From 438b475be098292deb0ff7a443a7def8a17cd15f Mon Sep 17 00:00:00 2001 From: Fabio Marcello Salvadori Date: Wed, 21 Oct 2026 18:48:32 +0200 Subject: [PATCH 1/3] Add PIC Standard (agent-enabling) Adds tools/pic-standard.md in agent-frameworks-standards with first-party evidence, and the matching tool-submitters.json entry. Signed-off-by: Fabio Marcello Salvadori --- tool-submitters.json | 1 + tools/pic-standard.md | 90 +++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 91 insertions(+) create mode 100644 tools/pic-standard.md diff --git a/tool-submitters.json b/tool-submitters.json index bc7ef18..e47df57 100644 --- a/tool-submitters.json +++ b/tool-submitters.json @@ -57,6 +57,7 @@ "pangolinfo-amazon-data-mcp": "Pangolin-spg", "paperclip": "bradvin", "paygseo": "foo-bender", + "pic-standard": "madeinplutofabio", "pixelvault": "facundofarias", "proofeditor": "foo-bender", "provenant": "MoslemBenDhaou", diff --git a/tools/pic-standard.md b/tools/pic-standard.md new file mode 100644 index 0000000..00022ab --- /dev/null +++ b/tools/pic-standard.md @@ -0,0 +1,90 @@ +--- +slug: "pic-standard" +name: "PIC Standard" +description: "Open, local-first protocol that verifies an agent's intent, provenance and evidence before a tool call runs" +seoTitle: "PIC Standard: Verify AI Agent Tool Calls Before They Run" +seoDescription: "Open, local-first protocol and verifier that checks an agent's intent, provenance and signed evidence before a tool call runs, and blocks calls that fail." +agentSummary: "PIC Standard lets an agent submit an Action Proposal before a high-impact tool call: what it intends to do, how much is at stake, which inputs it relied on, and evidence such as SHA-256 hashes or Ed25519-signed approvals. A local verifier checks the proposal against the operator's policy and trusted keys, and the call is blocked if verification fails." +category: "agent-frameworks-standards" +tags: + - "agent-security" + - "tool-call-verification" + - "provenance" + - "open-standard" + - "mcp" + - "langgraph" +websiteUrl: "https://madeinpluto.com/pic" +githubUrl: "https://github.com/pic-standard/pic-standard" +pricing: "open-source" +classification: "agent-enabling" +entityType: "protocol" +developerName: "PIC Standard project" +docsUrl: "https://github.com/pic-standard/pic-standard/blob/main/docs/for-agents.md" +licenseUrl: "https://github.com/pic-standard/pic-standard/blob/main/LICENSE" +interfaces: + - "Python SDK" + - "TypeScript verifier" + - "CLI" + - "HTTP API" + - "MCP" +deploymentModes: + - "local" + - "self-hosted" + - "application-embedded" +evidenceSources: + - title: "PIC Standard repository: Python reference implementation and integrations" + url: "https://github.com/pic-standard/pic-standard" + claim: "The repository publishes the Python reference verifier with a CLI, MCP tool guards, a LangGraph tool node, and an HTTP bridge with an OpenAPI contract." + accessedAt: "2026-10-21" + sourceType: "official-repository" + - title: "RFC-0001: PIC Standard specification" + url: "https://github.com/pic-standard/pic-standard/blob/main/docs/RFC-0001-pic-standard.md" + claim: "Specifies a local-first, fail-closed protocol in which an agent declares intent, impact class, data provenance, claims and cryptographic evidence before a tool call is executed." + accessedAt: "2026-10-21" + sourceType: "official-specification" + - title: "PIC core specification: verification rules" + url: "https://github.com/pic-standard/pic-standard/blob/main/docs/spec-core.md" + claim: "Defines the verification checks, including tool binding before dispatch, and states that any check's failure produces a fail-closed outcome." + accessedAt: "2026-10-21" + sourceType: "official-specification" + - title: "PIC Standard v0.9.1 release notes" + url: "https://github.com/pic-standard/pic-standard/releases/tag/v0.9.1" + claim: "v0.9.1 adds live-argument binding at the MCP guard and HTTP bridge, an optional MCP pre-execution hook, and grows the shared conformance corpus from 84 to 91 vectors." + accessedAt: "2026-10-21" + sourceType: "official-release-notes" + - title: "MCP integration guide" + url: "https://github.com/pic-standard/pic-standard/blob/main/docs/mcp-integration.md" + claim: "Documents guard_mcp_tool for wrapping MCP tool functions so that PIC verification runs before the tool executes." + accessedAt: "2026-10-21" + sourceType: "official-documentation" + - title: "PIC Standard TypeScript verifier" + url: "https://github.com/pic-standard/pic-standard-ts" + claim: "A second implementation in TypeScript that passes the shared conformance vectors for the canonicalization, core and trust-sanitization modes." + accessedAt: "2026-10-21" + sourceType: "official-repository" + - title: "PIC Standard on PyPI" + url: "https://pypi.org/project/pic-standard/" + claim: "The Python package pic-standard is published on PyPI, with version 0.9.1 as the current release." + accessedAt: "2026-10-21" + sourceType: "official-product-page" + - title: "PIC Standard license: Apache-2.0" + url: "https://github.com/pic-standard/pic-standard/blob/main/LICENSE" + claim: "The repository is licensed under the Apache License 2.0." + accessedAt: "2026-10-21" + sourceType: "official-license" +verificationLevel: "documentation-reviewed" +classificationRationaleMd: "PIC gives agent builders a specified, independently implemented contract for gating high-impact tool calls on declared intent, provenance and evidence. It governs whether an agent's proposed action may run rather than how agents communicate with each other, so agent-enabling is the most specific class the evidence supports." +bestForMd: "Agent builders who want a verifiable, fail-closed check before payment, data-export, deletion or other high-impact tool calls run, using keys and policy they control." +notBestForMd: "Filtering or moderating model output text; PIC gates tool calls, not what the model says." +limitationsMd: "Protection applies to tool calls routed through a PIC integration. Live-argument binding is implemented in the MCP guard and HTTP bridge; the LangGraph PICToolNode verifies proposals and tool names but does not yet compare live arguments. With the HTTP bridge, the calling application enforces the allow or block decision. The TypeScript verifier does not yet implement evidence-mode verification." +unknownsMd: "The reviewed first-party sources do not publish third-party adoption figures." +--- + +PIC Standard (Provenance & Intent Contracts) is an Apache-2.0 protocol and local verifier that decides, before a high-impact tool call runs, whether the agent's proposed action is backed by trusted provenance and verifiable evidence. + +## So agents can... + +- Declare intent, impact, sources and evidence before a payment, data export, deletion or command runs +- Back a claim with SHA-256 hashes or Ed25519-signed approvals from keys the operator trusts +- Have the call blocked before execution when evidence is missing or fails verification +- Run only the exact tool arguments that were verified, through the MCP guard From 62ed7af58e3e8a78afc82afd3a6dfd5b99e89e8a Mon Sep 17 00:00:00 2001 From: Fabio Marcello Salvadori Date: Thu, 22 Oct 2026 15:52:00 +0200 Subject: [PATCH 2/3] Address review: canonical website URL and PyPI JSON evidence Signed-off-by: Fabio Marcello Salvadori --- tools/pic-standard.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/tools/pic-standard.md b/tools/pic-standard.md index 00022ab..e8b2c4f 100644 --- a/tools/pic-standard.md +++ b/tools/pic-standard.md @@ -13,7 +13,7 @@ tags: - "open-standard" - "mcp" - "langgraph" -websiteUrl: "https://madeinpluto.com/pic" +websiteUrl: "https://madeinpluto.com/pic/" githubUrl: "https://github.com/pic-standard/pic-standard" pricing: "open-source" classification: "agent-enabling" @@ -62,10 +62,10 @@ evidenceSources: claim: "A second implementation in TypeScript that passes the shared conformance vectors for the canonicalization, core and trust-sanitization modes." accessedAt: "2026-10-21" sourceType: "official-repository" - - title: "PIC Standard on PyPI" - url: "https://pypi.org/project/pic-standard/" - claim: "The Python package pic-standard is published on PyPI, with version 0.9.1 as the current release." - accessedAt: "2026-10-21" + - title: "PIC Standard package metadata on PyPI (JSON API)" + url: "https://pypi.org/pypi/pic-standard/json" + claim: "The Python package pic-standard is published on PyPI with 0.9.1 as the current release, requires Python 3.10 or later, and offers langgraph, mcp and crypto extras." + accessedAt: "2026-10-22" sourceType: "official-product-page" - title: "PIC Standard license: Apache-2.0" url: "https://github.com/pic-standard/pic-standard/blob/main/LICENSE" From 2d4ce7dc45237995721bd97d9b97b9c7bf541208 Mon Sep 17 00:00:00 2001 From: foo-bender <259108858+foo-bender@users.noreply.github.com> Date: Fri, 23 Oct 2026 06:55:03 +0100 Subject: [PATCH 3/3] Review PIC Standard editorial metadata --- tools/pic-standard.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tools/pic-standard.md b/tools/pic-standard.md index e8b2c4f..9684ab7 100644 --- a/tools/pic-standard.md +++ b/tools/pic-standard.md @@ -73,6 +73,8 @@ evidenceSources: accessedAt: "2026-10-21" sourceType: "official-license" verificationLevel: "documentation-reviewed" +reviewedBy: "foo-bender" +reviewedAt: "2026-10-23" classificationRationaleMd: "PIC gives agent builders a specified, independently implemented contract for gating high-impact tool calls on declared intent, provenance and evidence. It governs whether an agent's proposed action may run rather than how agents communicate with each other, so agent-enabling is the most specific class the evidence supports." bestForMd: "Agent builders who want a verifiable, fail-closed check before payment, data-export, deletion or other high-impact tool calls run, using keys and policy they control." notBestForMd: "Filtering or moderating model output text; PIC gates tool calls, not what the model says."