TrustGate: a verifiable execution environment for AI agents

How it works

From agent request to independent proof.

An MCP agent submits a job. It runs in an isolated, measured, attested environment, under deny-by-default capabilities and resource limits. What comes back is the result plus a receipt that proves it, not a promise.

01Submit

An agent calls an MCP tool with an approved, publisher-signed workload and an input.

02Isolate

The workload runs in wazero inside a measured Nitro Enclave. No capabilities unless granted, with CPU and memory limits.

03Attest

AWS attests to the enclave image. The receipt-signing key is bound to that Nitro attestation document. Receipts are hash-chained and Ed25519-signed.

04Verify

Anyone checks the receipt against the AWS root CA and a pinned measurement, from somewhere else. Deterministic jobs can be replayed.

Why it holds up

Built to survive a hostile host.

Tamper-evident

Edited receipts, changed inputs and wrong pinned measurements all fail verification. These are covered by attack tests and were run on real hardware.

Measurement-gated keys

AWS KMS releases a secret only to the enclave with the exact measured image. The parent instance's own credentials, and a modified image, are denied.

Independently verifiable

A separate Lambda verifier checks signature, attestation and key binding, so the server that ran your job is not the one grading it.

Confidential jobs

The host handles ciphertext. Only the enclave sees your data.

The data owner seals an input to one exact job. The attested enclave unwraps it, runs it, and seals the result back to the owner's key.

Bound to one job. A hostile parent can't re-target the ciphertext at another workload, change arguments, or redirect the result.
Salted receipts. Hashes use secrets only the owner holds, so small or guessable data can't be brute-forced from a receipt.
Observed on the wire. A packet capture on the parent held none of the sealed job's data or results, while the same job unsealed did.

# data owner
$ trustgate seal --workload csv-stats ...
  ✓ input encrypted, data key wrapped by KMS

# parent instance sees
  ciphertext, sizes, timing

# attacker re-targets the job
  ✗ refused: authentication failed

# enclave (attested KMS call)
  ✓ unwrap → run → seal result to owner key

Agent interface

Plain MCP tools your agent already understands.

Streamable HTTP at /mcp. Works with any MCP client; a Strands agent on Bedrock is included as an example.

execute

Run an approved workload, with text or raw-bytes input. Returns output plus a signed receipt. Add sealed_input for a confidential job.

execute_async · job_status · job_result · cancel_job

Long-running jobs: get a job id at once, poll, fetch the result, or cancel.

replay

Re-run the workload in a receipt against the original input and compare output hashes.

verify_receipt

Check signature, attestation, key binding and an optional pinned measurement, by short receipt id or full bundle.

list_workloads · get_attestation

Discover approved workloads and the server's attestation evidence.

Guarantees

What it proves, and what it doesn't.

TrustGate proves what code ran, on which input, in which environment. It does not prove the result is correct.

You can rely on

The workload hash and input the receipt commits to
The enclave image measured by the attestation document
The receipt not having been edited after signing
Confidential inputs staying encrypted outside the enclave

Known gaps

Whether a rebuilt enclave image gets the same PCR0 is not yet confirmed for every build; until it is, a rebuild means updating the KMS key policy
Transport to the MCP endpoint is plain HTTP
The parent still sees metadata and can delay or drop jobs
dev mode has no hardware isolation and is rejected by the verifier by default
AWS Nitro remains the root of trust: this is verifiable execution, not the absence of trust

Trustless, verifiable remote execution for AI agents.