Agent Readiness Measures
How the Agent Gallery certifies agents across Functionality, Performance, and Security.
Certifying Agents
Outcome: a clear, explainable certification that scales across thousands of agents.
Each agent in the Gallery is certified on three pillars:
- Performance — effectiveness, correctness & latency
- Security — risk-based posture, supply chain & agent-specific (i.e. prompt-injections)
- Functional — ecosystem readiness & usability
| Dimension | Metric Type | Assessment Output | Frequency |
|---|---|---|---|
| Performance | Quantitative | Pass / Fail | Post-Build / Continuous (latency measured at runtime) |
| Security | Qualitative Risk Matrix | A, B, C, D | Periodic (currently every 30 days, compliant to ageing policy) |
| Functional | Ecosystem Readiness | Excellent, Strong, Moderate and Basic | Post-Build |
Readiness (Technology Readiness Level)
When certifying an agent, you select its current production tier / level — the Technology Readiness Level (TRL) that best reflects where the agent is in its lifecycle. This selection appears in the certification workflow as the Readiness step.
The seven tiers are:
| Level | Tier | Description |
|---|---|---|
| 1 | Concept & Roadmap Tier | Agent requirements and functionalities conceptualized and validated for business outcomes. Design/build in progress. |
| 2 | Prototype Tier | Working standalone agent prototypes validated for intended functionality and outcomes with mostly synthetic data. |
| 3 | Trusted Agent Huddle Tier | Working agent prototypes onboarded to AI Refinery and enabled for trusted agent huddle orchestration across systems. |
| 4 | Pilot Tier | Working agents with full functionality and limited robustness in a real-life workflow tuned to perform with production data. |
| 5 | Production Tier – General Usage | Working agents that are deployed and operating in general purpose internal facing scaled production usage. |
| 6 | Production Tier – Customer Usage | Working agents with high functionality, performance, tuning, controls for customer facing scaled production usage. |
| 7 | Production Tier – Regulatory Usage | Working agents with high functionality, performance, tuning, regulatory level controls for highly regulated production usage. |
For how TRL fits with maturity and certification, see Agent Maturity.
Certification in the Gallery
Whenever viewing the details of an agent, we can see the current certification status for Performance, Functional and Security dimensions. Clicking on the See details link on each of the certification status cards will open a dialog with the specific certification details.
The performance card consists of performance tests conducted on this agent. Hover each of the icons to see more details.
The Tools work and Latency tests work on aggregate data from multiple users, as such, they are not available for some of the agents on the gallery till more data is collected through frequent usage. Read Performance Certification to see how we validate correctness & speed.
The functional card consists of performance tests conducted on this agent. Hover each of the icons to see more details. Read Functionality Certification for more details.
The security certification card consists of the final security score of this agent. Hover each of the icons to see more details (e.g. how many critical, high, medium vulnerabilities were flagged in the container scan). Read Security Certification for details on the grading pipeline.
Certification Process
Sequence of Certification
For MCP Agents built from open source repositories, the order is: build, certify, publish to gallery. For agents added by gallery users, certification runs in parallel so agents can be onboarded and tested quickly.
The certification workflow establishes a complete chain of evidence: code assessment, pre-testing documentation (Evidence Box 1), evidence collection (Evidence Box 2), and secure evidence bundling. For the full process, required artifacts, and how evidence is anchored to each agent and code version, see Chain of Evidence.
Next steps
- Read Chain of Evidence for the full certification workflow and verifiable, auditable documentation.
- Read Functionality Certification to understand static analysis & ecosystem checks.
- Read Performance Certification to see how we validate correctness & speed.
- Read Security Certification to learn the risk framework and grading pipeline.