[GH-ISSUE #313] Optional agent-trust (AgentCert + TrustScore) check before proxying? #137

New issue

Open

opened 2026-10-18 21:12:06 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-18 21:12:06 +00:00

Owner

Originally created by @karlmehta on GitHub (Oct 5, 2026).
Original GitHub issue: https://github.com/open-webui/mcpo/issues/313

mcpo turns an MCP server into an OpenAPI endpoint, which makes it the layer that decides who gets to reach those tools — a natural spot for an optional agent-trust check before the call is proxied through.

it verifies the caller's AgentCert + a live TrustScore per call and returns allow / deny / annotate. we ship it as a small MIT service (ghcr.io/pdxlab/agentcert-tag), so mostly a callout from mcpo, or the proxy in front.

opt-in, off by default, shadow-mode first (logs, blocks nothing), metadata only.

is an optional trust gate something mcpo would want? happy to send a reference hook. https://trustmodel.ai/verify

Originally created by @karlmehta on GitHub (Oct 5, 2026). Original GitHub issue: https://github.com/open-webui/mcpo/issues/313 mcpo turns an MCP server into an OpenAPI endpoint, which makes it the layer that decides who gets to reach those tools — a natural spot for an optional agent-trust check before the call is proxied through. it verifies the caller's AgentCert + a live TrustScore per call and returns allow / deny / annotate. we ship it as a small MIT service (`ghcr.io/pdxlab/agentcert-tag`), so mostly a callout from mcpo, or the proxy in front. opt-in, off by default, shadow-mode first (logs, blocks nothing), metadata only. is an optional trust gate something mcpo would want? happy to send a reference hook. https://trustmodel.ai/verify