​

Trust Scoring

​

How It Works

1. File operations — what files are created, modified, deleted
2. Terminal commands — every command executed
3. Network activity — outbound connections and data transfer
4. System access — attempts to read system files or escalate privileges

​

Scoring Rules

​

No Penalty (Score: 100)

• Editing source code files
• Running test suites
• Installing packages from known registries
• Git operations (commit, push, pull)
• Reading documentation files

​

Minor Penalty (-5 to -10)

• Deleting more than 10 files at once
• Installing packages from unknown registries
• Large file downloads (>100MB)
• Modifying configuration files outside the project

​

Moderate Penalty (-10 to -20)

• Outbound network calls to unknown hosts
• Running processes as root
• Accessing environment variables containing sensitive names
• Creating SSH keys or certificates

​

Severe Penalty (-20 to -30)

• Reading /etc/passwd, /etc/shadow, or other system credential files
• Running curl | sh or similar remote execution patterns
• Modifying system binaries or libraries
• Attempting to access the host network namespace
• Exfiltrating data (large outbound transfers to unknown hosts)

​

Trust Levels

​

Alerts

# Get alerted when trust drops below 70
curl -X PUT https://api.caged.dev/v1/alerts/rules/rule-trust-warn \
  -H "Authorization: Bearer caged_sk_..." \
  -d '{"threshold": 0.7, "channels": ["email", "slack"]}'

​

Viewing Trust Details

​

CLI

caged trust cage-a1b2c3d4

Trust Score: 78/100 (Good)

Deductions:
  -10  Outbound connection to unknown host (185.199.108.133)
  -7   Deleted 15 files in /tmp/
  -5   Installed package from git URL

​

Dashboard

• Overall trust score with trend
• Timeline of trust-impacting events
• Detailed breakdown of each deduction

​

Customizing Rules

# .caged.yaml
trust:
  min_score: 50          # Pause sandbox if trust drops below this
  allow_root: true       # Don't penalize root access
  allowed_hosts:
    - api.openai.com     # Don't penalize connections to these
    - registry.npmjs.org

​

Best Practices

• Set budget guards alongside trust scoring — they complement each other
• Review sessions with scores below 80 to understand agent behavior
• Use allowlist network mode for maximum trust score predictability
• Custom agents should avoid patterns that trigger deductions