Open-source ecosystem

An accountability layer for agents that act

When an agent takes a consequential action and the outcome is wrong, three questions usually have no good answer: what did it rely on, could that have been checked before it committed, and can the action be undone. These tools answer all three, on one shared model of what makes an agent auditable.

Before deployment

Detect

Scan agent code and tool configurations for risks that would otherwise surface only at run time.

agent-audit

At execution

Enforce

Gate a tool call before it commits, and write a signed, tamper-evident record of the decision.

Aegis

After the commit

Recover

Replay a decision against current state, and reverse the action when its basis no longer holds.

auditable

01 / Components

One framework, three tools, and a map

The three tools each install and run on their own; awesome-auditable-ai is a curated index rather than software. What makes them an ecosystem is that they cover a single agent action end to end, against one shared definition of auditability.

Component	Role	Stars	Forks	What it does	License
Auditable Agents	Framework	—	—	Five auditability dimensions, the detect / enforce / recover model, and the Auditability Card, a disclosure format for stating which guarantees a system offers.	paper
agent-audit	Detect	211	26	Static scanner for agent code and Model Context Protocol configurations. 51 rules mapped to the OWASP Agentic Top 10, with taint analysis. Works with LangChain, CrewAI, and AutoGen.	MIT
Aegis	Enforce	343	38	Runtime policy enforcement with human-in-the-loop approval and a kill switch. Writes Ed25519-signed, hash-chained decision records. No changes to agent code.	MIT
auditable	Recover	19	1	Captures what a decision relied on, replays it against live state, and reverses a committed action when the basis fails. One typed graph across past, present, and future.	Apache-2.0
awesome-auditable-ai	Map	20	10	Curated index of papers, tools, datasets, benchmarks, and standards for building and auditing reliable agents.	CC0-1.0

The same gate, other policy domains

Two further repositories run the same check at the same point in the lifecycle: they intercept an action before it commits and apply a declared policy. What differs is the policy. One governs prose, the other governs shell and filesystem commands, so neither belongs in the detect / enforce / recover core above. They are worth naming anyway. agent-style is the most-starred repository in the family, and together the pair is the evidence that the enforcement mechanism carries past agent security into any domain where a policy can be declared.

Component	Role	Stars	Forks	What it does	License
agent-style	Enforce · prose	617	32	A 21-rule writing ruleset with a pre-write hook that blocks a non-conforming file write before it lands, plus adapters for several agent runtimes.	CC-BY-4.0, MIT
anywhere-agents	Enforce · harness	212	24	Portable agent configuration carrying a pre-tool-use risk classifier that gates destructive git, publish, and filesystem commands across agent harnesses.	Apache-2.0

Star and fork counts recorded 11 August 2026; about 1,400 stars across the six repositories. Counts move; the roles do not.

02 / The ecosystem, connected

What sits around the core

An ecosystem is layered. The shared framework sits at the centre; around it orbit the tools that implement it, the independent work that cites or benchmarks against it, and the coverage and support that carry it outward. Hover any node to trace its ties.

Framework Tools Independent work citing or benchmarking it Rings are ecosystem layers. Independent work is shown because it is externally checkable; it does not indicate endorsement or adoption.

03 / Independent uptake

Other groups have started to cite and benchmark this

These are early and specific signals rather than proof of broad adoption. They are listed with sources so anyone can check them, including the places where the record is still thin.

Used as a baseline

An independent behavioral-firewall paper evaluates against Aegis as the pre-execution system to beat, citing it by exact title.

12.8%

attack success, Aegis

2.2%

attack success, theirs

Dang, Enforcing Benign Trajectories · arXiv:2604.26274

Cited as prior art

“Our contribution is therefore not the enforcement mechanism, which pre-execution systems such as AEGIS … already establish.”

Reason Less, Verify More · arXiv:2607.07405

Adopted as vocabulary

“Auditable Agents frames recoverability, policy checkability, responsibility attribution, and evidence integrity as system properties … Agent Audit analyzes code and deployment artifacts before execution.”

Accentrust, with Georgia Tech and UIUC affiliations · arXiv:2607.25364

Placed in a survey

“Agent Audit … inspect policies, applications, skills, or runtime evidence to produce audit or compliance artifacts.”

Agentic Services Computing · arXiv:2509.24380

Also citing the framework: AgentBound Decision Evidence Maturity Model arXiv:2607.01641 arXiv:2604.15367

04 / Governance

Where this ecosystem actually stands

A publicly accurate account matters more than a flattering one, especially for tooling whose job is to make other systems inspectable. Both columns are current.

Today, plainly

Each repository is effectively maintained by one developer. No component yet has a second regular committer.
The six repositories carry four license types, MIT, Apache-2.0, CC0-1.0, and CC-BY-4.0, and grew up in separate personal accounts. The most-starred one splits content from code licensing, which GitHub's own license metadata cannot express.
There is no shared release process, no cross-component interface contract, and no published governance model.
The Auditability Card has been referenced by others, but no independent project has published a completed Card yet.

What this organization is for

Hold the components under one umbrella, so the ecosystem's identity does not depend on any individual maintainer's personal or commercial pages.
Publish a component manifest and one working cross-component interface, so a finding, a policy decision, and a recovery record can refer to the same action.
Publish a governance model covering maintainer appointment, succession, release authority, and conflict handling, plus a security policy with coordinated disclosure.
Grow a contributor base past one maintainer per repository, which is the main thing between this and a sustainable ecosystem.

05 / Taking part

Contributing, reporting, disclosing

Contribute

Each repository takes issues and pull requests directly. Good entry points are new detection rules for agent-audit, policy examples for Aegis, and additions to awesome-auditable-ai.

Report a vulnerability

Please do not open a public issue for a security problem. Reporting routes differ by component today, and a single coordinated process across the ecosystem does not exist yet. Aegis publishes a private email contact and accepts encrypted reports. agent-audit publishes a policy. auditable and awesome-auditable-ai have no published policy yet; contact their maintainer privately rather than filing an issue. Establishing one disclosure process, with published response targets, across every component is part of the work this organization exists to do.

Publish an Auditability Card

The Card is a disclosure format for stating which accountability guarantees a system provides, described in the framework paper. No independent project has published one yet. If you publish the first, open an issue and it will be listed here.