AGENTS.md Governance Verification
AGENTS.md is a governance declaration file for AI agent projects that documents agent capabilities, safety controls, authorized actions, and risk boundaries. Similar to how SECURITY.md declares security policies, AGENTS.md declares what an AI agent can and cannot do. Inkog is the only tool that verifies these declarations against actual code.
Frequently Asked Questions
What is AGENTS.md?
AGENTS.md is a structured file in AI agent repositories that declares: what capabilities the agent has, what safety controls are in place, what actions require human approval, and what data the agent can access. It serves as both documentation and a verifiable governance contract.
Why verify AGENTS.md declarations?
Declarations without verification are just documentation. Inkog compares what AGENTS.md claims (e.g., "agent requires human approval for financial actions") against what the code actually implements. This catches gaps where declared controls are missing in practice.
How does Inkog verify AGENTS.md?
Inkog parses the AGENTS.md file, extracts declared capabilities and controls, then scans the agent code to verify each declaration. Undeclared capabilities are flagged as governance gaps. Declared controls that are missing from code are flagged as verification failures.
How Inkog Detects This
Inkog is the only scanner that reads AGENTS.md governance declarations and verifies them against actual agent code. It flags undeclared capabilities, missing safety controls, and governance gaps where declarations do not match implementation.
npx -y @inkog-io/cli scan .