Proposal: Agent Trust Cards (ATC) — SSL certificates for AI agents

[edgarfloresguerra2011-a11y]

Proposal: Agent Trust Cards (ATC) — SSL certificates for AI agents

Context

OpenAI's function calling API is the standard for GPT-based agents. As agents built on OpenAI's API increasingly call external MCP servers and interact with other agents, trust becomes critical.

Agents increasingly call external tools and other agents. But there's no standard way to verify:

• Is the agent/tool I'm calling who it claims to be?
• Has it been security-audited?
• Has its key been revoked?

This is the same problem the web had before SSL.

What I built

ATC (Agent Trust Card) — a lightweight trust layer for agents, inspired by SSL certificates:

• Ed25519 signed by a Certificate Authority (MarketNow Sentinel CA)
• Verifiable by anyone with the CA public key (public on GitHub)
• Revocable — compromised agents are flagged in real-time
• Sentinel-scored — each ATC includes a 0-10 security audit score from an 8-layer pipeline (L1.5 metadata → L1.8 YARA-equivalent malware family detection)

API

Issue:   POST https://marketnow.site/api/atc {"action":"issue", agent_id, public_key}
Verify:  GET  https://marketnow.site/api/atc?action=verify&card_id=X
Revoke:  POST https://marketnow.site/api/atc {"action":"revoke", card_id}
CA key:  GET  https://marketnow.site/api/atc?action=ca-key
List:    GET  https://marketnow.site/api/atc

Links

• Live: https://marketnow.site/atc
• GitHub: https://github.com/edgarfloresguerra2011-a11y/marketnow
• Release v1.5.0: https://github.com/edgarfloresguerra2011-a11y/marketnow/releases/tag/v1.5.0
• Dev.to: https://dev.to/edison_flores_6d2cd381b13/ai-agents-need-their-own-ssl-heres-why-i-built-it-1njk

Not asking for adoption — just sharing in case the trust-layer pattern is useful. Feedback welcome.

— Edison Flores, AliceLabs LLC