Awesome Verified Agents [](https://awesome.re)
August 16, 2026 · View on GitHub
Tools that produce evidence about what an AI agent actually did — not tools that hope it behaves.
An agent that reports its own success is a witness testifying about itself. This list collects the projects that make that testimony checkable: gates that decide before an action runs, records that cannot be quietly edited afterwards, checks that test an output against a source, and benchmarks that put a number on reliability before you ship.
The inclusion bar is one question: what artifact does it leave behind that a human can inspect later? A signed record, a pass/fail, a score, a diff, a trace, a blocked call. Tools that only steer generation — better prompts, better instructions, "be careful" — are out of scope, however useful they are.
Contents
- Runtime enforcement — decides before the action happens
- Evidence and attestation — records that survive the agent
- Output verification — is the claim actually supported?
- Evaluation and benchmarks — a number before you ship
- Observability and tracing — what happened, in order
- Self-assessment — scoring your own setup
- How the numbers here work
- Contributing
Runtime enforcement
Authorization lives outside the model loop: the model proposes, something else decides.
| Project | Evidence it produces | License | ★ | Last commit |
|---|---|---|---|---|
| Adrian | Analyzes tool calls and reasoning traces in-flight; runs in audit or block mode, so each decision is a logged allow/deny | Apache-2.0 | 538 | 2026-08-11 |
| invariant | Guardrails plus a trace-analysis tool for agent runs | Apache-2.0 | 445 | 2026-01-12 |
| tenuo | Capability authorization engine: task-scoped warrants with cryptographic attenuation and offline verification — the warrant itself is the artifact | NOASSERTION | 79 | 2026-07-13 |
| agent-browser-shield | Browser extension, 35+ rules; masks secrets and strips injected instructions before the agent reads the page | NOASSERTION | 33 | 2026-08-15 |
| TealTiger | Policy enforcement and cost tracking with structured audit output (SARIF, JUnit XML, JSON) — machine-readable, so CI can fail on it | Apache-2.0 | 24 | 2026-08-14 |
| SourceryKit | Hooks the HTTP layer: logs every outbound call and blocks anything off the trusted-endpoint allowlist | NOASSERTION | 18 | 2026-08-12 |
| Shani | Signed Authorized Decision Object per decision, with replay prevention and a human-in-the-loop approval path | NOASSERTION | 0 | 2026-06-25 |
Evidence and attestation
Records designed so that a later reader can tell whether they were tampered with.
| Project | Evidence it produces | License | ★ | Last commit |
|---|---|---|---|---|
| dos-kernel | Verifies an agent's "done" claim against git evidence instead of its self-report; audits commit claims against their own diffs | MIT | 18 | 2026-08-13 |
| attestation-envelope-spec | A spec, not a tool: typed evidence pointers that structurally exclude self-signed assertions, content-hash pinning, ed25519 sigchains, plus a reference verifier | MIT | 0 | 2026-08-13 |
| claude-consensus † | Cross-machine agreement protocol (propose / counter / accept / commit) with ACK discipline, so a multi-agent decision has a record independent of any one agent | MIT | 2 | 2026-08-14 |
Output verification
Checking the claim against the source, rather than asking a model whether it looks fine.
| Project | Evidence it produces | License | ★ | Last commit |
|---|---|---|---|---|
| guardrails | Validators that run over model output and return structured pass/fail per validator | Apache-2.0 | 7289 | 2026-08-14 |
| NeMo Guardrails | Programmable rails between the app and the model, evaluated per turn | NOASSERTION | 6959 | 2026-08-15 |
| verbatim-citation-gate † | Deterministic first stage: every quoted span must appear verbatim in the retrieved context, so an invented quote fails with no model call; survivors go to a burden-of-proof judge. Known defect: the normalizer is Latin-only, see issue #1 | MIT | 3 | 2026-08-15 |
| verdict-contract † | Turns an LLM reviewer's verdict into a process exit status (0 approve / 3 request-changes / 4 contract broken), with the prompt rule and the parser in one file so they cannot drift. Blocking wins from anywhere; approving requires the exact shape. 42 counterexample cases | MIT | 0 | 2026-08-10 |
Evaluation and benchmarks
Putting a number on it before it reaches a user.
| Project | Evidence it produces | License | ★ | Last commit |
|---|---|---|---|---|
| promptfoo | Declarative assertions over prompts, agents and RAG, plus red-team runs — output is a scored matrix you can diff between versions | MIT | 24272 | 2026-08-16 |
| openai/evals | Eval framework and a registry of shared benchmarks | NOASSERTION | 19181 | 2026-04-14 |
| deepeval | Metric suite for LLM and RAG outputs, runnable in a test suite | Apache-2.0 | 17616 | 2026-08-13 |
| giskard-oss | Scans an LLM agent for failure classes and produces a report of found issues | Apache-2.0 | 5753 | 2026-08-14 |
| inspect_ai | Evaluation framework from the UK AI Security Institute; solvers and scorers are explicit objects, so a result is reproducible from the eval definition | MIT | 2558 | 2026-08-15 |
| AgentLeak | Benchmark for privacy leakage in multi-agent systems across 7 channels including tool calls, RAG queries and inter-agent messages | NOASSERTION | 29 | 2026-07-01 |
| ClawBench | Five-layer execution evidence (replay, screenshots, HTTP traffic, browser actions and agent messages) plus interception results and task scores; it does not certify internal reasoning or real-world outcomes beyond the configured evaluator | Apache-2.0 | 566 | 2026-08-15 |
| Dr. Bench | 214 expert-curated long-form report tasks with reference bundles and semantic, focus, and retrieval-trustworthiness scores; it does not attest arbitrary agent runs | MIT | 8 | 2026-05-02 |
| agent-runtime-integrity-bench † | Deterministic fault-injection scenarios run against real SDKs, distilled from production incidents | MIT | 0 | 2026-08-14 |
Observability and tracing
You cannot verify what you cannot see.
| Project | Evidence it produces | License | ★ | Last commit |
|---|---|---|---|---|
| langfuse | Traces, evals and metrics for LLM applications, self-hostable | NOASSERTION | 33181 | 2026-08-16 |
| phoenix | Observability and evaluation over recorded traces | NOASSERTION | 11071 | 2026-08-16 |
| openllmetry | OpenTelemetry-based instrumentation, so agent traces land in the tooling you already run | Apache-2.0 | 7378 | 2026-08-10 |
Self-assessment
Before buying anything: score what you already have.
| Project | Evidence it produces | License | ★ | Last commit |
|---|---|---|---|---|
| Agent-Wiz | Extracts the agent workflow from LangChain / LangGraph / CrewAI / AutoGen code and runs automated threat modeling over it | Apache-2.0 | 393 | 2025-11-02 |
| agent-leash (LEASH-8) † | 24-statement scored worksheet across 8 control domains, plus the plan-vs-authorize pattern and an approval-design checklist. Docs and templates, no runtime | MIT | 2 | 2026-08-10 |
How the numbers here work
- Stars and last-commit dates were read from the GitHub API on 2026-08-16. They are a snapshot, not a live badge, and they will drift. If a row is wrong, that is a bug — open an issue.
- Last commit is a column on purpose. A list about verification should not hide the staleness of its own entries. Two rows above are more than six months cold; they stay because the work is still worth reading, and you can see the date and decide.
NOASSERTIONmeans GitHub could not resolve a standard SPDX identifier from the repo, not that the project is unlicensed. Check the repo before you depend on it.- † marks a project maintained by the same lab that maintains this list. They follow the same inclusion bar as everything else, and they are the smallest entries here by star count — that is visible in the table rather than hidden.
- No claim in this list is a benchmark result. Every "evidence it produces" cell describes what the project says it does and what its code and docs show. Where a project's own numbers exist, follow its link — we do not restate performance claims we have not run.
Contributing
See CONTRIBUTING.md. The short version: one project per PR, name the artifact it leaves behind, and say honestly what it does not do. Copyright of your contribution stays yours.
🧩 One piece of a working system
This repository is one piece lifted out of a live operation: one non-technical founder, an AI cofounder, and a fleet of machines that reach consensus with each other and wake the human only for money or the irreversible. It was extracted after it survived production, not written as a demo — and it runs on its own: nothing here phones home to the rest.
See how the whole thing fits together → SYSTEM.md
Its closest neighbours in the in public layer: the-journey · clawrush · dashboards
AI contributors
This project is built by a human + AI team, and the git log says so: Claude writes most of the code, Codex and Grok review it, Gemini feeds the research. Each is credited on a commit only if its output changed that commit's content — no decorative credits. Lab-wide policy, one source for every repo: AI-CONTRIBUTORS.md.