Trust Needs a Number

If you were a PC gamer at any point in the last twenty years, you know the ritual in your bones. A new game gets announced. You want it badly. And under the desk sits your allowance-grade computer, the one you are quietly worried is not good enough, humming with the anxieties of the underpowered. So before you spend the money and get your heart broken, you go to one website. You paste in your machine's specs. You hold your breath. And it gives you a verdict, clean and merciless: a green check or a red X. Can You Run It. The site is still up, two decades later, and for twenty years it has answered one question with one number: can this machine be trusted with this workload?

We built that. For graphics cards. For frame rates. For whether a nineteen-year-old's hand-me-down PC could handle a shooter.

We never built it for the things we are now wiring directly into payroll, into customer databases, into the systems that move money.

Here is the situation in 2026, stated as plainly as I can manage. An engineer assembling an AI agent today makes a series of trust decisions, one after another, often late at night against a deadline. They pick a model. They pick a framework. They pick a handful of MCP servers and skills, the tools the agent will actually act through. And then they connect the assembled thing to email, to databases, to money. Every one of those component choices is a decision to trust a stranger's code with your credentials. And the trust data available to inform each decision is, in ascending order of respectability: the vendor's own model card, the GitHub star count, the download number, and vibes.

That is genuinely the whole toolkit. Let me take it apart. Stars measure fame, not safety; a beloved project and a safe project are different things, and the correlation is weaker than anyone wants to admit. Download counts measure momentum, and as the ClawHavoc campaign demonstrated when researchers found hundreds of malicious skills riding typosquats and manipulated rankings on a single agent marketplace, momentum is precisely the thing an attacker manufactures first, because momentum is what makes you skip the check. And the model card is, at the end of the day, the seller writing the description of their own horse.

For ordinary code libraries, we solved this a full generation ago. We have CVE databases, security advisories, npm audit, software bills of materials. No serious engineer pulls in a dependency with a known critical vulnerability without at least a meeting about it, because the check is cheap and the tooling is everywhere. For the components AI agents are built from, the equivalent check simply does not exist. Every team is re-deriving trust from scratch, in the dark, and most teams, under deadline, are quietly skipping it and hoping. We are all buying the horse on the seller's description, and then handing the horse the keys to the vault.

The fair that almost burned down

There is a precedent for this exact moment, and I think about it constantly, because it tells you how this story ends if we do it right.

Chicago, 1893. The World's Columbian Exposition, the fair meant to announce America's arrival as a modern power. And the organizers had bet the whole spectacle on the new miracle of the age: electricity. Two hundred thousand incandescent bulbs. Entire palaces outlined in light. The future, switched on, for millions of visitors to walk through and gasp at.

There was one problem. Electricity in 1893 was roughly where autonomous agents are in 2026: transformative, barely understood, and burning things down on a regular basis. Faulty wiring started fires constantly. The insurers looked at the fair's sprawling, improvised, high-voltage guts and saw, accurately, a bonfire with a ticket booth. So they sent a young electrical engineer named William Henry Merrill to inspect the exhibition's electrical systems and tell them how doomed they were.

Merrill did the inspection. And then he saw the much larger opportunity hiding inside the small job. The world did not need one more inspection of one more building. It needed an institution: a permanent laboratory that tested electrical things against published standards, continuously, so that anyone, anywhere, could know at a glance whether a device was safe to trust. The lab he founded the following year became Underwriters Laboratories. That small "UL" mark has since appeared on essentially every toaster, lamp, extension cord, and power strip you have ever bought, and its genius is that you have never once thought about it. You do not research your toaster's fire-safety history before breakfast. Someone did, against a standard, in a lab, years ago, and the little mark on the underside carries the entire result so that you never have to.

Electricity did not scale into the backbone of modern civilization because it stopped being dangerous. It is exactly as dangerous now as it was in 1893; the physics did not change. It scaled because trust in it stopped being anecdotal and became checkable. The mark turned "I heard that manufacturer is pretty careful" into a standard anyone could verify without leaving their kitchen.

Agent components are pre-Merrill electricity. Everything is bespoke evaluation or blind faith. Every team re-derives the trust question from first principles, and most, out of time, skip it and plug the thing in. The moment is even ripe institutionally, the way 1893 was: OWASP recently shipped AISVS 1.0, a security verification standard for AI systems with 514 testable requirements, and the insurance market published AIUC-1 so underwriters can certify agents. The standards are arriving. What is missing is the lab, and the mark. The place you check before you plug in.

So we built the directory

Today we are launching TrustVector: a public, continuously updated trust directory for the components AI agents are built from. Models, agent frameworks, MCP servers. At launch it holds 106 evaluations, and it grows every week.

The scores are not opinions, and the mechanism matters, so let me be specific about it rather than wave at it. Every component in the directory is put through the same evaluation harness that ships inside our open-source scanner, g0. That means adversarial payloads across the attack categories that actually show up in real incidents: prompt-injection resistance, jailbreak resistance, data-leakage behavior under pressure, tool-abuse handling, all of it mapped against the OWASP and MITRE ATLAS frameworks so the results connect to standards a security team already knows. The methodology is published, in full, so you can see exactly how a score was produced. And the per-category results are visible, not just a single letter grade at the top, because a component can be genuinely excellent at resisting injection and genuinely terrible at isolating data between users, and collapsing those into one number would hide the exact thing you most need to see. You get the breakdown, the way a good lab report shows you every test and not just the pass/fail.

Three commitments, and I am putting them in writing here rather than in a footer, because a trust directory is only worth precisely what its rules cost the people running it:

The methodology is public. Every score is traceable to the specific tests that produced it. If you think one of our tests is wrong or unfair, you can read it and argue with it, which is the only kind of transparency worth having.

Disputes happen in the open. Vendors can challenge their findings, and the challenge and its resolution get published right alongside the score, permanently. Corrections become part of the record, the way errata are part of science rather than an embarrassment to be buried.

Scores stand, even when they hurt us. If a component we integrate with, or partner with, or personally built and love, scores badly, the score ships anyway. The day a trust directory starts grading on friendship is the day it silently converts into a brochure, and everyone can smell a brochure. This sentence is in writing specifically so that you can hold us to it later, and so that we cannot pretend we did not say it.

And in Merrill's honor, the piece I am most fond of: embeddable badges. A project can put its TrustVector score right in its README, the way it already displays its build status, so that the mark travels to the exact place the decision gets made. Which is not a boardroom and not a compliance review. It is an engineer at 11pm, browsing components, deciding what to npx into a system that can reach the customer database, wanting one more real signal before they commit.

What this is actually for

Let me be precise about the claim, because directories invite overclaiming and I would rather undersell it honestly.

A trust score will not make a component safe, any more than the UL mark makes your toaster physically incapable of ever burning the bread. That is not what it does. What it changes is the default. Today, the default trust decision for an agent component is uninformed, because informing it requires heroic, bespoke effort that nobody has time for, so almost nobody does it. A public directory flips the economics of that. Checking becomes a ten-second glance. And once checking is a ten-second glance, not checking becomes the thing that requires an explanation. "Why did we wire an unevaluated MCP server directly into payroll?" is a question that only ever gets asked, out loud, in organizations where evaluation was cheap enough that skipping it looks like negligence rather than normalcy. That shift, from "checking is heroic" to "not checking is negligent," is the entire mechanism by which the electrical world became safe. Not perfection. A mark, a standard, and a default that quietly flipped.

I will leave you with the scene this is really for, and then the link. Somewhere in your company, this week, an engineer is going to choose an MCP server the same way we all chose games in 2004: something looks great, everyone in the channel is talking about it, and the only pre-flight check that currently exists is whether the thing runs without erroring. When that engineer, at the last moment, on instinct, goes looking for one more signal, one number from someone who actually put the thing through its paces, I want something to be there for them to find.

It is there now. TrustVector, on guard0.ai. Check before you import. Green check or red X, twenty years later, for the components that can reach your money.

References

1. Can You Run It (System Requirements Lab), the original
2. The founding of Underwriters Laboratories and William Henry Merrill
3. OWASP AI Security Verification Standard 1.0
4. The Hacker News on ClawHavoc and marketplace manipulation
5. Communications of the ACM on AIUC-1 and agent certification
6. g0, the open-source scanner whose harness powers the scores