Inspiration

AI agents constantly read webpages, documents, and messages from unknown sources. These sources can contain useful information alongside malicious instructions that attempt to steal secrets or manipulate the agent. TrustSieve was inspired by one principle: untrusted content may provide data, but it should never be able to grant itself authority.

What it does

TrustSieve is a content firewall for AI agents. It processes suspicious text inside a restricted SharedOS workflow and returns safe facts with exact evidence offsets, SHA-256 hashes, risk flags, an authorization audit trail, and an Ed25519-signed receipt. The reader can access only the submitted document. Attempts to read secrets, access unrelated files, or send messages are denied by SharedOS. Agents can call TrustSieve through SharedNet for five Arena credits, while receipt verification is free.

How we built it

We built TrustSieve using TypeScript, Node.js, SharedOS, SharedNet, MCP, Zod, Vitest, Ed25519 signatures, SHA-256 hashing, Render, GitHub, and Codex. Each request creates a fresh permission environment under trustsieve-containment-v1. Three isolated agents handle the workflow:

• The reader extracts candidate facts.
• The reviewer receives only validated evidence.
• The coordinator returns only the final report. A deterministic gate verifies every claim against its source. SharedOS checks every tool call and blocks anything outside the agent’s exact grants.

Challenges we ran into

The main challenge was preserving useful facts without trusting instructions contained in the same document. We also had to design strict per-agent grants, prevent secrets from leaking through outputs or errors, create verifiable receipts, support SharedNet’s Room-message system, and keep responses below the Arena’s five-minute limit. SharedNet uses different identifiers for calling, tagging, and payment, so we built a dedicated message handler that treats Room messages as untrusted data and responds only to valid TrustSieve requests.

Accomplishments that we're proud of

TrustSieve passes 64 automated tests and a 50-document evaluation suite containing 40 hostile and 10 benign fixtures. Useful facts were preserved while zero unauthorized secret or messaging probes succeeded. A recent live request completed in approximately 1.4 seconds and correctly denied two unauthorized actions. Another autonomous SharedNet agent independently evaluated TrustSieve against alternative services, verified its evidence-backed delivery, and paid three credits—providing real agent-market validation before the Arena.

What we learned

We learned that model safety and authorization are separate problems. Prompts can request safe behavior, but reliable protection requires an authorization layer outside the model. We also learned that agents value verifiable results: evidence offsets, hashes, audit traces, predictable schemas, signatures, transparent prices, and clear failure states. What's next for TrustSieve Next, we plan to support PDFs, webpages, agent messages, and structured datasets. We will add an SSRF-safe webpage fetcher, model-backed extraction under the same restricted grants, persistent audit exploration, and reputation signals based on verified receipts. Our long-term goal is to make TrustSieve the standard safety boundary agents use before trusting content from the web or another agent.

Team lead Discord username: @Ananya Daitkar ananyadaitkar

SharedNet agent/seat ID :i_Iq7NNQT34O

Built With

• codex
• github
• mcp
• node.js
• render
• sha-256
• sharednet
• sharedos
• typescript
• vitest