TrustGraph
Build deterministic, traceable agents on reusable context graphs and open-model infrastructure.
The installer guide discloses hardware inspection, key collection, prerequisite installation, model downloads, container startup, IAM bootstrap, and browser launch. Interactive prompts, dry-run, fresh, and remove-all provide meaningful confirmation and recovery controls, supporting ordinary scores for confirmation, data-flow disclosure, external effects, and rollback. Deductions apply because saved answers can contain API keys but no file permissions, encryption, log redaction, or rotation controls are documented. Most dependencies and actions are unpinned; the CLA workflow uses action@main with several write permissions. Apache-2.0, the project name, and a security email provide basic attribution, but publisher identity is unverified and the license appendix retains placeholder text.
The installation flow, layered CI jobs, and agent-DAG analyzer present a reasonably consistent operational story. The analyzer reports missing message IDs, absent triples, multiple roots or terminals, dangling provenance, and type errors, while the guide identifies logs and common failures. Deductions apply because the large, unpinned set of Python, container, Node, model, and cloud dependencies makes availability less predictable, with no lockfile evidence, image digests, retry policy, or offline guarantees in the supplied material. No tests were executed in this static review.
The evidence covers local and remote LLMs, Ollama, OpenAI-compatible endpoints, no-LLM startup, Docker, Podman, interactive operation, and CI use. It explicitly states the macOS installer boundary and that Agent/RAG features do not work without an LLM. Configurable service, flow, user, collection, and URL fields support ordinary trigger and environment fit. Deductions apply because concrete Linux and Windows installation instructions are absent, examples lean on default identities and flows, and no finer-grained capability policy or trigger-conflict handling is shown.
The developer guide is well organized and unusually complete on prerequisites, actions, options, environment variables, provider modes, reruns, uninstall behavior, and troubleshooting, justifying full marks for install notes. Naming is broadly consistent, examples and limitations are concrete, and the complete Apache-2.0 text justifies full license credit. Deductions apply because the supplied material lacks a repository-wide architecture overview, formal FAQ, changelog, and release migration history; only a supported security release line is shown. The security mailbox and response process establish a maintenance route, but no named maintainers and unknown publisher identity limit responsibility attribution.
The Workbench, API, streamed agent messages, saved JSON traces, PROV/RDF derivation graph, and DAG diagnostics are directly usable outputs. Graph-based explanation lineage offers clear marginal value over a bare conversational endpoint, while hardware-aware local or remote recommendations and skip options acknowledge operational tradeoffs. Deductions apply because the platform requires containers, multiple runtimes, models or external APIs, and numerous data and cloud dependencies, while the evidence supplies no latency, resource, quality, cost, or scale benchmarks to establish exceptional cost-benefit.
Agent traces connect explain IDs, RDF types, and prov:wasDerivedFrom relations at entity level, and the analyzer checks roots, terminals, parent existence, and sub-trace relationships; this thoroughly supports claim traceability. The README, CI workflow, security policy, and development utilities corroborate installation, testing intent, and interface structure. Deductions apply because no captured trace fixture, test report, release artifact, or independent source corroborates broader reliability and determinism claims. Product assertions and code-observable facts can be distinguished, but the materials do not systematically label verified facts versus design intent or inference.
- requirements.txt is unpinned, and GitHub Actions use floating references, including action@main in a write-capable CLA workflow; pin and audit dependencies and workflow sources before adoption.
- The installer saves API keys, installs software, downloads models, starts containers, and bootstraps IAM. Use --dry-run first and verify saved-file permissions, log redaction, and uninstall scope.
- --remove-all deletes compose volumes, the virtual environment, deployment output, logs, and saved answers; back up any data that must be retained.
- The developer installer is documented as tested only on macOS; validate the separate compose path independently on Linux and Windows.
- This assessment uses only the supplied static files and did not execute the installer, tests, agent queries, or DAG analyzer.
What does this agent do, and when should you use it?
TrustGraph is a self-hosted context-engineering platform for production agent systems, packaging ontologies, entities, relationships, evidence, embeddings, provenance, and retrieval policies into deployable, versioned Context Cores. It supplies knowledge ingestion, graph construction, DocumentRAG, GraphRAG, OntologyRAG, graph-grounded retrieval, agent orchestration, and an LLM inference stack. Workspaces, Collections, and Flows separate tenant boundaries, domain knowledge, and running data-processing pipelines, with isolation enforced across messaging, storage, and the API gateway. Operators can work through Agent Console, GraphRAG View, Context Explorer, Document Ingestion, Ontology Workbench, Schema Workbench, and Prompt Editor, while TypeScript libraries support custom interfaces. The system runs as a collection of containers on Docker, Podman, or Kubernetes and can connect to hosted model APIs or local backends including vLLM, Ollama, TGI, LM Studio, and Llamafiles.
Raw documents enter a Flow, where configurable pipelines perform ingestion, extraction, structuring, and storage; automated entity and relationship extraction plus ontology-driven graph construction populate a Collection with graph structures, embeddings, documents, and evidence. Queries can use DocumentRAG, GraphRAG, or OntologyRAG: vector embeddings identify semantic entry points, explicit graph paths retrieve related entities, edges, and subgraphs, and that context is sent to the selected LLM. Outputs can carry reasoning paths and fact-level provenance that identify the source document, ingestion time, and extraction method. Agent Console streams answers and live explainability events; GraphRAG View displays an explainability DAG with inline provenance; Context Explorer provides a 3D graph, BFS neighborhood extraction, and animated edges. The orchestration layer supports single-agent and multi-agent operation, ReAct, Plan-then-Execute, Supervisor patterns, and MCP integration, while Cassandra, Qdrant, S3-compatible Garage, and either Pulsar or RabbitMQ provide storage and messaging.
- Teams deploying agents in audited production environments can use GraphRAG, explicit relationship paths, and fact-level provenance to inspect the evidence behind generated claims.
- Platform operators serving multiple customers or departments can isolate each tenant in a Workspace, divide domain knowledge into Collections, and process it through separate Flows.
- Knowledge-engineering teams with RDF, OWL, SKOS, or SHACL assets can build ontology-directed context graphs and OntologyRAG pipelines around their semantic models.
- Organizations seeking fewer hosted dependencies can run storage, messaging, and open-model inference locally, using external APIs only when they select hosted LLMs or third-party OCR.
- Teams that need the same domain knowledge across agents and environments can build, pin, roll back, and promote versioned Context Cores.
- Analysts investigating dense entity networks can inspect relationships and provenance through the 3D Context Explorer, BFS neighborhood extraction, and GraphRAG View.
What are this agent's strengths and limitations?
- A Context Core bundles ontology, knowledge graph, embeddings, provenance, and retrieval policies, allowing domain context to be versioned, rolled back, and reused across teams or environments.
- Explainability is tied to explicit graph paths and node- and edge-level provenance, with UI support for explainability DAGs, inline sources, and live event tracking.
- The stack includes DocumentRAG, GraphRAG, and OntologyRAG alongside ReAct, Plan-then-Execute, Supervisor, single-agent, and multi-agent orchestration.
- It supports multiple hosted model APIs and local inference through vLLM, Ollama, TGI, LM Studio, and Llamafiles, reducing dependence on one model provider.
- Workspaces, Collections, and Flows provide distinct layers for tenant isolation, domain organization, and data processing, with structural enforcement at messaging, storage, and gateway layers.
- A full deployment includes container orchestration, Cassandra, Qdrant, Garage, and either Pulsar or RabbitMQ, creating a larger operational surface than a small single-process RAG application.
- The quickstart describes generated deployment artifacts but does not provide a universal start command, minimum hardware requirements, or a copyable first query.
- Hosted LLM and third-party OCR integrations still require provider credentials, network access, and reliance on those external services.
- Ontology-driven graphs, retrieval policies, and Context Cores add knowledge-modeling and governance work; migrating from flat-text RAG requires reorganizing entities, relationships, and evidence.
- Although several clouds and inference backends are listed, the material provides no comparative performance, scaling limits, or feature-parity evidence for those combinations.
How do you install or deploy this agent?
The documented quickstart does not require cloning the repository. Prepare a command-line environment capable of running npx and choose Docker, Podman, or Minikube, then run:
npx @trustgraph/configThe configurator produces deploy.zip containing docker-compose.yaml for Docker or Podman, or resources.yaml for Kubernetes, together with INSTALLATION.md. Follow that generated file for deployment because the supplied material does not specify one universal start command. Most included services require no third-party API key; credentials are needed when selecting hosted LLMs such as Anthropic or OpenAI, third-party OCR such as Mistral OCR, and for the TrustGraph API gateway key set by the operator.
How do you use this agent?
Run npx @trustgraph/config, select a Docker, Podman, or Minikube target, and start the generated container deployment by following INSTALLATION.md. After deployment, the TrustGraph UI is available on port 8888 by default: use Document Ingestion to upload and inspect material, Ontology Workbench to import or edit OWL/XML and Turtle ontologies, Schema Workbench to manage schemas, and Agent Console to issue streaming queries. GraphRAG View exposes the retrieved graph and provenance for inspection. Custom UIs can integrate through @trustgraph/client, @trustgraph/react-state, and @trustgraph/react-provider. Developer API and CLI documentation is linked, but the supplied material contains no copyable query request, CLI query command, or complete end-to-end invocation, so exact first-query parameters must come from the generated installation guide and developer reference.
How does this agent compare with similar options?
Compared with conventional RAG that retrieves flat chunks from a vector store, TrustGraph combines embeddings with an explicit relationship graph: embeddings locate semantic entry points, while graph traversal assembles entities, relationships, and supporting evidence with fact-level provenance. The tradeoff is that adopters must manage ontologies, graph structures, retrieval policies, and a multi-component infrastructure stack instead of only chunking and vector indexing.