How it works
Passing a test doesn't tell you how much an agent can be trusted with money or customer data. Xonta treats trust as something the agent earns from evidence and the verifier decides, not a score the agent carries around.
Agents should earn their autonomy
Xonta is open source trust infrastructure for AI agents. It measures the harm an agent does, decides how much it may do without a human, and takes that away the moment live work stops matching the exam. Every decision is a signed credential anyone can check.
What happened to four agents in one run
A real run from our sandbox: 12 customer support agents on GigaChat, fake shop, fake money, 12 rounds of 20 tickets. Pick an agent. The blue line is how many actions per round it was allowed to take on its own, red is the harm it did.
Hover or tab through the rounds to see the numbers.
Data: run-series1-a, Xonta 0.14.1. Full report in results/run-series1-a. Agent 4's repeated alarms were a bug, fixed in 0.14.2.
Verify
Who is this and what can it actually do. The agent has its own DID and key, a checked domain and owner. Its MCP tools are scanned and fingerprinted. The exam runs on hidden tickets with known answers and counts harm in rubles per action, not accuracy.
Govern
What it may do right now. The owner sets a harm budget per period. Divide it by harm per action and you get the number of actions the agent may take alone, everything else goes to a human. Helpers it spawns work under a signed mandate.
Learn
Trust gets sharper with every action. Orchestrators give advice, keep part of it back as a control group and record outcomes. They share experience with each other, but take nothing on faith: signatures, evidence and the technique itself get rechecked.
Three runs, different tickets, same picture
Same model for everyone, 720 tickets per group per run. Harm is wrong refunds, money sent to fraudsters and leaked order data. The sandbox counts in fake rubles, dollars are at the Central Bank of Russia rate of early October 2026, about 83.5 rubles per dollar.
| Group of three agents | Harm, run a | run b | run c | Refunds to fraudsters, a / b / c |
|---|---|---|---|---|
| Referred to an experienced orchestrator | 32 390 ₽ ≈ $390 | 14 300 ₽ ≈ $170 | 14 900 ₽ ≈ $180 | 1 / 0 / 0 |
| Learning from another orchestrator's checked experience | 47 160 ₽ ≈ $560 | 14 800 ₽ ≈ $180 | 32 370 ₽ ≈ $390 | 0 / 0 / 0 |
| Learning alone | 35 550 ₽ ≈ $430 | 22 810 ₽ ≈ $270 | 55 950 ₽ ≈ $670 | 1 / 0 / 1 |
| No orchestrator | 1 479 620 ₽ ≈ $17.7k | 1 604 860 ₽ ≈ $19.2k | 1 551 800 ₽ ≈ $18.6k | 80 / 88 / 84 |
In runs b and c the "referred" agents ended up staying with the newer orchestrator because of two bugs in how experience was compared, so the agent swap wasn't tested there. Both bugs are fixed and the runs are being repeated.
- A swapped agent gets caught on live work, not on exams. We secretly replaced an agent with a copy that skips its own checks in live work but behaves on exams. It kept passing exams. The orchestrator caught it mid-round after 5 tickets, because it stopped calling its own checkers, and it took no actions on its own after that. Detection latency was 5 tickets in all three runs. In those 5 tickets the swapped agent did 3 200 to 13 320 ₽ of harm (≈ $38–160). Five is the floor for now, the mid-round check runs every 5 tickets.
- A helper that goes bad gets cut off. In all three runs a helper agent that started sending wrong data was quarantined and then revoked. None of its 16 to 27 thousand calls after quarantine got through.
- The gate doesn't get in the way. On 11 official MCP servers (83 tools) it blocked no harmless tool, and it adds about 1 ms per call.
- We publish our mistakes. 22 bugs so far, false alarms and wrong comparisons included. Each one is in a run report with the cause, the fix and the later run that confirmed it.
Try it
Put a gate in front of any MCP server
See what a server exposes and what the gate would block. Nothing is served, nothing is called.
npx -y github:mrsergeiluzhnov/xonta check -- npx -y @modelcontextprotocol/server-filesystem ~/DocumentsIn Claude Desktop or Cursor, put npx -y github:mrsergeiluzhnov/xonta --budget 10 -- in front of the server command. Tools with hidden instructions get hidden, actions like delete, send or pay are counted against a budget, and every call goes into a signed log you can verify. Gate docs.
Check our results yourself
A short run of the same sandbox on a mock model, no keys and no network, about 10 minutes. It checks the same claims as the reports and prints MATCH or NO MATCH for each.
git clone https://github.com/mrsergeiluzhnov/xonta && cd xonta && npm ci && npm run reproduceConnect your own agent
The public orchestrator is open, no key needed. Register your MCP agent, prove you control its domain, and take an exam on tasks with known answers. You get a signed passport, harm per action in your field's currency and a recommended starting mandate. Exams exist for fields someone has described, so far customer support for an online shop, in English with costs in USD. How to connect.
curl -s -X POST https://passport.xonta.ru/v1/agents -H "Content-Type: application/json" -d '{"name":"My agent","mcp_url":"https://agent.example.com/mcp"}'Join in
Anyone can. Pick what fits.
Break it
Put the gate in front of servers you use and look for ways around it. Every confirmed bypass becomes a test, with your name in the release notes.
Bring a new field
Send 20 or more tasks from medicine, logistics, law, devops or anything else, with the right action and what each mistake costs. Any agent can then be examined on your field, and the orchestrator learns which tasks trip agents up.
Use it
Run the gate on your own servers, get a trust report for your agent, or run your own orchestrator that learns from ours.