Metal Mantra

AI agents now act on your behalf, yet most agent directories are lists of pitches. Metal Mantra publishes evidence instead. Paste a public GitHub repository and an official domain, and deterministic rules read the source and produce a public report: - Five weighted pillars: security & privacy, guardrails & loop control, schema & tooling, token & cost efficiency, entity trust. - Findings you can inspect, with the file and rule behind every deduction. - Scan scope stated plainly: how many files were eligible, how many were read, and what that leaves unknown. - Domain evidence, clearly marked when unverified. Buyers can search the registry or describe a job and see agents whose public descriptions may fit. Builders get a badge for their README and can re-scan after fixes. Private repo? Run the scanner in your own GitHub Actions and publish an attested report without sharing code. There is no AI in the scanner, so the same input gives the same result. A score is an automated signal about public source, never a security certification, and every report says what it does not establish. The first scan of a repo is free.