AgentTrust Pricing: What You Get and What to Check

AgentTrust describes itself as a verifiable zero-trust control plane, cryptographic black box, and post-quantum policy gateway for autonomous AI agents. In plain terms, it is designed to sit between an AI agent and the tools that agent wants to use, inspect each proposed action, and then allow it, block it, or hold it for a human to approve. The project lives at github.com/SRN0129/Agenttrust.

If you searched for AgentTrust pricing, the honest answer comes first: no prices, plan tiers, credit allowances, or usage limits are published on the pages that were checked. That changes the shape of the decision. Instead of comparing tiers, you are asking what the tool actually does, what infrastructure it demands from you, and how much of your own time and hardware it will consume.

What AgentTrust is and who it is for

AgentTrust is security infrastructure for agents that can take real actions. Confirmed capabilities include:

• A zero-trust control plane for autonomous AI agents
• Interception of every proposed agent action before external tool execution
• Parameter screening for prompt injections and data leaks
• Real-time blast radius checks and fine-grained capability policies
• Human approval gates for dangerous actions, triggered with one click
• An immutable, hardware-sealed audit ledger using TPM 2.0 or Nitro Enclave
• Audit anchoring with NIST FIPS 204 (ML-DSA) post-quantum Merkle proofs
• Orbital LEO satellite space-airgap attestations
• Standalone packages: orbital-notary, space-killswitch, doppler-ephemeris, qkd-witness, and core
• A direct authenticated gateway with deny-by-default capability glob matching and strict Bearer/API key validation
• Action-specific and verb scoping through sub-resource and AST verb extraction, for example distinguishing a database:orders:SELECT from a DROP
• Integration with LangChain, CrewAI, AutoGen, or custom runtimes

That feature list tells you who this is aimed at. It suits platform and security engineers who run agents that touch production databases, cloud APIs, or other systems where a bad call is expensive. It is also relevant to teams building verifiable audit trails for AI compliance work such as the EU AI Act, because the ledger is designed to produce tamper-evident records rather than ordinary logs.

It is not aimed at people who want a drop-in content filter or a dashboard they can sign into this afternoon. AgentTrust is closer to infrastructure you deploy and operate than a hosted product you subscribe to.

Free plan and pricing

There is no confirmed free plan to describe, because no plan details are stated on the fetched pages. The pricing reference linked for this project points to a GitHub Issues page, github.com/features/issues, and at the time of checking it did not list tiers, prices, credit amounts, or usage caps for AgentTrust. There is likewise no confirmed paid tier, no trial length, and no published per-seat or usage-based rate.

One structural point is confirmed and worth knowing before you plan a budget: the full enterprise control plane is separate from the standalone modular packages. Those two things are different products in practice, and only one of them is the complete control plane described above.

Treat that table as a scope comparison, not a price comparison. The only reliable next step is to open an issue or contact the maintainers directly and ask for current terms, because free plans and licensing change often.

Where the free plan runs out

Since no free allowance is published, there is no metered ceiling to point at. What limits you in practice will be structural rather than a credit counter:

• Hardware sealing. The hardware-sealed ledger requires TPM 2.0 or Nitro Enclave. If your machines or cloud instances do not provide that, you cannot use the sealed-ledger path as designed.
• Satellite attestation. The orbital features rely on external systems such as Iridium SBD or Starlink D2C. That means third-party connectivity, possible service fees outside AgentTrust, and coverage that depends on someone else's network.
• Human availability. The approval workflow requires a human in the loop. Every dangerous action you gate becomes a queue that somebody has to work, including out of hours.
• Control plane scope. If you only adopt the standalone packages, you get those capabilities, not the full enterprise control plane.

In other words, the practical ceiling is your infrastructure and your staffing, not a quota.

Getting started in general terms

A sensible evaluation path looks like this:

1. Read the repository documentation and issues first. They are the only authoritative source for current capability and any licensing or commercial terms.
2. Decide which layer you are evaluating: the standalone modular packages, or the full enterprise control plane. Do not assume one implies the other.
3. Identify your agent runtime. AgentTrust is designed to integrate with LangChain, CrewAI, AutoGen, or custom runtimes, so start with whichever one your agents already use.
4. Write your capability policy before you wire anything up. The gateway is deny-by-default with glob matching, so you should know which verbs and sub-resources your agents legitimately need, down to the difference between a read and a destructive write.
5. Plan your secrets handling, since the gateway validates strict Bearer tokens or API keys.
6. Choose where the audit ledger will live, and confirm the TPM 2.0 or Nitro Enclave requirement on those hosts.
7. Route approvals to a human channel that people actually watch, then test your policy with actions you expect to be blocked.

Run the whole thing against a staging agent before you point it at production systems. The value of a control plane is that it stops bad actions; the risk is that a misconfigured policy stops good ones.

Pros and cons

Strengths, as design intent to verify

• Open modular repository with standalone, zero-dependency packages, which lets you adopt pieces rather than the whole stack
• Post-quantum cryptography and a hardware-sealed audit ledger, unusual in AI agent security tooling
• Human-in-the-loop approvals built into the flow rather than bolted on
• Satellite space-airgap attestation concepts for teams with extreme isolation requirements
• Compatibility with major agent frameworks, so you are not forced to rewrite your runtime

These are properties of the design as described. Whether they hold up under real agent traffic is something you would need to establish in your own environment.

Trade-offs to check

• No public pricing or plan details, which makes budget approval and procurement harder
• Hardware and satellite dependencies add operational complexity and, potentially, third-party costs
• The focus is security infrastructure, not agent building, so it will not help you design or improve your agents
• Human approvals fail open into a queue when no one is available

Privacy and data notes to check

AgentTrust intercepts every proposed agent action before it executes and screens parameters for prompt injections and data leaks. That is exactly the position where a system sees the most sensitive material, so ask concrete questions before deploying it:

• Where do the intercepted parameters go? Are they evaluated locally, or does screening involve any external service?
• What is written to the audit ledger, for how long, and who can read it? Immutable records are excellent for compliance and painful for data minimisation if secrets end up inside them.
• Who controls the hardware attestation keys for the TPM 2.0 or Nitro Enclave setup, and what happens if a key is rotated or lost?
• What does satellite attestation transmit off-site? Any use of Iridium SBD or Starlink D2C means some metadata leaves your environment.
• How are gateway API keys and Bearer tokens stored, scoped, and revoked?
• What licence governs the packages, and what does it say about redistribution and warranty?

None of these are reasons to avoid the project. They are the questions a security review will ask, and you will get better answers from the maintainers than from a marketing page.

Who should skip AgentTrust

• Teams that need a hosted guardrails API with published pricing and a support contract. Nothing here is published yet, and the full control plane sits behind a separate enterprise arrangement.
• Solo developers and small teams prototyping agents. The overhead of hardware sealing, policy authoring, and approval routing is disproportionate to the risk at that stage.
• Anyone who only needs to filter model inputs and outputs. Simpler prompt-filtering tools cover that with far less infrastructure.
• Organisations that cannot run TPM 2.0 or Nitro Enclave hosts, since the sealed ledger is a core part of the design.
• Teams with no one available to work approval queues, because human-in-the-loop gating is central to how dangerous actions are handled.

Alternatives to AgentTrust

• Guardrails AI (guardrailsai.com): a validation framework for controlling model inputs and outputs, useful when your main concern is output quality and safety rather than agent tool-call interception.
• Lakera (lakera.ai): focuses on protecting LLM applications from prompt injection and related attacks.
• Prompt Security (prompt.security): a platform approach to securing generative AI usage across an organisation.
• HiddenLayer (hiddenlayer.com): security tooling aimed at AI models and the ML pipeline, a fit if your risk is model-level rather than agent-action-level.
• Invariant Labs (invariantlabs.ai): agent-focused security and analysis, closer in spirit if your problem is runtime agent behaviour.

Verdict

AgentTrust is an ambitious piece of security infrastructure. Intercepting agent actions before execution, scoping capabilities down to specific database verbs, gating dangerous calls behind human approval, and sealing the audit trail with post-quantum proofs is a serious combination. If you run autonomous agents against production systems and you need defensible evidence of what they did, this is worth a careful technical evaluation.

The catch for buyers is simple: there is no published pricing, so you cannot yet compare AgentTrust on cost. Treat it as an engineering evaluation first and a purchasing decision second. Read the repository, ask the maintainers directly about licensing and commercial terms, and confirm the TPM 2.0 or Nitro Enclave requirement fits your infrastructure before you invest time in a proof of concept. If what you actually want is a hosted filter for prompts and responses, one of the alternatives above will get you there faster.