trustops-agent

Policy-enforced AI agent runtime for the TrustOps Platform.

Installs on any machine where you want a Claude-based agent to run. Connects to your TrustOps server via Socket.io, consults the policy engine before every tool call, and signs every emitted log with Ed25519 so the audit chain is cryptographically verifiable.

Install

The recommended install is the one-liner from your TrustOps instance:

curl -sSL https://app.trustops.eu/install.sh | sudo TRUSTOPS_TOKEN=oat_xxx bash

It installs Node 20, creates a trustops system user, sets up a systemd unit, and starts the agent.

Manual

npm install -g trustops-agent
TRUSTOPS_API_URL=https://app.trustops.eu TRUSTOPS_TOKEN=oat_xxx trustops-agent

How it works

1. On startup it loads (or generates) an Ed25519 keypair at ~/.trustops/key.json and registers the public key with the server.
2. On every prompt it installs .claude/settings.json with a PreToolUse hook into the working directory. The hook curls POST /api/policies/evaluate and returns {permissionDecision: "deny", permissionDecisionReason} if the policy engine refuses the tool call.
3. Every log entry is hash-chained per prompt: each log carries prevHash, hash, and signature. The server stores them verbatim and /api/audit/verify?promptId=X walks the chain offline.

License

MIT