Agent Trust Kit

Make every AI-agent handoff explicit: select what leaves, record what returns, and recheck evidence before you trust or merge it.

Delegating code is easy. Keeping the handoff narrow—and deciding whether the returned result deserves trust—is the hard part. Agent Trust Kit gives the controller an inspectable packet, an explicit evidence record, and an independent verification step.

Tool	Boundary it adds
agent-packet	Builds an allowlist-based handoff archive and rejects known private paths, links, unsafe archive structures, and secret-like text.
agent-receipt	Records claims and evidence, then lets a controller repeat explicitly selected checks inside a controller-chosen workspace.
Native Hermes plugin	Adds project registration, operator approval, a fixed return quarantine, and controller-owned verification.

The intended flow is:

trusted controller -> inspectable packet -> remote worker
trusted controller <- changes + receipt <- remote worker
trusted controller -> independent checks -> accept or reject

Start here

• Follow the complete Hermes/OpenClaw handoff
• Install and use the native Hermes plugin
• Understand the security boundary
• Review the local validation record
• Read the first native Hermes dogfood record
• Review the isolated Hermes v0.20.0 compatibility check

Install the Python tools

uv tool install agent-packet
uv tool install agent-receipt

The tools are separate commands so a controller or worker can install only the boundary it needs. pipx install agent-packet and pipx install agent-receipt are equivalent alternatives.

The source repository is public. The tools reduce common handoff mistakes; they do not send packets, sandbox workers, control every Hermes tool, guarantee that sensitive data is absent, prove that a worker was honest, or merge returned changes automatically.

Development

Requirements: Python 3.10+ and uv.

uv sync --all-packages --group dev
uv run ruff check .
uv run ruff format --check .
uv run pytest -q

Package-specific instructions and examples live in each package README. The Hermes/OpenClaw walkthrough shows the complete handoff and independent verification boundary.

Native Hermes integration

The repository root is also a Hermes plugin. It exposes handoff_prepare, handoff_status, and handoff_verify_return, while keeping approval and local paths on the operator-facing hermes agent-trust CLI. Prepare accepts only a registered Git project, explicit include paths, and a clean input commit. Verification uses a fixed private quarantine, requires OUTPUT_MANIFEST.json plus receipt.json, performs a full recheck without executing worker commands, and never merges automatically.

Install the public repository with:

hermes plugins install mauricemohr88-debug/agent-trust-kit --enable
hermes agent-trust project add my-project /path/to/git/project
hermes agent-trust doctor

The plugin is not a global egress gate or OS sandbox. Other Hermes tools, manual transfers, unrestricted same-user terminal access, and a compromised host remain outside its boundary. Read the plugin guide and the threat model before using it with private work.

Want help applying this to a real workflow?

The code and local verification tools are MIT-licensed. If you want a human review of one concrete agent handoff, the 149 € founding pilot includes a prioritized short report, a workflow-specific include/deny policy, one reproducible controller check, and a 30-minute results handoff.

This is a fixed-scope review service—not SaaS, a penetration test, certification, or a guarantee against secrets or malicious workers. The German intake fixes the scope before work starts.

Relationship to Hermes Plugin Guard

Hermes Plugin Guard remains a separate project: it examines a plugin before activation. These tools cover the later handoff boundary. They may be used together but have independent release and support cycles.

Status

• v0.1.0 is the first public beta for the native Hermes plugin, agent-packet, and agent-receipt. Tagged releases publish the two Python tools through PyPI Trusted Publishing without a stored upload token.
• Local lint, the Python 3.10–3.14 test matrix, package builds, wheel-install smoke, and the end-to-end handoff are green; see the local validation record.
• GitHub CI and CodeQL are green on the public main branch. One real non-sensitive native Hermes workflow has now been dogfooded; see the recorded result. Feedback from two outside testers remains an open beta-validation goal tracked in issue #3; it is not presented as completed evidence.
• An isolated compatibility check against Hermes v0.20.0 (official tag v2026.8.3) passed the plugin-load and focused smoke coverage; it is not a claim that this repository has been live-upgraded. See the compatibility record.

MIT licensed. See SECURITY.md for responsible reporting.