Verb Authority
A security tool that stops untrusted data from authoring protected arguments in AI agent tool calls, classifying each argument by where it actually came from.
🔗 Visit Verb Authority
Description
AI agents that can send emails, move money, or edit records are only as safe as the arguments they pass to those actions — and a standard JSON schema only checks that an argument has the right shape, not who actually supplied its value. That gap lets a manipulated model, or attacker-controlled text the model read, quietly rewrite a "safe" tool call into a dangerous one. Verb Authority closes that specific hole.
Verb Authority is an open-source library that classifies every tool-call argument by provenance — trusted_fixed versus outbound_payload — and enforces that classification with a runtime gate that blocks unauthorized arguments before the tool executes, without needing to run the tool or upload any data to do the scanning. It integrates with MCP, OpenAI, and Anthropic tool definitions, ships a Pydantic AI adapter, and includes a GitHub Actions integration to catch "authority drift" in CI before it reaches production. It's free under the Apache-2.0 license.
💬 Our review
The short version: Verb Authority addresses a genuinely underserved problem — most AI-agent security tooling focuses on prompt injection detection or output filtering, while argument-provenance checking at the tool-call layer is still mostly done by hand, if at all.
General-purpose policy engines like OPA/Rego can express similar rules, but they weren't built with AI tool-call schemas in mind, so you'd be hand-rolling the same argument-provenance logic Verb Authority ships out of the box. Guardrails-style libraries mostly focus on validating and filtering model outputs after the fact, not on blocking a specific unauthorized argument before a tool executes — a narrower but more precise net for this exact failure mode. The CI integration to catch authority drift is the standout feature: it turns a runtime security property into something checked automatically on every pull request, which most teams currently don't do at all. Worth adopting if you're exposing agents to tools with real consequences (payments, email, data writes); unnecessary overhead if your agent's tools are all read-only or low-stakes.
💰 Pricing
📊 Global score
🤖 AI-enriched data
Open source, licence Apache-2.0 — aucun coût.
Pros
Classification de provenance par argument (trusted_fixed vs outbound_payload)
Bloque les arguments non autorisés avant l'exécution de l'outil
Scan de schéma sans exécuter l'outil ni uploader de données
Intégration CI (GitHub Actions) pour détecter la dérive d'autorité
Compatible MCP, OpenAI, Anthropic + adaptateur Pydantic AI
Cons
Ajoute une couche de configuration supplémentaire à maintenir
Pertinent surtout pour des outils à conséquences réelles, overkill pour du read-only
Projet jeune, pas encore un standard établi comme OPA