Metal Mantra
Public evidence reports for AI agents
Free3 impressionslaunches Oct 131 comment
Comments
>log in to commentHey Dev Hunt 👋 I built Metal Mantra because every "AI agent directory" I found ranked agents by who pitched best, not by what the code does. Paste a public GitHub repo and get a public report: findings with their source, scan scope (files eligible vs read, what stays unknown) and domain evidence. Five weighted pillars, deterministic rules, no AI in the scanner. Bug worth sharing: for monorepos we first read the first 80 files, which were examples, so we judged a framework by its demos. Files are now ranked source-first. The sampling strategy is part of the claim. A score is never a security certification. There is also a read-only MCP server (metalmantra.io/mcp) so agents can call verify_trust before delegating. First scan is free: metalmantra.io/scan. Tell me which rules feel wrong.
- Free first public agent signal scan
- Four-step process: name, inspect, publish, revisit
- Versioned static checks across five evidence pillars
- Public registry of AI‑agent evidence reports
Metal Mantra scans public AI agent repositories with deterministic rules and publishes a transparent evidence report.
- for
- Developers and teams that build or manage AI agents and need open source security evidence.
- pricing
- freemium · free trial
Key features
- Five-pillar static scan — Applies weighted rules on security, guardrails, schema, cost and trust to generate a score.
- Public evidence report — Creates a readable report showing source, findings, limits and domain ownership.
- Domain ownership verification — Checks DNS TXT records and HTTPS to prove control of the agent's domain.
- Re-audit passes — Allows paid re-scans when code or controls change, updating the public report.
- Registry listing — Adds the scanned agent to a public registry for discoverability.
- Read-only MCP server — Provides a public read-only server at https://metalmantra.io/mcp for accessing reports.
Use cases
- Validate the security posture of an AI agent before integrating it into a product.
- Verify domain ownership and public code provenance for compliance audits.
- Compare multiple agents using standardized evidence scores.
- Maintain an up-to-date public record of agent changes for stakeholders.
Metal Mantra pricing
- First signal$0Five-pillar static scan · Public evidence report · Registry listing · One re-scan after DNS verification
- Re-audit pass$29/3 scansThree re-scans for one repository · Updated public report · No subscription or auto-renewal
Metal Mantra FAQ
What does the free scan include?+
It runs the five-pillar static scan, produces a public evidence report, lists the agent in the registry, and includes one re-scan after DNS verification.
Is Metal Mantra a security certification?+
No, it provides an automated signal and evidence report, not a certification or compliance guarantee.
How are findings presented?+
Findings are shown with source locations, impact descriptions and suggested fixes, with critical details withheld for 30 days.
Can I re-scan my agent after changes?+
Yes, a paid re-audit pass ($29 for three scans) lets you update the report when code or controls materially change.
What does the domain trust score represent?+
It reflects DNS verification and HTTPS checks, contributing 15% to the overall signal score.
Summarized by DevHunt from metalmantra.io · Oct 9, 2026. Details may change; check the official site.
