The ecosystem front door for cMCP, TRACE, and Agent Manifest. Vendors and community projects integrate here, on their own terms, under published rules - while the core repos stay first-party.
| Repo | What belongs there | Who contributes |
|---|---|---|
| cmcp, agent-manifest, trace-spec, trace-tests | The standard and reference implementation. Bug fixes and spec feedback welcome; no vendor product code. | Maintainers; community fixes |
| examples | First-party, end-to-end runnable examples, plus flagship partner examples by invitation. Every line is reviewed and every claim verified before merge. | Maintainers; invited partners |
| this repo | Your product's integration with cMCP, TRACE, or Agent Manifest: adapters, exporters, dashboards, policy packs, verifiers. Vendor-maintained. | Anyone, self-serve |
| awesome-ai-governance | Neutral listings of notable agent-governance tools, including ones that do not integrate with this stack. | Anyone meeting the listing criteria |
Community - structure-validated and listed. We check that the directory follows the layout, the manifest validates, the links resolve, and the description makes no claims we can falsify. We do not run your code. The listing says exactly that.
Verified - everything above, plus we ran the integration end-to-end against released packages and confirmed the documented behavior. Verified integrations get the badge in the index and are eligible for the awesome list. Request verification in your PR; re-verification happens at every release that touches your integration.
Tier is recorded in each integration's integration.yaml and is set by maintainers, never self-declared.
TRACE only works as a standard if it is genuinely neutral. Integrations are listed on technical merit under identical rules, including products that compete with anything we build. What gets a submission declined is never who you are - it is unverifiable claims, misrepresentation, or marketing dressed as documentation. See CONTRIBUTING.md for the precise rules.
| Integration | Vendor | Integrates with | Tier |
|---|---|---|---|
| claude-code | agentrust-io | agent-manifest, trace | community |
| Agent Passport System | aeoess | trace | community |
| comply54 | comply54 | trace | community |
| DecisionAssure | DecisionAssure (a1k7) | trace | community |
| LangChain | agentrust-io | trace | community |
| LlamaIndex | agentrust-io | trace | community |
| Nobulex | Nobulex | trace | community |
| OpenShell TRACE Adapter | agentrust-io | trace | community |
| OpenTelemetry GenAI | agentrust-io | trace | community |
| ramen-ai cMCP Adapter | ramen-ai | cmcp, trace | community |
| SAGE AgenTrust Bridge | SAGE AgenTrust Bridge | cmcp, trace | community |
| Agent Sentinel | a1k7 | trace | community |
| Shadow AI Discovery | agentrust-io | cmcp, agent-manifest | community |
| Agentic SpendGuard | SpendGuard | trace | community |
| agentrust-codex | agentrust-io | agent-manifest, trace | community |
| scheduled-agents | agentrust-io | trace | community |
| Framework | Adapter | Released framework exercised in CI | Evidence boundary |
|---|---|---|---|
| LangChain | LangChain | Yes — LangChain Core 1.6.0 callback contract | Tool identity and outcome plus model identity; no chain topology or runnable state |
| LangGraph | LangChain | Yes — LangGraph 1.2.11 StateGraph with a nested tool call |
Propagated tool callbacks; no nodes, edges, state transitions, checkpoints, or rollback decisions |
| LlamaIndex | LlamaIndex | No — current tests use representative event objects | Allow-listed tool and model fields; released-framework interoperability remains unverified |
“Adapter exists” and “released framework exercised” are separate claims here. The adapter README documents the evidence each callback surface can support; a missing graph or state concept is not inferred into the TRACE record.
The Copilot, Cursor, Windsurf and
Gemini CLI drift checks are intentionally outside this manifest
index: none of them emit TRACE or Agent Manifest today, so none can truthfully
select an integrates_with value from the current schema. See the note below.
All seven engines share agentrust-capture-core,
which owns fingerprinting, comparison, baseline sealing and the report honesty rules.
Adapters that build a Trust Record from evidence another system produced share
agentrust-trace-adapters. Records built through it
carry origin.kind: third-party-control-plane, runtime.platform: software-only and
appraisal.status: none, so the assurance downgrade is something a consumer reads from
the record rather than from a README. None of the three is a parameter.
Note on the Copilot, Cursor, Windsurf and Gemini CLI entries. Each is a
pull-request status check rather than a session hook, because all four agents'
composition lives in the repository rather than a developer's home directory.
Each emits no TRACE record and no Agent Manifest, so each claims neither:
integrates_with offers only cmcp, trace and agent-manifest, and asserting
one today would be an unverifiable claim.
That is currently blocked on a spec question rather than on implementation, tracked
in agent-manifest#256.
TRACE describes an execution and these checks describe a composition, so a TRACE
record is the wrong artifact. Agent Manifest is the right one, but every level
requires artifacts.model_identity, and a repository cannot know the model: each
of these agents picks it at session time from the user's own plan and settings.
The same repository serves every model, with an identical contributed composition.
Manufacturing a model to satisfy the field would be exactly the kind of
unverifiable claim CONTRIBUTING.md rules out, so all four integrations ship
without one until the spec has a way to express a composition whose model is
unknowable at authoring time.
Questions, feedback, integration help: Discord.
Apache 2.0. Each integration directory may carry its own compatible license; the manifest declares it.