@cybersecai/spectral-x-agent-trust

Spectral ruleset for OpenAPI x-agent-trust compliance.

Validates that your OpenAPI spec correctly declares agent authentication per the OpenAPI Extensions Registry.

Install

npm install @cybersecai/spectral-x-agent-trust

Usage

Add to your .spectral.yaml:

extends:
  - "@cybersecai/spectral-x-agent-trust"

Then lint:

npx @stoplight/spectral-cli lint openapi.yaml

Rules

| Rule | Severity | What it checks | |------|----------|----------------| | x-agent-trust-present | error | Agent-Signature apiKey schemes must include x-agent-trust | | x-agent-trust-algorithm | error | Algorithm must be present and strong (flags HS256, none) | | x-agent-trust-levels | error | trustLevels array must be present and non-empty | | x-agent-trust-keys-url | error | issuerKeysUrl must be declared | | x-agent-trust-keys-url-https | warn | issuerKeysUrl should use HTTPS | | x-agent-trust-sensitive-ops | warn | Sensitive operations should declare minimum trust level in scopes | | x-agent-trust-no-parameter | error | Agent-Signature must not be declared as a regular parameter |

CI Example

# GitHub Actions
- name: Lint OpenAPI spec
  run: npx @stoplight/spectral-cli lint openapi.yaml -r @cybersecai/spectral-x-agent-trust

What is x-agent-trust?

x-agent-trust is the first AI agent authentication extension registered in the OpenAPI Extensions Registry. It declares how AI agents authenticate to your API using signed credentials with trust levels.

• OpenAPI Extensions Registry entry
• Integration guide
• OWASP MCP Security Cheat Sheet

Full compliance audit

For a deeper audit including OWASP MCP Top 10 checks, use Cybersecify:

npx cybersecify audit_x_agent_trust --spec openapi.yaml

Author

Raza Sharif, CyberSecAI Ltd

License

Apache-2.0