Metadata-Version: 2.4
Name: add-mesh
Version: 0.1.0
Summary: ADD Protocol — an open discovery, delegation, and trust overlay for the Agentic Web
Project-URL: Homepage, https://github.com/das-subha123/agent-mesh-protocol
Project-URL: Repository, https://github.com/das-subha123/agent-mesh-protocol
Project-URL: Issues, https://github.com/das-subha123/agent-mesh-protocol/issues
Project-URL: Specification, https://github.com/das-subha123/agent-mesh-protocol/tree/main/spec
License: Apache-2.0
License-File: LICENSE
Keywords: a2a,agents,delegation,did,ed25519,mcp,protocol
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Security :: Cryptography
Requires-Python: >=3.10
Requires-Dist: cryptography>=42
Provides-Extra: crewai
Requires-Dist: crewai>=1.0; extra == 'crewai'
Provides-Extra: dev
Requires-Dist: httpx>=0.27; extra == 'dev'
Requires-Dist: langchain-core>=1.0; extra == 'dev'
Requires-Dist: pytest>=8; extra == 'dev'
Requires-Dist: starlette>=0.37; extra == 'dev'
Provides-Extra: langchain
Requires-Dist: langchain-core>=1.0; extra == 'langchain'
Provides-Extra: server
Requires-Dist: starlette>=0.37; extra == 'server'
Description-Content-Type: text/markdown

# add-mesh

Python reference implementation of the **ADD Protocol** (Agent Discovery,
Delegation & Trust) — an open overlay for the Agentic Web that adds discovery,
capability delegation, and trust attestation on top of A2A and MCP.

Specifications live in [`spec/`](../spec); the normative cross-language
conformance vectors live in [`test-vectors/`](../test-vectors).

## Install

```bash
pip install add-mesh
```

## Usage

```python
from add_mesh.core import generate_signer, sign_envelope, verify_envelope

key_pair, signer = generate_signer()
print(key_pair.did)  # did:key:z6Mk...

envelope = sign_envelope(signer, "add/delegation", {
    "aud": "did:key:z6MkSubAgent...",
    "maxSpendUsd": 5,
    "ttl": 1200,
})

result = verify_envelope(envelope)
print(result.issuer, result.payload)
```

Verification establishes only that the holder of `iss`'s key signed this
payload at the claimed time. It says nothing about whether they were entitled
to what the payload requests — that is the delegation layer's job.

## Signers

`sign_envelope` takes any object satisfying the `Signer` protocol, so an agent
identity can live in a KMS or HSM rather than in local memory:

```python
from add_mesh.core import Signer

class KmsSigner:
    @property
    def did(self) -> str:
        return "did:key:z6Mk..."

    def sign(self, message: bytes) -> bytes:
        return my_kms.sign(key_id, message)
```

## Notes on parity with the TypeScript implementation

The wire format is identical and validated by a bidirectional interop harness.
The APIs differ in one deliberate, idiomatic way: **these functions are
synchronous**, because signing is a microsecond-scale CPU operation and
`cryptography` exposes it synchronously. The TypeScript API is async because
WebCrypto and remote KMS clients are async there.

Two portability details are handled internally and are worth knowing about if
you implement ADD in another language:

- RFC 8785 mandates ECMAScript number formatting, which differs from Python's
  `repr` (`1e-7` not `1e-07`, `1` not `1.0`, `100000000000000000000` not `1e+20`).
- RFC 8785 orders object keys by **UTF-16 code unit**, not code point. These
  disagree for non-BMP characters, so a naive `sorted()` produces a different
  signature over the same payload.

## Development

```bash
pip install -e ".[dev]"
pytest
```

## License

Apache-2.0.
