Agent Manifest

Prove what your agent was, not just who called it

Specification  |  Getting Started  |  Examples  |  Changelog

Developer Preview. Launched at Confidential Computing Summit, June 23 2026.

A signed JWT proves who called an API. It proves nothing about the agent that made the call.

Agent Manifest binds the ten artifacts that define an agent (system prompt, policy bundle, tool schemas, model identity, RAG corpus, memory state, the decision-log baseline, A2A delegation chain, supply chain provenance, and human-in-the-loop approvals) into one hardware-attestable, tamper-evident record. A signed manifest makes agent identity provable to any third party who has no reason to trust the operator. Runtime decisions remain separate TRACE or OCSF records; the manifest commits to the audit-chain root current at issuance so a verifier can join later evidence to the approved deployment without treating post-hoc evidence as deploy-time identity.

Quick start

pip install agent-manifest

# Generate a signing key pair
manifest keygen -d ./keys/

# Sign a manifest
manifest sign draft.json --key keys/private.hex -o signed.json

# Verify
manifest verify signed.json --public-key keys/public.hex   # VALID

--public-key accepts the raw Ed25519 public key generated by manifest keygen.

Python SDK:

from agent_manifest import AgentManifest, sign_manifest

manifest = AgentManifest(
    name="payments-processor",
    system_prompt_hash="sha256:a1b2c3...",
    model_id="claude-sonnet-4-6",
    policy_bundle_hash="sha256:d4e5f6...",
)
signed = sign_manifest(manifest, key=signing_key)

Resources

📖 Full documentation	manifest.agentrust-io.com
📄 Specification	spec/agent-manifest-spec-v0.2.md
📦 PyPI	agent-manifest
🔗 TRACE integration	trace-spec
💬 Discussions	GitHub Discussions
📋 Changelog	CHANGELOG.md

Relationship to Agent Plugins

Agent Manifest is not a package format and does not compete with one.

Agent Plugins 1.0 defines how Agent Skills and MCP server configuration are packaged and moved between clients. Its FUTURE_CONSIDERATIONS.md leaves provenance verification, trust model and permissions to future versions. Agent Manifest starts where that stops: it binds what was actually loaded at deployment, including the resolved tool schemas rather than the declared servers, to hardware, so a third party can check that the agent that ran is the agent that was published.

Put briefly, Agent Plugins describes what a client should install and a manifest describes what actually ran. A plugin bundle is an input to a manifest. See specification section 6.5.

Standards alignment

Targeting CoSAI Working Stream 4, an OASIS Open Project. 197 conformance tests against the formal specification. Integrates with TRACE for hardware-rooted attestation.

Contributing

See CONTRIBUTING.md and GOVERNANCE.md.