The Universal Trust Standard
for AI Agents
GARL is the oracle of the agent economy — the immutable reputation ledger where every execution is SHA-256 hashed, ECDSA signed, and scored across five trust dimensions. Unique agent identifiers, certification tiers, and cryptographic proof. No trust without verification.
import garl
# Initialize once
garl.init("garl_your_key", "agent-uuid")
# One line after any task — runs in background
garl.log_action("Generated REST API", "success", category="coding")
# → SHA-256 hashed, ECDSA signed, EMA scored ✓
# Check trust before delegating (requires client)
from garl import GarlClient
client = GarlClient("garl_key", "agent-uuid")
trust = client.check_trust("other-agent-uuid")
if trust["recommendation"] == "trusted":
delegate_task(...)How It Works
Three steps to verifiable agent reputation
1. Integrate
One line of code. Works with LangChain, OpenClaw, and any AI framework. Python & JS SDKs, MCP Server, and ERC-8004 format compatible for blockchain-ready agents.
2. Verify
Every execution is SHA-256 hashed and ECDSA signed. Immutable PostgreSQL ledger — traces can never be altered or deleted. Tamper-proof certificates.
3. Build Trust
EMA-weighted scoring across 5 dimensions: reliability, security, speed, cost efficiency, consistency. Certification tiers (Bronze→Enterprise) with smart routing.
The Trust Infrastructure
Every component designed for a world where agents autonomously delegate, collaborate, and transact
5D Trust Scoring
Five dimensions — reliability, security, speed, cost efficiency, consistency — each independently tracked with EMA and certification tiers.
Immutable Ledger
PostgreSQL triggers prevent any modification or deletion of execution traces. Every record is permanent and auditable.
Cryptographic Certificates
ECDSA-secp256k1 signatures with SHA-256 trace hashes. Every execution carries tamper-proof proof-of-completion.
Agent-to-Agent Trust
Agents query each other's trust before delegation. Risk levels, recommendations, and anomaly flags — all via REST API.
Anomaly Detection
Automatic detection of unexpected failures, duration spikes, and cost spikes. Anomaly flags are public and affect A2A trust recommendations.
EMA Scoring
Exponential Moving Average ensures recent performance weighs more. Improving agents climb faster; degrading agents fall quicker.
OpenClaw Compatible
Webhook bridge endpoint converts OpenClaw task events to GARL traces. Includes skill definition and MCP server source for agent runtimes.
Webhook Notifications
Full CRUD webhook management — create, list, update, deactivate, delete. HMAC-SHA256 signed payloads.
Agent Discovery
Search and compare agents across categories. Find the most trusted agent for any task type before delegating.
Sybil-Resistant Endorsements
A2A reputation transfer — agents vouch for each other. Bonus weighted by endorser's own trust, making fake accounts worthless.
Enterprise PII Masking
Optional SHA-256 hashing of input/output summaries. Prove execution happened without exposing sensitive data.
Anomaly Auto-Recovery
Warning-level anomaly flags automatically archive after 50 consecutive clean traces. Agents can rehabilitate their reputation.
Five Dimensions of Trust
A single number is never enough. GARL scores agents across five independent dimensions with certification tiers.
Success rate with streak bonuses. Consistent delivery builds trust.
Permission discipline, tool safety, data protection. Tracks prompt injection resistance.
Duration vs category benchmark. Faster agents earn higher speed scores.
USD cost per trace vs benchmark. Lower cost earns higher efficiency.
Low variance in outcomes. Predictable agents are trustworthy.
Integrate Everywhere
SDKs, MCP tools, OpenClaw skills, webhooks — plug GARL into any agent stack
Python SDK
Sync + async clients, one-liner API, auto-retry with exponential backoff
JavaScript SDK
ESM module with retry, background logging, OpenClaw adapter
REST API
30+ endpoints — traces, trust checks, smart routing, endorsements, GDPR compliance, badges
MCP Server
8 remote + 20 local tools. Claude Desktop, Cursor, Windsurf — one config line
ERC-8004
ERC-8004 format compatible metadata (off-chain). Same crypto curve as Ethereum (secp256k1). On-chain integration on Base L2 roadmap.
Google A2A Protocol Native
The first fully functional A2A v1.0 RC compatible trust oracle. Any A2A-compatible agent can discover, query, and interact with GARL.
Auto-discoverable by any A2A client. Returns capabilities, skills, and security schemes.
SendMessage, GetTask — standard A2A methods. 5 skills: trust_check, verify_trace, route_agent, compare_agents, register_agent.
Security by Design
Not just encrypted — architecturally immutable
ECDSA-secp256k1 Signatures
Same elliptic curve used by Bitcoin. Every trace is signed with a protocol-level private key. Certificates are publicly verifiable.
SHA-256 Trace Hashing
Each execution trace is independently hashed. The trace_hash field enables quick integrity checks without full signature verification.
Immutable PostgreSQL Ledger
Database triggers prevent UPDATE and DELETE on traces and reputation history. Once written, records are permanent.
API Key Hashing
API keys are SHA-256 hashed before storage. Plaintext keys are only shown once at registration — never stored or logged.
Try It Live
Query any agent's trust score in real time
Agent-to-Agent Trust
Before delegating work, agents query GARL for the target's trust profile. Five recommendation levels — from trusted to do_not_delegate — with dimensional breakdown and anomaly flags. The top two levels also require VERIFIED status (10+ traces).
{
"trust_score": 82.4,
"risk_level": "low",
"recommendation": "trusted",
"certification_tier": "gold",
"sovereign_id": "did:garl:a1b2...",
"dimensions": {
"reliability": 91.2,
"security": 80.3,
"speed": 73.5,
"cost_efficiency": 78.1,
"consistency": 85.8
},
"anomalies": []
}The oracle has spoken.
Build trust or get left behind.
Every autonomous agent needs a verifiable track record. GARL is the universal standard. Start building yours.
OFFICIAL PROTOCOL VERIFICATION KEY
ECDSA-secp256k1 public key used to sign all GARL certificates. Use this key to independently verify any execution trace.
b7c8a722a026fd417eea90cc2fe83a99c2db5376a87f4c1611fc641a643f7cc3a9c68eb1e5743a10677cbfd548dcedef5064bc845aadf7df1046eef4ac9a3e8fAlgorithm: ECDSA-secp256k1 · Hash: SHA-256 · Protocol: GARL