Optional AgentCert / agent-trust verification via forward-auth / ext-plugin #13990

APISIX already has forward-auth and the external plugin runner, which are a clean fit for a question that's showing up with agent traffic through the AI gateway: is the calling agent trusted right now, beyond holding a valid credential.

We run an open verify-gate (MIT, ghcr.io/pdxlab/agentcert-tag) that checks a presented AgentCert — signature, revocation, and a live TrustScore — and returns allow / deny / annotate. Through forward-auth (or an ext-plugin) it runs entirely outside APISIX; no core changes.

Safe by construction: off unless enabled, shadow-mode first (observe, block nothing), metadata only.

Would an agent-trust check via forward-auth/ext-plugin be welcome as a documented integration for the AI-gateway use case? Happy to put up a reference config. https://trustmodel.ai/verify