compliance_domain": "pii",
-    "requires_baa": false,
-    "sensitivity_level": "pii",
-    "added_at": "2026-06-05T00:00:00Z",
-    "approved_by": "you@example.com"
-  }
-]
-EOF
      -
      -
      -
      4 · Sanity check, confirm the config parses
      -
      cmcp validate-config --config cmcp-config.yaml
      -
      -

      Expect ✓ Config valid: cmcp-config.yaml. This checks the YAML only; the policy bundle and catalog are loaded when the runtime starts in step 3. If you see an error instead, a block didn't paste cleanly, so re-run that one.

      -
      +
      +
      02 · Agent Agent Manifest
      +

      Sign a small agent configuration and verify its declared inputs, then watch an edited record and a changed prompt hash fail. It runs no model and produces no hardware attestation.

      +

      Create your first manifest →

      - -
      -
      3
      -
      -

      Start the runtime

      -

      Run this in the same terminal where you just created the files (you're inside cmcp-quickstart). It keeps running and won't return a prompt, which is normal, and the startup notices are expected, not errors. Leave it open and open a second terminal for the next step.

      -
      -
      Terminal 1: leave running
      -
      CMCP_DEV_MODE=1 cmcp start --config cmcp-config.yaml
      -
      -
      +
      +
      03 · Actions cMCP
      +

      Run the runtime in dev mode, see a call to a sensitive tool get HTTP 403 before it is forwarded, and verify the signed TRACE claim. With no hardware TEE, verification reports partially_verified.

      +

      cMCP quickstart →

      - -
      -
      4
      -
      -

      Fire a bad action, watch it get blocked

      -

      In a second terminal, run cd cmcp-quickstart && source venv/bin/activate first (so cmcp is available here too), then paste this. It's your support agent trying to pull a customer's Salesforce record. The runtime looks the tool up in your catalog, sees compliance_domain: "pii", and your rule 2 forbids it. Watch it return a 403 before it ever reaches Salesforce. Not blocked? You're likely in advisory mode, so check the config says enforcing.

      -
      -
      Terminal 2: you, playing the agent
      -
      curl -i -X POST http://localhost:8443/mcp \
-  -H "Content-Type: application/json" \
-  -d '{
-    "jsonrpc": "2.0", "id": 2, "method": "tools/call",
-    "params": {
-      "name": "salesforce.contacts",
-      "arguments": { "query": "Acme Corp" },
-      "_cmcp": { "session_id": "demo-session-001", "workflow_id": "demo-agent" }
-    }
-  }'
      -
      -

      workflow_id is the only field the runtime reads out of _cmcp. The session id is a label for your own logs: the runtime mints its own session id, which is why step 5 looks it up instead of assuming it.

      -
      -
      what the runtime returns
      -
      -
      HTTP/1.1 403 Forbidden
      content-type: application/json
      -
      {"jsonrpc":"2.0","error":{"code":-32000,
        "message":"Request denied by policy",
        "data":{"error_code":"POLICY_DENY",
          "call_id":"51da9a46-149f-40c4-b83f-82d48fd654bd"}},"id":2}
      -
      -
      -
      -
      ✓ What just happened
      -

      Your policy rejected a call to a tool tagged pii before forwarding. No Salesforce server runs in this demo, and no personal data is fetched. The decision uses the catalog tag; it does not inspect the request for personal data.

      -

      Keep an eye on that call_id. The same id lands in the audit chain, so the deny you just watched is the deny you can hand to someone else in step 5. A refusal nobody can check afterwards is just a log line.

      -
      -
      +
      +
      03 · Actions cA2A
      +

      Build a two-hop delegation chain and verify it, then see an untrusted root and a grant wider than its parent rejected. It needs no network, hardware or running peer.

      +

      Verify your first chain →

      - -
      -
      5
      -
      -

      Walk away with proof

      -

      Closing the session mints a signed TRACE claim, a tamper-evident record of which tools ran and which policy decided each call. Verify it yourself; you don't have to trust us. See the full TRACE claim schema.

      -
      -
      Terminal 2: finalize the session, then verify
      -
      SID=$(curl -s "http://localhost:8443/audit/export?session_id=demo-session-001" \
-  | python3 -c "import sys,json; print(json.load(sys.stdin)['entries'][0]['session_id'])")
-curl -s -X POST "http://localhost:8443/sessions/$SID/close" | python3 -m json.tool > claim.json
-cmcp verify claim.json
      -
      -

      Expected output in dev mode. The CRYPTO-001 line comes first and is an advisory, not a failure: it is the CLI saying up front that a software-mode key binding proves nothing about hardware.

      -
      -
      cmcp verify claim.json
      -
      CRYPTO-001: software-only (dev) mode -- TEE key binding cannot be
      verified; this claim provides no hardware provenance guarantee
      -
      -
      -
      schemaPASS ✓
      -
      signaturePASS ✓
      -
      policy_bundle.hashPASS ✓ (not pinned)
      -
      tool_catalog.hashPASS ✓ (not pinned)
      -
      attestation_freshnessPASS ✓
      -
      audit_chainPASS ✓
      -
      hardware_attestationFAIL: software-only mode
      -
      ResultFAIL (partially_verified)
      -
      -

      Every cryptographic check passes. The one FAIL is hardware attestation, which dev mode can't provide, and that is the honest answer: overall verification only reports verified when the claim is hardware-backed, so the CLI prints FAIL (partially_verified) and exits 1 here. A hardware deployment must also supply valid attestation, trusted keys, and the expected policy and catalog bindings. Moving the runtime to a TEE alone does not establish those checks or legal compliance. To see what a passing hardware check looks like, verify a real Intel TDX quote in your browser.

      -
      +
      +
      04 · Evidence TRACE
      +

      Sign a record, verify it, then change one field and watch verification fail. It uses synthetic claims and software signing, with no agent, registry or attestation.

      +

      TRACE quickstart →

      - -
      - -
      -
      Go further: stateful escalation
      -

      The rule you just wrote is stateless: the tool is tagged PII, so it is always forbidden for this workflow. cMCP also tracks sensitivity across a session. Once a response has been inspected and found to contain PII, the session's session_max_sensitivity rises, and a rule like this starts to bite:

      -
      -
      The stateful version of rule 2
      -
      forbid ( principal, action == cMCP::Action::"call_tool", resource )
-when { context.session_max_sensitivity == "pii" };
      +
      +
      04 · Evidence Conformance suite
      +

      Install agentrust-trace-tests, generate a Level 0 sample record, and run trace-tests verify against it. The sample passes Level 0; Levels 1 and 2 fail without attestation and anchoring.

      +

      Conformance quick start →

      -

      That one needs a session with history: sensitivity starts at public and only rises after the runtime inspects a real response, so you need an upstream tool server and at least one allowed call before it fires. The reference quickstart sets that up with a mock upstream: cMCP reference quickstart.

      - -

      Stuck? Every block above is copy-paste: the file blocks write themselves via cat > … EOF, the rest are commands. Keep your first terminal (the runtime) running while you work in the second. Full walkthrough and troubleshooting: cMCP quickstart · debugging guide.

      -
      - If a step fails

      Get back to the expected result

      -
      -
      Connection refused
      Keep Terminal 1 running. Confirm startup completed and the address is 127.0.0.1:8443.
      -
      Command not found or missing files
      Activate the virtual environment in both terminals. Run commands from the cmcp-quickstart folder.
      -
      The tool call is forwarded instead of denied
      Check enforcement_mode: enforcing, the catalog's pii tag, and the forbid rule. Restart the runtime after configuration changes.
      -
      FAIL (partially_verified), exit 1
      Expected only when the listed software checks pass and hardware attestation is the missing check. Other failures need investigation.
      -
      -

      Finish: stop the runtime with Ctrl+C in Terminal 1. Keep claim.json to inspect the record.

      -

      Next: run an example with a real local tool server →

      -
      - -
      - You did it -

      Tell the community how it went

      -

      The people building cMCP hang out in Discord. Drop your result, get help, and tell us if it unblocks something you can't ship today.

      -
      -

      Join the AgenTrust Discord

      -

      Post your result in #general and answer one question: did it unblock something you can't ship today?

      -
      Join the Discord
      -
      +
      + No install +

      Check real hardware evidence first

      +

      Verify a genuine Intel TDX quote from a GCP confidential VM in your browser, including its commitment to the key that signed a TRACE record. Nothing is uploaded.

      +
      Verify a real Intel TDX quoteRun the demos
      @@ -399,18 +153,18 @@

      Join the AgenTrust Discord

      AgenTrust
      Open specifications for verifiable AI
      -
      cMCP evaluates routed MCP tool calls against Cedar policy and emits a signed TRACE session record when the session closes. It is software-rooted in dev mode, and hardware-backed only when the runtime runs in a TEE with verified attestation. Sponsored by OPAQUE, which funds the engineering, infrastructure and confidential-computing work behind these projects.
      +
      + Home + Verify + Demos + GitHub +
      +
      Sponsored by OPAQUE, which funds the engineering, infrastructure and confidential-computing work behind these projects.
      -
      © 2026 AgenTrust Contributors · cMCP is open source (MIT) · agentrust-io.com
      +
      © 2026 AgenTrust Contributors · agentrust-io.com
      - diff --git a/registry/index.html b/registry/index.html index 5dafece..0425fdd 100644 --- a/registry/index.html +++ b/registry/index.html @@ -70,7 +70,7 @@
    • TRACE conformance suite
  • Build
  • Build
      -
    • 10-minute quickstart
      • +
    • Get started
    • Demos
    • Telemetry
    • Marketplace
      • @@ -321,7 +321,7 @@

      The documents to implement against

      Home - Quickstart + Get started Demos GitHub
      diff --git a/tools/build-controls.py b/tools/build-controls.py index 67459d7..c2cb87f 100644 --- a/tools/build-controls.py +++ b/tools/build-controls.py @@ -145,7 +145,7 @@ def head(title, description, canonical, robots, og_title, og_url, extra=''):
      Home - Quickstart + Get started Demos GitHub
      diff --git a/tools/build-discovery.py b/tools/build-discovery.py index 52853c0..2e7e592 100644 --- a/tools/build-discovery.py +++ b/tools/build-discovery.py @@ -67,7 +67,7 @@ def catalog_html(snapshot): ''' + f'

      {len(items)} listings, captured {escape(snapshot["captured"])} from this source revision. Search the live catalog for newer listings.

      \n' + '''

      Community listings are manifest-validated, not endorsed. AGT project listings describe integrations in the Microsoft Agent Governance Toolkit. Listing does not establish certification, hardware validation, or commercial availability.

      ''' + '\n'.join(cards) + ''' -
      + ''' diff --git a/tools/check-quickstart.py b/tools/check-quickstart.py deleted file mode 100644 index 8659e7a..0000000 --- a/tools/check-quickstart.py +++ /dev/null @@ -1,49 +0,0 @@ -"""Run the published Bash quickstart in a temporary directory, including exit 1.""" -from html.parser import HTMLParser -from pathlib import Path -import subprocess -import tempfile - - -class Blocks(HTMLParser): - def __init__(self): - super().__init__(convert_charrefs=True) - self.blocks, self.current = [], None - - def handle_starttag(self, tag, attrs): - if tag == "pre": - self.current = "" - - def handle_data(self, data): - if self.current is not None: - self.current += data - - def handle_endtag(self, tag): - if tag == "pre": - self.blocks.append(self.current) - self.current = None - - -parser = Blocks() -parser.feed((Path(__file__).resolve().parents[1] / "quickstart/index.html").read_text(encoding="utf-8")) -install, config, policy, catalog, validate, start, deny, verify, *_ = parser.blocks -script = "set -eu\n" + "\n".join([install, config, policy, catalog, validate]) -script += "\n" + start + " >runtime.log 2>&1 &\nruntime_pid=$!\n" -script += "trap 'kill $runtime_pid 2>/dev/null || true' EXIT\n" -script += ''' -ready=0 -for attempt in $(seq 1 60); do - if curl -s -o /dev/null http://localhost:8443/health; then ready=1; break; fi - if ! kill -0 "$runtime_pid" 2>/dev/null; then cat runtime.log; exit 1; fi - sleep 1 -done -if [ "$ready" != 1 ]; then cat runtime.log; exit 1; fi -''' -script += "\n" + deny + " >denial.txt\ncat denial.txt\ngrep -q '403' denial.txt\ngrep -q 'POLICY_DENY' denial.txt\n" -script += "set +e\n" + verify + " >verification.txt 2>&1\nresult=$?\nset -e\ncat verification.txt\n" -script += "test $result -eq 1\ngrep -q 'partially_verified' verification.txt\ngrep -q 'CRYPTO-001' verification.txt\n" -for check in ("schema", "signature", "policy_bundle.hash", "tool_catalog.hash", "attestation_freshness", "audit_chain"): - script += f"grep -Eq '{check.replace('.', '[.]')} +PASS' verification.txt\n" -with tempfile.TemporaryDirectory(prefix="agentrust-quickstart-") as temp: - subprocess.run(["bash", "-c", script], cwd=temp, check=True, timeout=240) -print("PASS published quickstart: 403 POLICY_DENY, signed session record, expected software-mode verification exit 1") diff --git a/tools/site_header.py b/tools/site_header.py index 8dd8c49..abefa86 100644 --- a/tools/site_header.py +++ b/tools/site_header.py @@ -29,7 +29,7 @@ ('TRACE conformance suite', 'https://tests.agentrust-io.com'), ]), ('Build', [ - ('10-minute quickstart', '/quickstart/'), + ('Get started', '/quickstart/'), ('Demos', '/demos/'), ('Telemetry', '/telemetry/'), ('Marketplace', '/marketplace/'), diff --git a/verify/index.html b/verify/index.html index 28da2a6..a4e29f0 100644 --- a/verify/index.html +++ b/verify/index.html @@ -69,7 +69,7 @@
    • TRACE conformance suite
  • Build