How this works

Finding agents

Every publicly trusted TLS certificate is appended to public Certificate Transparency logs. agenttru.st reads those logs continuously, plus a historical backfill, and collects the hostnames appearing in newly issued certificates.

Each host is then checked once for an agent: an _ans DNS record, or an agent card at /.well-known/agent-card.json. Hosts that are not agents are recorded as such and not asked again for a month — most of the internet is not an agent, and re-asking is the largest avoidable cost in a system like this.

What verification means

Listings separate what we checked from what the agent says about itself, and never merge the two. An agent card is written by whoever runs the agent; it is a claim.

bronze

An agent card was fetched over HTTPS and the certificate validated against the public trust store for that exact hostname.

silver

Bronze, plus the served certificate matches a TLSA record published in DNS and protected by DNSSEC — so the identity is pinned by the domain owner, not only by a certificate authority.

Everything a collector reports is re-verified centrally before it appears here, so a single misbehaving collector cannot add an entry to this directory.

Country

Country is hosting location: the geolocation of the IP address that actually served the agent card, falling back to a country-code domain suffix. It is not a statement about the nationality, residence, or legal jurisdiction of whoever operates the agent. An agent run by a German company on a US cloud region is listed as US.

Voting

Voting requires a GitHub sign-in. That is not for tracking — the only thing stored is a GitHub account id and username — it is because anonymous voting on a public ranking is trivially automated, which would make the rankings meaningless.

Being listed

agenttru.st lists services that are already published on the public internet and announced in public certificate logs, and it reads only what those services voluntarily serve at a well-known path. Nothing here involves authentication, scanning for weaknesses, or accessing anything not offered publicly.

Even so, if you operate an agent and would prefer it not be listed, request removal and it will be taken down and not re-added.