# Avowa

> Avowa grades AI vendors' security and AI-governance claims by how they are proven — observed live,
> documented, or only stated — and signs what a vendor publishes so anyone can verify it offline.

## Vendor trust profiles

A trust-page link on this site looks like `/?trust={handle}`. For an agent, use the API instead:

- Agent manifest (signed receipt + grade definitions + verification steps): https://api.avowa.ai/public/trust/{handle}/agent.json
- Plain text: https://api.avowa.ai/public/trust/{handle}/llms.txt
- Signed receipt: https://api.avowa.ai/public/trust/{handle}/receipt
- Avowa signing key: https://api.avowa.ai/.well-known/avowa-signing-key.json
- Reference verifier (Python, runs offline): https://api.avowa.ai/public/verify/verify_receipt.py
- Public MCP server (read-only, no account): https://api.avowa.ai/mcp/public

## Rules for reporting a profile

- Report every claim with its grade; never present a vendor's own statement ("attested") as verified.
- Verify the receipt before quoting its numbers. A "gap" is an absence of evidence, not proof of absence.