Start here

TrustOS is a trust control plane for AI agents. In Preview it finds agents on this machine (or in repos you choose), puts them in a registry, and shows risk from declared tools. When something actually runs through the gateway, it records a decision. Default mode is MONITOR — it logs what would happen and does not block.

1. Scan a folder on Scan. TrustOS reads MCP configs and framework fingerprints. It never runs what it finds and never fetches remote MCP URLs.
2. Open Agents and assign an owner. No owner means Unmanaged.
3. Watch Approvals and Decisions once real tool or model calls happen. Those pages stay empty until something actually waits or is decided.

Open http://localhost:8787 after npm run dev. The sidebar on the left is the control panel for this console.

Control panel

The sand strip on the left is the control panel. It stays put while the main area changes. On a narrow window, use Menu (top of the page) to open it; Escape closes it.

Home

Risk surface and live activity from the last scan. Scanning lives on Scan.

Agents

Everyone we found, owners, and MCP servers.

Scan

Pick a local folder, a Git repo, n8n, or an Agent Card. TrustOS only reads files.

Approvals

Calls that should wait for a person. The orange badge is how many are still waiting.

Policies

Draft, activate, roll back, and simulate bundles. A draft never turns on by itself. Refresh reloads bundles and starter packs from this server — it does not activate anything.

Monitoring

Fleet MONITOR vs ENFORCE, backend status, and the verdict contract.

Decisions

Every recorded decision, plus fleet MONITOR / ENFORCE.

Evidence

Proof for auditors: hash chain, framework controls, export.

Insights

Drift and suggestions from the decision log. Nothing applies itself.

How to use

This page. At the bottom of the control panel.

Preview chip

This build is Preview, not production ENFORCE. Default is MONITOR.

Skip to content jumps past the sidebar. URLs use a hash: #report, #discovery, #agents, #agent/…, #guide. The first visit also offers a short tour of Scan.

Scan

Choose where TrustOS looks. It only reads files. It never runs what it finds and never fetches remote MCP URLs.

Local folders

Paste a path or Browse. Shortcuts (Home, Desktop, Documents, Downloads) are jailed under home. Use this folder, then Start scan. Optionally also scan well-known home MCP paths.

Git repositories

Personal access token, not a GitHub App login. List an org, pick repos, then Scan selected. Tokens are not echoed back.

n8n

Instance URL (workflow JSON only). We never execute nodes.

Agent Cards

A2A Agent Card URL (parse only — we never follow URLs inside the card).

Open Scan

Words you will see

Pills always include a text label. Color is not the only signal.

Agent status

Unmanaged

No owner assigned. Highest inventory risk until someone claims it.

Monitored

An owner is assigned. In Preview this is not a live monitor — it is inventory status.

Enforced

Policy is meant to take effect for this agent. Fleet default may still be MONITOR until you switch mode.

Verdicts

ALLOW

The call may proceed. Only evaluate may mint ALLOW.

BLOCK

The call is denied (stored as DENY). In MONITOR this is logged as what would happen.

REQUIRE_APPROVAL

Park the call until a person approves or denies it once.

HALT

Stop this path. Stronger than a single tool deny.

Fleet mode

MONITOR

Logs the verdict. Never blocks. Default for new agents and for Preview.

ENFORCE

ALLOW, BLOCK, REQUIRE_APPROVAL, and HALT take effect. Do not skip a MONITOR soak.

Unknown on an MCP server means the scan saw no declared tools — not that the server is safe. Empty tools: [] is unknown, not low risk.

Home

Home opens the Dashboard: last-scan counts plus live activity. Charts stay empty until something is real. Open this page from the control panel.

Open Dashboard

Environment

Local limits the report to the local environment. All includes every tagged environment from the last scan.

Refresh

Reloads report, activity, approvals, and control-plane health.

Scan sources

Opens Scan. Folder pick, Git, n8n, and Agent Cards live there — not on Home.

Export

Appears after a scan. Downloads JSON or CSV of agents, MCP servers, owner rollup, and highest-risk tools. Format is a modal; nothing is sent off this machine by the download itself.

Numbers and charts

Agents

How many agents the last scan registered.

Unmanaged

Agents with no owner.

Approvals

Parked calls waiting for a person — not a count of tools.

Actions

Recorded tool or model calls in the activity window.

Verdict mix

Share of monitored actions by ALLOW / BLOCK / REQUIRE_APPROVAL / HALT.

Activity over time

Calls grouped by hour or day.

Risk

Declared tool capabilities: destructive, write, external, financial. Empty tool lists are unknown, not safe.

Allowed vs blocked

Decisions stacked by time bucket.

Top risky agents

Blocked and halted calls, not a reputation score.

Tool call volume

Most-used tools in this window.

Activity by hour

Weekday and hour heatmap of monitored calls.

Agent, MCP, and tool

Each row is one path: the agent uses that MCP, and the MCP exposes those tools. Long names wrap instead of overlapping.

Activity

Live feed of tool and model calls. Empty until something actually runs.

Needs attention

Approve or block once from Home without opening Approvals.

After a scan, Home also shows by-owner rollup and highest-risk tools. Charts stay empty until there is real data — they do not invent a fleet.

Agents

The registry: who we found, whether anyone owns them, and the MCP servers they wire to.

Open Agents

Search

Filters agents, owners, and tool names on this machine’s registry.

Status

All, Unmanaged, Monitored, or Enforced.

Table

Name, source, owner, status, tool count. Click a row to open that agent. Sort by name, owner, or tools.

Scan now

Empty state opens Scan. Nothing is rewritten.

MCP servers

Name, where it was found, declared tools, and a risk pill (High / Medium / Low / Unknown). Unknown means no tools declared — not safe.

Agent detail

Open an agent from the Agents table. The URL looks like #agent/the-agent-id. Back returns to the list.

Owner

Save an email or handle. Clearing it returns the agent to Unmanaged. Owners are preserved across re-scans.

Tools

Declared tools and capability tags from the last scan (write, destructive, external, financial, unknown).

Guardrails

Pattern, regex, and entropy checks — not a model. Kind: PII, secrets, toxicity, NSFW. When: Pre (before the call) or Post (on output). Create from template or add your own. Test runs a sample and does not set last triggered.

Violations

Guardrail hits for this agent, when any exist.

Recent

Recent actions for this agent only. Empty until something actually runs.

Approvals

Anything that should wait for a person lands here. Empty until a call is parked. Approve or deny exactly once — a second click does not change the first decision.

Open Approvals

Queue

Waiting requests only. Approve lets the call proceed; Block denies it. Decided requests move to History.

History

A time-ordered React Flow graph for one request (pan and zoom when it is long), plus a text timeline that scrolls inside its own box so color is not the only signal. ⌘K opens the command palette.

Analytics

Shows when there is volume: top rules and tiers, counts by day. Auto-approve is not a silent skip of the human step.

Reassign

Hand the waiting request to another email or handle when that action is offered.

Policies

Cedar-shaped JSON bundles — not AWS Cedar. A draft never activates itself. Sign-off is not activate.

Open Policies

Policy bundles

Each row is a versioned bundle. Activate turns it on. Rollback returns to the previous active bundle. Refresh reloads from the store.

Active bundle rules

The rules currently in force, with their effect (allow, deny, require approval, halt).

Tier map

Tool-name patterns mapped to risk tiers 1–5. Higher tiers are more sensitive.

Policy review sign-off

When required, Activate is blocked until enough people sign off. Sign-off does not turn the bundle on — use Activate after.

Recent activations

Who activated or rolled back which bundle, and when.

Simulate

Replays the last 200 logged decisions through a candidate bundle. Dry-run only. The log stores agent and tool, not args. This is policy replay, not a prompt-injection product.

NL → policy draft

Keyword matcher, not an LLM. Describe a rule, get a diff. Activate this draft is explicit and optional.

Starter packs

Install a known-good starting bundle (for example finance). Still a draft until you activate.

Refresh

Reloads bundles, active rules, sign-offs, activations, and starter packs from this server. It does not scan a folder, activate a draft, or switch MONITOR / ENFORCE.

Monitoring

Whether the fleet is watching or blocking, and which backends are up. Preview watches. It does not enforce until you switch to ENFORCE.

Open Monitoring

Mode

MONITOR logs what would happen and never blocks. ENFORCE makes ALLOW, BLOCK, REQUIRE_APPROVAL, and HALT take effect. This is the fleet default. Decisions can also show a per-agent override.

Backends

Whether the gateway and related paths are available on this install.

Recent decisions

Verdict counts from the last 200 stored decisions.

Verdict contract

ALLOW, BLOCK, REQUIRE_APPROVAL, HALT — the four outcomes evaluate can return.

Decisions

Every recorded decision. Empty until a real tool or model call is decided. Sample evaluate calls on this page are computed live but are not written to the log.

Open Decisions

Fleet mode

MONITOR logs what would happen. ENFORCE makes ALLOW, BLOCK, REQUIRE_APPROVAL, and HALT take effect. This is the fleet default; a per-agent override can differ.

Digest

Total, ALLOW, REQUIRE_APPROVAL, BLOCK for the current window.

Filters

Search agent or tool; filter verdict and minimum tier; last 50–500 rows.

Table

Time, agent, tool, verdict, mode. Select a row for the inspector.

Inspector

Overview of the selected decision. Review is a false-positive / true-positive label only — it never changes the verdict or policy.

Override

Set MONITOR or ENFORCE for one agent, optionally one risk tier. Look up shows the current override.

Usage

Analytics for call volume in this window.

Reviews

False-positive review list. Labels are reviewable; they do not rewrite the log verdict.

Mode changes

Audit of who changed MONITOR / ENFORCE, for which agent or fleet scope.

Evidence

Proof for auditors from records TrustOS already has. Not a posture percentage.

Open Evidence

Continuous compliance

Chain status, last anchor, evidence packs, and Tier 4+ in the last 90 days. Re-evaluate refreshes the mapping.

Chain

Re-verify the hash chain. Export CSV of the audit table.

Framework controls

Covered, partial, or missing from live records. Open a pack to see the mapping.

Retention

How long decisions are kept. Apply retention now runs the sweep.

Chain anchors

Daily head hashes. Anchor chain head now writes the current head.

Audit table

Filter by agent, action, rule, and verdict.

Insights

Drift and suggestions from the decision log. Nothing applies itself.

Open Insights

Recompute analysis

Rebuilds baselines, drift events, and suggestions from the current log.

Drift events

Agents whose recent behavior diverged from their own baseline. Score is local, not a fleet rank.

Suggestions

Pending policy or ownership ideas. You apply them elsewhere; this page never auto-activates.

Benchmark

A local cohort note, not a live peer fleet.

More pages

These are in the console but not on the control panel. Open them by URL hash.

Fleet #fleet

Environments, governability, governance status, resolved enforcement mode, pending approvals by tier, drift note, and policy assignments. Precedence: agent → team → environment → global override → active bundle. Resolve an agent name to see the chain.

Open Fleet

What Preview does not do

• Scan never executes MCP command / args and never fetches remote MCP URLs.
• Default mode is MONITOR. ENFORCE is available in the UI but is not production-ready as GA — soak in MONITOR first.
• NL draft is a keyword matcher, not an LLM. Simulate is policy replay, not a red-team or prompt-injection SKU.
• GitHub / GitLab connect is a personal access token, not a GitHub App OAuth login.
• Charts and counts are empty until you scan or until real calls happen. Nothing is invented for the demo.
• Guardrails are pattern / regex / entropy. They are not a model and do not claim accuracy percentages.

A copy of this guide also lives in the repo at docs/CONSOLE_GUIDE.md.