Verification methodology

The four stages

1. Static analysis — code and manifest are scanned for unsafe patterns, leaked secrets, and over-broad permissions. 2. Dependency & supply-chain — every dependency is audited for known vulnerabilities and licence risk. 3. Dynamic behaviour — the agent runs in a sandbox against real tasks so its actual behaviour is measured. 4. Injection resistance — adversarial prompt-injection and jailbreak attempts probe its guardrails.

From findings to a score

Findings are weighted into a calibrated 0–100 trust score and a certification tier. The score updates as the agent is re-verified.

See the full how-it-works walkthrough for the end-to-end loop.