AgentTrust runtime safety layer for AI agent tool use

Source Summary

What It Contains

The AgentTrust preprint describes a runtime safety layer that intercepts AI-agent tool calls before execution and returns allow, warn, block, or review verdicts for risky actions.

Extracted Claims

• The paper frames modern AI agents as systems that can create real-world side effects through file operations, shell commands, HTTP requests, and database queries.
• It argues that post-hoc benchmarks, static guardrails, and infrastructure sandboxes are incomplete because they may not understand the meaning of an action before it executes.
• AgentTrust intercepts tool calls before execution and returns structured verdicts: allow, warn, block, or review.
• The system combines shell deobfuscation, safer-action suggestions, multi-step attack-chain detection, caching, and LLM-as-judge review for ambiguous cases.
• The paper reports a 300-scenario benchmark across six risk categories plus 630 independently constructed adversarial scenarios, with high reported verdict accuracy under the evaluated rulesets.
• AgentTrust is described as AGPL-3.0 software with a Model Context Protocol server for MCP-compatible agents.

Evidence Quality

Academic preprint on arXiv with a concrete architecture and benchmark claims. Treat the numbers as research claims pending independent replication, but the control pattern is directly relevant to local agent operators because it focuses on pre-execution review of tool calls rather than model-output filtering alone.

Follow-Up

• Track whether AgentTrust publishes implementation details, releases, or independent evaluations that can be mapped into Armorer controls.
• Compare its interception model with Armorer action gates, Docker isolation, credential scoping, and runtime monitoring expectations.