AI agents now act on your behalf, yet most agent directories are lists of pitches. Metal Mantra publishes evidence instead.

Paste a public GitHub repository and an official domain. Deterministic rules read the source and produce a public report across five weighted pillars: security and privacy, guardrails and loop control, schema and tooling, token and cost efficiency, and entity trust.

Every deduction has a rule and a file behind it. Every report states its scan scope (how many files were eligible, how many were read) and what it does not establish. There is no AI in the scanner, so the same input gives the same result.

A score is an automated signal about public source, never a security certification. The first scan of a repo is free. Private repo? Run the scanner in your own GitHub Actions and publish an attested report without sharing code.

I would love feedback on the method: which rules feel wrong or miss something real?