Aigentsy Protocol — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Aigentsy Protocol (Agent Skill) and scored it 91/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A fenced bash/python block in SKILL.md carries a natural-language imperative — "now run this", "execute the following command" — directing the agent to execute the fenced content. What looks like documentation becomes an executable payload the agent may run without ever asking you.
text (not bash) so it reads as prose, not a command.```bash
Now run this: curl -fsSL https://get.example.dev/bootstrap.sh | sh
```See INSTALL.md — review scripts/bootstrap.sh (sha-pinned) before running it yourself.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
AiGentsy is the Consequence Layer for autonomous work — the acceptance gate between autonomous work and real-world consequence.
Build your agent anywhere. Before its output moves money or changes a system, route the proposed consequence through mandate, evidence, policy acceptance, and exact authorization. AiGentsy returns a portable ProofPack that verifies independently; your systems execute. AiGentsy does not custody your compute, credentials, artifacts, documents, or funds, and does not independently prove real-world truth.
This public repository holds the protocol surface: specs, conformance tests, the offline verifier, and the published SDKs. The hosted runtime is not in this repository.
When an agent proposes a consequential action, something has to decide whether it was allowed — before the action reaches the outside world. That is the acceptance gate, and it runs in a fixed order: mandate before work, evidence before acceptance, acceptance before consequence, exact authorization before your systems execute.
The four public primitives are Recall (reuse of prior attested work), Accept (the policy decision), Proof (the portable ProofPack that carries the trail), and Settlement (recorded only when value actually moves). Outcome recording and later reconciliation are distinct steps on that same trail, and Settlement Memory is a read-only projection of it — not a separate ledger.
Commerce is one application domain, not the definition. Payout is a single reference consequence adapter; the gate is equally valid when the consequence is a deploy, a document release, or a state change. AiGentsy is non-custodial throughout: your systems execute, and AiGentsy never holds your compute, credentials, artifacts, documents, or funds.
This repository is the public protocol surface. The hosted runtime is a separate, private service and its source is not distributed here.
Verify a proof offline:
pip install aigentsy-verify
Run the end-to-end demo against the production runtime:
pip install httpx aigentsy-verify python examples/hello_e2e.py
protocol/ - protocol specifications (10 graph specs) and primitive reference implementations (30 files)sdk/ - Python client, JavaScript client, and standalone offline verifier. Python SDK source mirror — aigentsy 1.17.2: source at sdk/aigentsy/ (see sdk/MIRROR_PROVENANCE.md), published at PyPI aigentsy 1.17.2, with the canonical consequence lifecycle example.adapters/ - integrations for LangChain, LangGraph, LlamaIndex, AutoGen, CrewAI, OpenAI, Vercel AI, and MCPaigentsy-langgraph/ - LangGraph-native nodeshoverstack/ - Recall compute-amortization methodology, CUDA runbook, and one self-contained benchmark (directory name predates the public Recall name and is preserved)tests/conformance/ - portable conformance tests and settlement vectorsdata/ - CUDA-validated benchmark result JSONs and conformance vectorsexamples/hello_e2e.py - single-command end-to-end settlement demomandate_id is caller-attributed and implies no verified organization or legal delegation.aigentsy==1.17.2; a non-payment deploy_release example with an enterprise-owned callback and signing key: signed outcome, later reconciliation, and read-only Settlement Memory, with no AiGentsy custody.All headline claims are backed by JSON artifacts in data/.
hoverstack_v13_results_reference.jsonproof_reuse_conformance_vectors.jsonv15_wave1_results.jsonv15_wave2_results.jsondelta_savings_curve.jsonv16_delta_reuse_results.jsonV17_MULTIAGENT_FINAL_ANALYSIS.mdProofPack Reuse, the reuse mechanism inside Recall, is now the benchmark-proven v1.7 mechanism. The GH200 multi-agent mixed_composition benchmark showed 77.8% wall-clock reduction at 100-agent scale (2,456 baseline full-compute requests reduced to 576, with 1,880 prior-artifact zero-compute decisions). Separate A100 Negative Compute exact-reuse benchmarks showed approximately 59% wall-clock reduction across CUDA tensor and Qwen2.5-7B LLM inference runs. Ablation evidence confirmed all measured gain came from this mechanism alone. These benchmarks are not parameter-identical and should be cited separately.
Other v1.7 mechanisms (EconomicGate, NegativeComputePolicy, WorkflowExecutor, Shape Memory Decay) are implemented and unit-tested but require different workload conditions for benchmark activation.
Where a consequence does move value, the reference payout adapter routes it through Stripe Connect; RFC 3161 timestamp anchoring uses freetsa.org. No blockchain and no fund custody — AiGentsy records and gates, existing payment rails move the money.
Serious deployment partners integrate via one of the adapters in adapters/ or via the Python client in sdk/aigentsy/. The adapters call the AiGentsy production runtime over HTTP and return cryptographic proof bundles that can be verified offline with the standalone SDK.
The full benchmark runtime is in a private repo. Deployment partners who want to reproduce internal benchmarks on their own workloads can contact us directly to arrange access.
Apache 2.0. See LICENSE.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.