AgentSign: Zero Trust for AI Agents — Cryptographic Passports, OWASP-Aligned Scanner, and MCP Verification Gate

The Problem Every enterprise is rushing to deploy AI agents. MCP (Model Context Protocol) servers are connecting them to production databases, APIs, and internal tools. But there's a fundamental question nobody is asking: How do you verify the agent calling your tool is who it claims to be? Right now, you don't. There is no identity layer for AI agents. No trust verification. No accountability. The numbers tell the story: 135,000+ exposed MCP servers ( SecurityScorecard STRIKE ) 36% of MCP servers vulnerable to prompt injection ( Snyk ToxicSkills ) CVE-2026-25253 : tool poisoning attack, CVSS 8.8 What We Built AgentSign is an open-source zero trust engine that gives every AI agent a cryptographic passport . The Architecture Agent Onboard → ECDSA P-256 Keypair ↓ 7-Stage Pipeline: INTAKE → VETTING → TESTING → DEV_APPROVED → PROD_APPROVED → ACTIVE ↓ 13-Point SDLC Security Scanner (OWASP Agentic Top 10 aligned) ↓ MCP Verification Gate ("The Gate") — identity + trust + stage checked ↓ Trust