APS lets a person or company give an AI agent limited authority to act on its behalf, and produces verifiable proof of what the agent does with it. Open protocol, Apache 2.0.
Agenten stärken
Der eigene Befehl des Herausgebers. Kein PlugMCP-Endpunkt.
Host a copy with our keys and logs.
npx -y [email protected]Claude Code hat keinen Installationslink für einen lokalen Befehl. Kopieren Sie den Befehl unten und führen Sie ihn in einem Terminal aus.
claude mcp add agent-passport-system -- npx -y agent-passport-system@8.0.1In einem Terminal ausführen.
{ "mcpServers": { "agent-passport-system": { "command": "npx", "args": [ "-y", "[email protected]" ] } }}claude_desktop_config.json
Remote-URL oder ein Befehl auf Ihrem Rechner? Worin sich die beiden Installationen unterscheiden
Auf PlugMCP ausführen
A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.
StartenVom Herausgeber
APS lets a person or company give an AI agent limited authority to act on its behalf, and produces verifiable proof of what the agent does with it. Open protocol, Apache 2.0.
Enforcement and accountability layer for AI agents. Bring your own identity (did:key, did:web, SPIFFE, OAuth, did:aps). Gateway enforcement, monotonic narrowing, cascade revocation, earned reputation, wallet binding, attribution, signed receipts.
It answers four practical questions about any agent action:
Authority can pass from one agent to the next, but it can only get narrower. Scope, spending limits, expiration, and approved services are checked before an action runs, at a gateway that is both judge and executor: a request outside the granted authority is denied before it executes. Every decision, allowed or denied, produces a signed receipt, so anyone can later verify what was requested, what authority was presented, which policy applied, and what APS decided.
flowchart LR
P["Person or company"] -->|"payments up to $500"| A["Agent A"]
A -->|"refunds up to $100"| B["Agent B"]
B -->|"$200 refund request"| G{"APS gateway"}
G -->|"outside delegated authority"| X["denied + signed receipt"]
npm install agent-passport-system
Also implemented in Python, Go and Rust, each checked against this TypeScript reference through the conformance suite.
Verify any receipt or evidence bundle in your browser at agent-passport.org/verify.html (runs locally, nothing is uploaded). Machine-readable docs for agents are at agent-passport.org/llms.txt.
Lead with the curated essentials. agent-passport-system/core exposes the 24 functions that 90% of integrations need: identity, delegation, enforcement, commerce, reputation, key management. The full agent-passport-system root import is unchanged and backward compatible: pull from it when Core does not cover your case.
import {
createPassport, createDelegation,
evaluateIntent, commercePreflight, generateKeyPair
} from 'agent-passport-system/core'
Status: Canonical.
What ships in every deployment.
Identity -- Ed25519 passports, passport grades 0-3, key rotation, did:aps identifiers. Bring your own identity too: APS accepts did:key, did:web, SPIFFE SVIDs, and OAuth tokens alongside native did:aps.
Delegation -- Scoped authority with monotonic narrowing. Sub-delegation can only reduce scope. Cascade revocation propagates through the full chain. subDelegateAdvisor implements the bounded-escalation delegation pattern used in multi-model agent workflows where a lower-cost executor escalates to a higher-capability advisor at decision points -- the advisor delegation is count-bounded, cannot execute tools, and cascade-revokes with its parent.
Two delegation records ship, and they are not interchangeable. AuthorityDelegationV1 (record_type aps:authority-delegation:v1) is the delegated authority record of draft-pidlisnyi-aps-03 section 3.1, with the seven signed facets and the chain verifier that returns valid, invalid, indeterminate or unsupported. The older Delegation from createDelegation, subDelegate and verifyDelegation is a pre-draft compatibility surface, deprecated and frozen: it predates the draft wire format and is not on the draft path. Its scope matching is the pre-draft rule, under which a bare grant p covers p:x; section 3.2 allows only * and a terminal p:* as wildcards, and the draft-path check follows section 3.2. The two rules are deliberately not converged, because changing either would change what records already signed under it authorize. New work uses AuthorityDelegationV1.
Enforcement -- 3-signature action chain: agent signs intent, policy engine signs evaluation, agent signs execution receipt. The agent cannot skip the check. Gateway evaluation runs under 2ms.
Commerce -- 5-gate preflight: valid passport, scope check, spend limit, merchant allowlist, idempotency. Human approval thresholds for high-value transactions.
Reputation -- Bayesian trust scoring across 5 tiers. Authority is earned per-scope, not global. Passport grades compound with behavioral history.
Every primitive in this README carries one of three labels so you know how much weight it can bear today.
Where enforcement sits:
flowchart LR
AG[Agent] -->|signed intent| GW{"Gateway<br/>scope / spend / revocation / values floor"}
GW -->|permit| ACT[Action executes]
GW -->|deny| STOP[Blocked]
GW --> RC[("Signed receipt<br/>every outcome, both verdicts")]
APS receipts are graph-composable. Each claim links to the authority, policy, action, observation, or evidence it depends on, so a verifier can walk from any receipt back to its supporting facts and stop at the boundary it cares about. This is documentation of existing structure, not a new primitive. The linkage already lives in the existing receipt envelopes (delegation_chain_root, policy_ref, action_ref, evidence_id, bound_to); the graph view is just how those edges compose.
Every APS receipt is a signed declaration about what the system observed. It is not a causal proof of agent cognition, and it is not a proof that an off-protocol side effect actually happened. Each receipt type carries an explicit scope_of_claim with asserts and does_not_assert fields, so the boundary travels with the receipt. The boxes below state that boundary in one place. The same shape is enforced in code by the ScopeOfClaim type (src/v2/accountability/types/base.ts), re-exported from the package root.
ActionReceipt (aps:action:v1)
AuthorityBoundaryReceipt (aps:authority_boundary:v1)
CustodyReceipt (aps:custody:v1)
ContestabilityReceipt (aps:contestability:v1)
APSBundle (aps:bundle:v1)
PaymentReceipt (aps:payment_receipt:v1)
Across all of them: a self_attested receipt (where the agent signed without independent attestation) carries lower evidentiary weight than a gateway_observed or runtime_attested one. A verifier should treat the capture_mode and self_attested fields as part of the claim, not metadata.
A valid signature is not a valid claim. The cases below are receipts that are cryptographically sound yet must still be refused, because they are being used outside the envelope they were issued for. The conformance package under tests/conformance/ ships a golden fixture for each one, and a test asserts the rejection reason.
aps:action:v1 receipt presented as proof of payment. The signature checks out; the receipt simply does not make that claim. Reject (WRONG_CLAIM).DELEGATION_EXPIRED).DELEGATION_REVOKED).self_attested evidence must not be promoted to observed evidence. Reject (WRONG_CLAIM).receipt_id it has already honored in the window. Reject (REPLAYED).POLICY_NOT_EXECUTED).A conformant verifier runs the crypto layer first (claim type, receipt_id match, signature) and then the context layer (delegation state, budget, principal, policy version, replay window). A receipt that fails either layer is not authoritative.
Proof box. These docs and fixtures specify what each receipt proves and the negatives a conformant verifier must reject. They do not change protocol behavior. No signing path, canonical preimage, or
action_refcomputation is altered by anything in this section.
Status: Production-Extension. Optional and additive: passports without bound_wallets canonicalize unchanged, and actions without a walletRef skip the gate.
Two layers, designed to compose.
Structural (agent-attested). The agent's own passport private key signs { passport_id, chain, address, bound_at } and appends the result to the passport's bound_wallets field. Verifiable offline with just the passport public key. Chain-agnostic: Nano is the native APS wallet, but the primitive accepts any chain identifier with an address.
import { bindWallet, verifyBoundWallet } from 'agent-passport-system'
const bound = bindWallet({
passport: signedPassport,
privateKey: agentPrivateKey,
chain: 'nano',
address: 'nano_3jb1...',
})
verifyBoundWallet(bound, 'nano', 'nano_3jb1...') // true
Behavioral (issuer-attested). Independent issuers (the insumer-examples ecosystem and friends, skyemeta/skyeprofile and 8 others) sign attestations about wallet behavior, sybil signals, and on-chain history. Their signatures stand alone.
The two layers compose: a verifier accepting both gets cryptographic proof that this passport holder controls this address (structural) and that this address has these behavioral properties (behavioral). Neither layer claims what the other proves. Multi-attestation envelopes carry both.
commercePreflight() enforces the structural layer at gate 5: when the action references a walletRef, the gate denies with WALLET_NOT_BOUND unless the wallet is currently bound to the acting passport. The check is opt-in. Actions without a walletRef skip it, so existing 5-gate flows are unaffected.
unbindWallet() produces a separately signed unbind event so the bind/unbind history can be reconstructed independent of the passport's current bound_wallets snapshot.
Status: Production-Extension. Delegations without an explicit credentialCheckPolicy keep the existing recheck-on-execute behavior unchanged.
A credential needs to declare WHEN it should be re-verified. Different credential types have different trust decay profiles. APS lets the issuer set this on the delegation itself via credentialCheckPolicy.
import { createDelegation } from 'agent-passport-system'
const delegation = createDelegation({
delegatedTo: agentPublicKey,
delegatedBy: principalPublicKey,
scope: ['payments:wire'],
spendLimit: 1_000_000,
expiresInHours: 24,
privateKey: principalPrivateKey,
credentialCheckPolicy: {
mode: 'both', // 'on-accept' | 'on-process' | 'both'
max_acceptance_age: 3600, // optional, seconds
},
})
Three modes:
on-accept -- verify once at credential acceptance time, trust the snapshot afterward. Cheap. Use for long-lived session credentials where the live revocation cost is prohibitive and brief staleness is acceptable. Live revocation between accept and process will not be caught.
on-process -- verify on every action evaluation. The default. Catches live revocation. This matches the existing APS recheck-on-execute behavior, so delegations without an explicit credentialCheckPolicy continue to work unchanged.
both -- verify at acceptance AND at process time. Use for high-stakes actions (large spend, irreversible operations, cross-org transactions) where you want both the snapshot integrity check AND the live state check.
Denial codes specific to this gate: CREDENTIAL_NOT_ACCEPTED (policy is on-accept/both but no acceptance stamp), CREDENTIAL_ACCEPT_STALE (stamp older than max_acceptance_age), PROCESS_TIME_INVALID (live state failed), ACCEPT_TIME_INVALID (acceptance check failed).
Proposed by @piiiico on the a2aproject/A2A governance metadata thread.
Status: Production-Extension.
Pick what you need. import from 'agent-passport-system' for the full API.
Coordination (task lifecycle with 9-state machine), EU AI Act mapping support through signed evidence packets for accountability and audit workflows, framework adapters (CrewAI, LangChain, Google ADK, A2A, MCP), bilateral receipts, execution attestation, DID resolution, data lifecycle (access receipts, derivation tracking, consent revocation).
Status: Experimental, except where noted. The Wave 1 accountability primitives below are Canonical: their signed bytes are frozen and pinned by the conformance fixtures.
Forward-looking governance. Published, tested, available.
23 v2 constitutional modules: approval fatigue detection, epistemic isolation, blind evaluation, separation of powers, affected-party standing, circuit breakers, constitutional amendment, authority laundering audit, emergence detection.
Wave 1 accountability primitives: Ed25519 ActionReceipt, AuthorityBoundaryReceipt, CustodyReceipt, ContestabilityReceipt, APSBundle. RFC 8785 JCS canonicalization for cross-implementation receipts and conformance fixtures, content-addressed, byte-match across implementations.
Institutional governance: charters, offices, federation, reserves, multi-party approvals.
npx agent-passport-system-mcp
154 tools by default. Set APS_PROFILE=essential for a slim profile that presents 28 tools. Profiles: essential, identity, governance, coordination, commerce, data, gateway, comms, minimal, full.
The Agent Passport System spans these repositories:
APS ships its own identity layer (src/core/key-rotation.ts, src/types/did.ts) plus the full delegation, enforcement, governance, commerce, data, coordination, and composition stack. Where independent implementations exist for the same primitives, vocabulary crosswalks track the mapping in agent-governance-vocabulary:
crosswalk/agent-did.yaml. Co-drafted A2A composition contract: a2aproject/A2A#1742.The composition contract specifies how a verifier MUST cross-check per-request signature key material against published Agent Card key material under the rotation state machine. APS implements the verifier-side rules in src/core/key-rotation.ts; Agent-DID's IdentityCompositionError is the typed error shape used by both implementations.
The test total is reported by npm test and by the tests badge above; it is not written into
prose here or in package.json, so it cannot drift. Framework adapters for CrewAI, LangChain,
ADK, A2A, MCP, OpenShell, IBAC, Gonka. Gateway evaluation under 2ms in the benchmarks under
benchmarks/. Zero heavy dependencies. Apache-2.0.
tools/call, including the mcp-use adapter.Copyright 2026 Tymofii Pidlisnyi. Apache-2.0.
Enforcement and accountability layer for AI agents. Bring your own identity (did:key, did:web, SPIFFE, OAuth, did:aps). Gateway enforcement, monotonic narrowing, cascade revocation, earned reputation,
{ "mcpServers": { "agent-passport-system": { "command": "npx", "args": [ "-y", "[email protected]" ] } }}Übersicht
Enforcement and accountability layer for AI agents. Bring your own identity (did:key, did:web, SPIFFE, OAuth, did:aps). Gateway enforcement, monotonic narrowing, cascade revocation, earned reputation, wallet binding, attribution, signed receipts.
Tools
Noch keine Tool-Liste. Remote-Server erhalten eine nach dem ersten Health-Check.
FAQ
Kopieren Sie auf dieser Seite die stdio-Konfiguration für Cursor, Claude Desktop, Claude Code oder VS Code. Sie nutzt die Installation des Herausgebers, keinen PlugMCP-Proxy.
In diesem Eintrag ist keine erforderliche Umgebungsvariable aufgeführt.
Agent Passport System läuft lokal über stdio.
Zuletzt geprüft: 2026-11-14. Enforcement and accountability layer for AI agents. Bring your own identity (did:key, did:web, SPIFFE, OAuth, did:aps). Gateway enforcement, monotonic narrowing, cascade revocation, earned reputation, wallet binding, attribution, signed receipts.