TrustFix

Getting started

What TrustFix is

The verifiable authority layer for non-human and AI-agent identity — a platform that proves what an identity may do, and (optionally) enforces it.

TrustFix is a security platform for the identities that aren't people — the non-human identities (NHIs) and AI agents running modern estates: CI/CD pipelines, service accounts, IAM roles, OIDC-federated workloads, MCP tool servers, and autonomous agents.

Most tools in this space detect those identities after the fact, or broker and rotate their credentials. TrustFix's job is different: it makes what an identity is allowed to do discoverable, scored, and — where it can be proven — cryptographically provable.

Detection tells you an agent exists. TrustFix makes what it may do provable — and revocable with a signed kill-switch.

Prove it, then enforce it

There are two halves to securing a non-human identity, and TrustFix is honest about which half is the default.

  • Prove it (the platform, today). TrustFix discovers your NHIs and agents, finds the real risk, scores trust, issues born-verified authority, and records everything as Ed25519-signed, hash-chained, Merkle-anchored entries in a Trust Ledger anyone can verify offline — with zero access to your tenant. This is the control plane, and it ships now.
  • Enforce it (the optional Gate tier). Inline-blocking a live tool call that exceeds scope is the Gate proxy runtime tier. The fix-gate verdict stream is live; per-request runtime interception is a separate deployment, and we label it as such rather than imply it is always on.

Where something is provable, it is attested. Where it isn't, it is shown honestly as observed or empty — never asserted. That discipline is the product: we'd rather attest 70% provably than 100% by assertion.

What the platform does

  • Discover — read-only, agentless grants inventory your NHIs and agents across AWS, GCP, Azure, GitHub, GitLab, and Bitbucket. There is nothing to install in your workloads.
  • Find the real risk and score trust — surface toxic combinations that compose into attack paths, a per-credential leak profile, and a signed, offline-verifiable per-agent trust score.
  • Issue and delegate authority that is born verified — replace a static secret with a secretless one only when the math proves it grants no new access; bind an agent to an Agent Passport; and revoke instantly with a signed kill-switch.
  • Generate audit-grade evidence — a control-mapped, signed evidence pack and public, offline-verifiable Trust Receipts an auditor checks with no tenant access.

The platform vs. the open-source CLI

TrustFix ships in two forms:

  • The platform — the full multi-tenant product described throughout these docs: the connected estate, the screens, the Trust Ledger, the Policy Intelligence Engine, and the evidence pack. Start at the platform quick start.
  • The open-source oidc-audit CLI — a free, standalone scanner that checks your AWS IAM roles for GitHub Actions OIDC trust-policy misconfigurations from your terminal or CI, with no account required. See the open-source CLI section.

The CLI is a focused slice of one detector family; the platform is the verifiable authority layer. You can run the CLI today and adopt the platform when you're ready to prove and govern authority across your whole estate.

Platform quick start →