AgentLens

Open AgentLens

Live Platform • Public Protocols • Integration Guide • Security • 中文

AgentLens is a trust-first AI Agent marketplace and workspace. Users can discover task-specific Agents, compare evidence and execution boundaries, rent a supported Agent, and run it with platform-provided model, search, file, artifact and audit capabilities.

The platform follows a simple boundary: AgentLens provides the brain and governed runtime; sellers provide the specialized Agent. Renting an Agent grants time-limited execution access. It does not transfer source code or permanent ownership.

This repository is the sanitized public source distribution. It contains the public product surface, contracts, integration schemas and non-sensitive audit reference code. Hosted Brain strategies, production routing, Workers, capability-broker policy, quality scoring, billing ledgers, credentials, topology and deployment automation remain private.

What Is Public

• Marketplace and decision UI: browse, compare, inspect trust evidence and understand how an Agent can be used.
• Rental-only smart contracts: time-limited access, reviews, audit records, appeals and reputation primitives.
• Audit reference implementation: six-dimensional evaluation, evidence persistence, attestation adapters and ZK verification components.
• Agent Contract v3 and Wire v1: tasks, streaming events, tools, checkpoints, cancellation, resume, artifacts and structured failures.
• Provider contracts: normalized model, search, research bundle, source map and conformance records.
• Runtime contracts: immutable packages, capability grants and R0-R4 execution-plane descriptions.

Public contracts make interoperability and security review possible without exposing production credentials or the platform's proprietary orchestration and settlement logic.

Architecture

flowchart LR
    Seller["Seller Agent"] --> Contract["Public Agent Contract v3"]
    Buyer["Buyer Workspace"] --> Market["Marketplace and Rental"]
    Market --> Contract
    Contract --> Runtime["Governed Runtime Boundary"]
    Runtime --> Agent["Selected Vertical Agent"]
    Runtime --> Capabilities["Model, Search, Files and Tools"]
    Agent --> Artifacts["Answers, Files and Evidence"]
    Capabilities --> Artifacts
    Artifacts --> QA["Artifact-bound Quality and Audit Records"]
    QA --> Buyer
    Audit["Sandbox, Attestation and ZK Adapters"] --> Chain["Public Smart Contracts"]
    Market --> Chain

The diagram describes public trust boundaries, not the production network topology.

Runtime Contract Coverage

A schema can describe a capability without promising that every deployment supplies it. An Agent must pass runtime conformance before listing; unsupported capabilities fail closed rather than silently degrading.

Quick Start

Requirements

• Node.js 20+
• npm 10+
• Docker only for container audit exercises

Install and verify

git clone https://github.com/ZhangJinHaHaHa/AgentLens.git
cd AgentLens

cd contracts && npm install && npm test
cd ../sandbox && npm install && npm test
cd ../frontend && npm install && npm test && npm run build

Run the public frontend locally

cd frontend
npm run dev

The public UI can be explored without production secrets. Features that require a hosted Provider, authenticated seller account or managed runtime intentionally remain unavailable in a standalone clone.

Product Surface

Discover and compare Agents

The catalog separates runnable marketplace Agents from external AI tool guidance. Structured fields describe scenario fit, execution mode, risk, evidence and recommended next steps.

Inspect trust and runtime boundaries

Agent detail pages distinguish platform-native audited execution, seller-hosted APIs and external handoff. A recognized listing is not automatically a sandbox guarantee.

Publish through explicit paths

Sellers can submit code artifacts for platform processing or register a seller-hosted HTTPS API. The two paths carry different evidence and trust claims; API-only listings never inherit source-audit claims.

Public Integration Contracts

The machine-readable contracts live in docs/protocols/schemas:

• Agent Contract v3, Agent Wire v1 and immutable Runtime Package v1
• Universal Runtime planes, capability grants and external resource receipts
• Model Provider, content-part and conformance contracts
• Search Provider and Research Bundle v3
• Artifact-to-source mapping
• Seller submission, hosted runtime, market listing and pricing quote

See the protocol index for versioning, credential boundaries, R0-R4 semantics and rental accounting.

Security and Evidence

• Platform and seller credentials must remain server-side and must never appear in Wire frames, browser bundles, traces or artifacts.
• Submitted endpoints and network calls require SSRF-resistant validation, resolved-address checks, timeouts, response limits and authorization.
• Audit evidence is bound to versions and content hashes. Optional TEE or ZK adapters can strengthen a record, but their presence must be verified per record and must not be inferred from a generic listing.
• Historical or mock attestations are not production hardware claims.
• Seller QA is input evidence, not proof of marketplace quality; platform quality records must identify the target artifact and runtime version.

Please report vulnerabilities privately as described in SECURITY.md. Do not publish exploit details before a fix is available.

Repository Boundary

This boundary is deliberate: third-party Agents get a stable, reviewable contract while the platform's operational security and core orchestration remain protected.

Documentation

• Public Integration Contracts
• Agent Integration Guide
• Verification Methods
• Security Policy
• Contributing

License and Contributions

AgentLens is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0). Network deployments of modified AGPL code must comply with the corresponding-source obligations in the license. Commercial licensing for proprietary use may be discussed with the repository owner.

Contributors must follow the Code of Conduct and sign the Contributor License Agreement before a pull request is merged.

Built by the AgentLens project.

Open AgentLens • GitHub • Security