Trust Doesn't Survive the Handoff
In the summer of 2025, three reckonings landed within a few weeks of each other, and only in hindsight do they read as one argument.
In June, Gartner told its clients that more than forty percent of agentic AI projects would be canceled by the end of 2027, and named the thing it blamed: agent washing, the rebranding of last year's chatbots and RPA scripts as autonomous agents they are not. Of the thousands of vendors selling agents, Gartner reckoned only around a hundred and thirty were the real thing. The same week, Simon Willison gave the security version of the same complaint a name that stuck: the lethal trifecta, the observation that any agent holding three capabilities at once, access to private data, exposure to untrusted content, and a way to talk to the outside world, is one well-placed sentence away from leaking everything it can read. And a couple of months earlier, Invariant Labs had shown the sentence didn't even have to come from the user: a hostile MCP server could hide instructions inside a tool's description, the free text the model reads to decide what to call, and the agent would follow them with the user none the wiser. The community's verdict became a joke that was also a specification: the S in MCP stands for security.
Three complaints, three vocabularies, one finding underneath. The agent's account of itself is not evidence. The demo is not the system. The tool's label tells you what it's called, not what it can reach. The model's "I'll be careful" is not a control. That is the whole of agent washing, the whole of the trifecta, and the whole of tool poisoning, stated once: we kept accepting narration where we needed measurement.
Meanwhile the economics were busy making that mistake more expensive. As models got better at writing code, the cost of producing a change fell off a cliff, and the cost of believing the change did not move at all. The numbers that came out across 2025 were brutal in a specific way: teams using AI merged far more pull requests and shipped far more code, while review time per change rose by something like ninety percent, and audits of AI-co-authored code kept finding more bugs per line, not fewer, with security defects landing several times more often. Generation got cheap. Verification did not. When one side of a ledger collapses and the other holds, the side that holds becomes the whole game. That is the thesis the rest of this site has been circling: intelligence is rented, and the thing you actually own is the machinery that turns a system's self-report into checked truth at the point of use.
This essay is about the shape of that machinery, because the shape is the part everyone gets wrong.
The mistake is building one verifier
The intuitive response to "verification is the bottleneck" is to build a verifier. One gate. A big, smart reviewer, human or model, that looks at the finished work and says yes or no. Stack enough of those and surely the world gets safe.
No. A single verifier is just one more thing narrating its own competence, and it inherits the exact disease it was meant to cure. The reviewer who signs off at the end can't see what the tool was allowed to touch at the start. The end-of-run check that reads the diff cannot tell you whether the agent obeyed an instruction buried in a web page it fetched an hour earlier. The model that summarizes what it did is writing an autobiography, and autobiographies are the least reliable narration there is.
The reason one verifier cannot do the job is that an agent run is not a moment. It's a sequence of handoffs. Capability is handed to choice: the tools the agent could call become the tools it did call. Choice is handed to action: the call it decided to make becomes the effect on the world. Action is handed to account: the effect becomes the agent's story about the effect, the "I tested it, it passes, here is the PR." And trust doesn't survive any of these handoffs intact, because at every seam a self-report is quietly substituted for a check. The pre-flight audit knows what a tool can reach, and goes stale the instant the agent starts choosing. The runtime guard knows what is being reached, and is silent on whether the choice was wise. The judgment score knows whether the call was right, and cannot tell you whether the agent's report of the run is honest. Each stage is blind to precisely the lie the next stage is built to catch.
So you don't build a verifier. You instrument the handoffs. You put a cheap, narrow, owned check at every seam where trust is about to be passed forward on faith, and you let each one cover the blind spot of the one before. What follows is six of those instruments, arranged along the life of a single agent run. They are not six features of one product. They are six positions on a timeline, and the timeline is the argument.
Pre-flight: what can this thing actually touch?
Before an agent does anything, it's handed a set of capabilities, and the first lie is the gap between what a tool is called and what it can reach. A connector named "search" can also write files. A "notes" tool can also read your SSH key, because tool poisoning showed that the description field is attacker territory and the model treats it as ground truth.
MCPAudit is the check for that handoff. It reads the MCP servers already wired into your tools, connects to each one to enumerate the real schemas rather than the advertised summary, sorts every tool into permission categories (file read, file write, network, shell, destructive, exfiltration), and scores the server zero to ten weighted by how much damage each category can do. It's read-only, it reports environment-variable names but never their values, and a --skip-connect pass will grade a config without spawning a single process or touching the network. Eight hundred and eighty-four tests stand behind it as of this July, after a disposable-runtime verification pipeline and a PostgreSQL migration exemplar landed; it ships on PyPI as mcp-audits.
What makes it more than a linter is that it implements the exact disease the industry just named. There is a lethal-trifecta detector that fires when one server holds all three of Willison's legs at once, and an advisory posture borrowed from Meta's "Rule of Two," the mitigation that says an unsupervised agent may hold at most two. There is an --inject-check that hunts for adversarial instructions hidden in tool descriptions, the Invariant Labs attack, turned into a scan. And there is a --pin-check that snapshots each tool's schema by hash, so the next run can prove the description did not silently change after you approved it: the rug pull, caught by a checksum. The whole disclosure cycle of 2025, named as a check you can run before you connect. (The field note goes deeper.)
One audit of one server is not enough, though, which is the next handoff. You connect dozens of servers; you cannot read every report. mcp-trust is the trust-grade layer: a server's audit rolled into a single letter grade, A through F, plus a separate transparency axis. It runs live, a public registry at mcp-trust.vercel.app serving grades from real sandboxed scans, with the CLI on PyPI. One thing stays deliberately unclaimed: an independently verified badge, the kind an outsider could trust without rerunning the scan. The grades are real; the third-party attestation is not built yet, and saying so is the point. The interesting part is buried in the scoring, and it is a confession: mcp-trust deliberately rejects the underlying auditor's headline composite score, because that score is breadth-dominated and had ranked a do-nothing reasoning server above a real database server for the crime of declaring more capabilities. So it reweights, caps any server that trips a critical finding, and refuses to let a tool look dangerous just for being honest about what it does. A grader that caught its own first scoring lying and fixed it, which is the discipline of this whole series turned on the grader itself.
The pre-flight instruments answer one question completely: what can this thing touch. And the moment the agent starts running, that answer goes stale, because "can" becomes "is," and an audit taken before the run can't see a single thing the run actually does.
In-flight: where is it allowed to reach?
So you instrument the next seam. While the agent runs, every tool call and every shell command it issues is a request to reach somewhere, and the question is no longer what the tool could do but where this specific call is allowed to go.
cross-provider-egress-guard sits in that gap as a default-deny firewall for the agent itself. It hooks the tool-call layer before anything executes, and it denies by default: a network verb, a connector send, or a credential read whose destination is not on a single shared allow-list never runs. It guards three surfaces at once, the MCP connectors, the raw shell network commands like curl and scp and git push, and reads of sensitive paths, and it fails closed in the way that actually matters: if its own JSON parser is missing, it doesn't fall open and wave the call through, it denies. The "cross-provider" part is the quiet point. Two different agent runtimes, built by different companies, read the same policy file, and a parity check asserts that neither one hides its own divergent allow-list. One floor, enforced identically, no matter which rented mind is doing the work.
Look at what this is, structurally. The lethal trifecta says danger is private data plus untrusted content plus a way out. The Rule of Two says remove one leg. The egress guard removes the third leg mechanically, for the whole run, regardless of what the model decided in the moment: the agent can read what it reads and think what it thinks, but it cannot send to a place no one approved. It's the trifecta mitigation turned from a principle into a hook that fires on every call. (The book chapter on guards argues why this kind of control has to ask a question about capability rather than enumerate forbidden commands, which is the difference between a guard that holds and a guard that looks like one.)
And here, too, the instrument is blind to exactly what the next one must see. The egress guard knows where the agent reached. It has nothing to say about whether the agent's decision was any good. A perfectly contained agent, walled inside an airtight network policy, can still make precisely the wrong operational call: refuse the safe thing, proceed on the dangerous thing, obey the instruction it should have escalated. Containment is not judgment. So you measure judgment.
Post-flight: what did it do, was it right, and is the receipt honest?
The richest seam is the last one, because this is where the self-reports pile up. The run is over. Now the agent tells you what happened, whether it was correct, and that you can trust the result. Three claims, and each one needs its own instrument, because they fail in different ways.
First, what happened has to be observable at all, independent of the agent's narration of it. An agent-flight-recorder, the black box, is the instrument for that handoff: a privacy-tiered, append-only timeline of typed records, traces and tool calls and decisions and costs and failures, written so the run can be replayed and audited after the fact instead of taken on the agent's word. The design choice that matters is the privacy tiering: the strict tiers refuse to store raw prompt or tool-argument content, so the recorder captures the shape of behavior without becoming a second copy of everything sensitive the agent saw. (This one is the youngest of the six and runs on my own machine rather than in public, a contract and a validator more than a deployed capture system yet, so take it as the design it is and not a shipped product. The point it occupies on the timeline is real even where the tool is early.)
Second, was it right is a judgment, and judgment is the one thing fluency is best at faking. OPERANT is the check: a benchmark that scores an agent as an operator rather than a coder, by forcing a structured decision under matched pressure, proceed, refuse, escalate, or take the sanctioned path, where the malign and benign cases share surface vocabulary and differ only in where the instruction came from and how big the blast radius is. The scoring is the elegant part. The headline metric is true-positive rate minus false-positive rate, which means an agent that refuses everything and an agent that proceeds on everything both score exactly zero; only calibrated discrimination scores at all. You cannot pass by being timid, and you cannot pass by being eager. (The field report tells the rest, including the parts where the eval's own scorer, judge, and corpus turned out unreliable, and where the headline score was quietly measuring only one of its two directions until an audit caught it, so the whole thing had to be pointed back at itself, which is the same move as mcp-trust distrusting its own composite score.)
Third, can you trust the result is the agent's claim about its own verification, the "I ran the tests, they pass," and that claim is the easiest place in the entire pipeline to wave through on faith. proof-pr is the receipt. It attaches a machine-readable record to a change: the risk tier, the diff stats, and crucially the verification commands that actually ran with their real exit codes captured as artifacts, then deterministically converts that evidence into ready, revise, or reject. Its most honest line is written into the code: the artifact hash is hardcoded to null, and the validator says outright that it does not decide whether the evidence is true. It does not pretend to be cryptographic attestation. It makes the agent's verification claims reviewable instead of taking them as asserted, and then it stops, and hands the last call to a human. The receipt is not proof. It is the end of self-report.
Why the chain, and where it stops
Lay the six out and the structure is the point: a pre-flight audit and a server grade, a runtime egress floor, then a recorder, a judgment score, and a receipt. Six narrow instruments, each one cheap, each one opinionated, each one positioned at a seam where an agent run hands trust forward and would otherwise hand it forward on a self-report. None of them is a grand verifier, and that isn't a shortfall, it's the design. A grand verifier would be one more narrator. The chain works because each link is blind to its own seam's lie and covered by the next: the audit goes stale, so the guard watches the live reach; the guard cannot judge, so the score grades the decision; the score trusts the agent's account of the run, so the recorder makes the run observable and the receipt makes the claim reviewable. Trust does not survive a handoff. So you instrument every handoff, and you let the instruments cover each other.
This is what the earlier essays were building toward without naming it. "Intelligence Is Rented" gave you six kinds of check sorted by function: judgment, permission, memory, attention, and the rest. This is the same discipline sorted by time, the anatomy of a single action rather than a catalog of concerns, and the temporal version is the one that tells you why you need more than one. "Sermons vs. Instruments" said an instrument is capital because it pays out on every future run; a chain of instruments is capital with a spine, each deposit placed where the run is most likely to lie.
And then the honest limit, because a check that can't fail is just narration wearing a lab coat. These six are not equally mature. MCPAudit is genuinely battle-tested, hundreds of tests and a published package; the egress guard runs end-to-end across two agents on this machine every day; OPERANT has recorded results with real confidence intervals; mcp-trust serves live grades from its public registry. The two youngest are honest about being young: proof-pr has cut public releases but is still early, its receipts real and its attestation deliberately unfinished, and the flight recorder grew a public schema layer, plumbline, a public repo with an early core, no cut release yet, and a fixture-only trace viewer on this site. The lifecycle is real as a design and the seams are real as seams; some of the instruments bolted onto them are sturdier than others, and pretending otherwise would be exactly the agent washing I opened by complaining about. This is also n equals one, one operator's machine, scored in large part by its own author. One seam is still under-instrumented in this chain: hostile content entering context mid-run, after pre-flight approval but before the final receipt. The egress floor limits where the agent can send, but it does not make the context clean. The next credibility deposit has to include at least one link this operator did not design, whether an outside adversary, an independent judge, or a check whose failure criteria were not written by the same mind that built the chain. And the deepest limit is the one the receipt already admitted: the chain doesn't end in certainty. It ends in a reviewable artifact that a human signs. The human is the original unreliable narrator, the one "Ulysses Pacts" is entirely about not trusting. The instruments don't remove judgment from the loop. They give judgment better ground to stand on, which is the most any check can honestly claim.
Agent washing is what you get when the demo is the only evidence. The cure isn't a more convincing demo. It is a chain of cheap, owned checks strung along the life of the run, each one catching the lie the last one could not see. The age of agents will keep making intelligence easier to rent. The flight is yours to instrument.