evidence over claims

Don't trust us. Check us.

Every AMC score ships inside a signed evidence bundle. Anyone can verify a bundle offline — without an account, without our servers, and without trusting the person who sent it. This page lets you try that right now, on a real bundle we generated and published.

Verify a real bundle in two minutes

1. Install AMC (free, open source):

curl -fsSL https://agentmaturity.co/install.sh | sh

2. Download the sample bundle we published:

curl -fsSLO https://agentmaturity.co/verify/amc-sample-evidence.amcbundle

3. Save the sample's auditor public key. We publish it here, outside the bundle, because a bundle's own keys never vouch for it. Its fingerprint (SHA-256 of the key file) is eb6f84cc395175206962b8054442619563ceca075ff38a746739cd6df2031945.

cat > amc-sample-auditor.pub <<'EOF'
-----BEGIN PUBLIC KEY-----
MCowBQYDK2VwAyEAiknpzbSC8obwQGVNQZXdMt3yFExL1xzvEoHCg2WA8+U=
-----END PUBLIC KEY-----
EOF

4. Verify it, pinning that key and the fingerprint of the sample's monitor (ledger) key:

amc bundle verify amc-sample-evidence.amcbundle \
  --pubkey amc-sample-auditor.pub \
  --expect-monitor 93a2ad7bebb2e8b93a0de857710f9c39205f3dd29e23c8557291a0c4a470610f

You should see this, with exit code 0:

Bundle verification PASSED

Without the two pins, the same command prints Bundle verification FAILED, names each signing key as not-pinned with its fingerprint, and exits 1. Anyone can re-sign a forged bundle with a fresh key and ship that key inside it, so AMC trusts only keys you pinned from outside the bundle. Adding --allow-unpinned --allow-unanchored gives an integrity-only result: exit code 2 and an UNTRUSTED: line, never a pass.

AMC checks the bundle's signatures, hash chain, and manifest — fully offline. If a single byte had been edited after signing, verification would fail. Try it: flip one character anywhere in the file and run the command again. We did exactly that while publishing this page, and verification failed as it should.

The published sample's SHA-256, if you want to checksum the download itself:

b5860614cf52ef621693e41241c0c608c455538431263ac58aa1e18bb6029441

What this proves — and what it doesn't

It proves integrity. The bundle you verified is exactly what was signed. Nobody edited the score, the evidence, or the timestamps afterward.
It does not prove quality by itself. A signed bundle of weak evidence is still weak evidence — that's why AMC reports evidence readiness separately from the artifact seal, and marks scores claim-eligible only when readiness is READY. The published sample is a fresh baseline run: valid, signed, and honest about containing no accepted evidence yet.

Verify anyone's agent the same way

When someone hands you an AMC bundle — a vendor, a contractor, a teammate — ask them for their auditor public key and monitor key fingerprint, recorded when their vault was created, through a channel other than the bundle: their website, your contract, or a signed trust list. Then run the same commands. You don't need their infrastructure, only those keys from outside the bundle:

amc bundle verify their-agent-evidence.amcbundle \
  --pubkey their-auditor.pub \
  --expect-monitor <their monitor key sha256>
amc bundle inspect their-agent-evidence.amcbundle

To pin many issuers at once, use a signed trust list (--trust-list and --trust-root); see the trust-list guide.

Verify our releases too

The installer itself is verifiable: it downloads a pinned GitHub Release, checks every archive against the published SHA256SUMS, and refuses anything that doesn't match. Our published test counts are enforced by the test suite itself — the number and the suite are checked against each other, so the badge can't silently drift.

How the scoring works

The full methodology — levels, evidence tiers, decay, gates, and the compliance-framework crosswalk — is public: methodology · framework crosswalk.