Metadata-Version: 2.4
Name: ai-agent-passport
Version: 0.3.0
Summary: Verifiable agent identity with explicit trust and optional A2A integration.
Author: Alexander Manev
License-Expression: MIT
Project-URL: Repository, https://github.com/alexandermanev/agent-passport
Project-URL: Issues, https://github.com/alexandermanev/agent-passport/issues
Project-URL: Changelog, https://github.com/alexandermanev/agent-passport/blob/main/CHANGELOG.md
Requires-Python: >=3.10
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: cryptography>=42.0.0
Requires-Dist: jsonschema<5,>=4.18.0
Requires-Dist: referencing<1,>=0.30.0
Requires-Dist: pyjwt[crypto]<3,>=2.15.1
Requires-Dist: pyyaml>=6.0.0
Requires-Dist: typer>=0.12.0
Provides-Extra: a2a
Requires-Dist: a2a-sdk[signing]==1.2.0; extra == "a2a"
Requires-Dist: rfc8785<1,>=0.1.4; extra == "a2a"
Provides-Extra: dev
Requires-Dist: build>=1.0.0; extra == "dev"
Requires-Dist: pytest>=8.0.0; extra == "dev"
Requires-Dist: pyright<2,>=1.1.400; extra == "dev"
Requires-Dist: rfc8785<1,>=0.1.4; extra == "dev"
Requires-Dist: ruff>=0.8.0; extra == "dev"
Requires-Dist: twine>=5.0.0; extra == "dev"
Dynamic: license-file

# agent-passport

Verifiable identity for agents. Explicit trust for the systems they meet.

A small Python SDK for issuer-signed agent identities, current key and identity status, and binding a verified identity to an independently authenticated caller. It **complements A2A**: A2A owns discovery, messaging and tasks; agent-passport adds an application-defined ownership and trust profile.

**Status:** pre-1.0. Version 0.3.0 adds the identity SDK and optional A2A adapter. It has not been independently security-audited. The older local CLI remains available for compatibility.

## Install and try

Python 3.10–3.14:

```bash
python3 -m venv .venv
source .venv/bin/activate
pip install "ai-agent-passport==0.3.0"
agent-passport --help
```

For native A2A Agent Cards:

```bash
pip install "ai-agent-passport[a2a]==0.3.0"
```

From a repository checkout, run `python examples/identity_demo.py` (or add `--a2a`). The demo generates disposable keys in memory, verifies identity, rejects an unauthenticated presenter, and checks revocation. No credentials, servers or paid calls are needed.

## What it provides

- A versioned identity profile: issuer, agent, owner, audience, revision, expiry and credential ID.
- Ed25519 JWS credentials through PyJWT, with a dedicated token type—not access tokens.
- An optional A2A 1.0 adapter using the official Python SDK's native Agent Card signing and a required profile extension.
- Explicit trusted-key and identity-state resolution, including revocation and overlapping rotation keys.
- Presenter binding and a fresh status check immediately before a protected operation.
- Bounded parsing, pinned algorithms, stable verification errors and packaged schemas/types.

See the [runnable example](https://github.com/alexandermanev/agent-passport/blob/main/examples/identity_demo.py) and [identity profile](https://github.com/alexandermanev/agent-passport/blob/main/docs/identity-profile.md#v1) for the API and wire format. A typical receiving application calls:

```python
identity = verify_credential(
    token, trust=trust,
    issuer=expected_issuer, audience=service_id, agent_id=expected_agent,
)
check_presenter(
    identity, authenticated_peer,
    audience=service_id, recipient=receiving_agent_id, trust=trust,
)
# Separately authorize the exact task, action and resource before execution.
```

`trust`, expected IDs and `authenticated_peer` come from trusted application configuration and authentication middleware, **never from the request body**. `TrustResolver` connects the SDK to your authoritative store; `MemoryTrustStore` is for local tests and examples.

## Security boundary

A public passport is copyable. It does not authenticate its presenter, prove the underlying model, grant tool permissions, or prevent request replay by itself. Use validated OAuth/mTLS/session authentication, bind that principal with `check_presenter`, and enforce task-specific consent. The host owns trusted enrollment, durable status, freshness, replay protection, resource authorization and revocation/execution race handling.

The core does not fetch advertised keys or URLs. A verified endpoint is still untrusted network input: the host must enforce egress/SSRF policy before contacting it. Keep private keys in a managed secret store; never put secrets or unnecessary personal data in public cards.

**A2A compatibility:** the adapter pins SDK 1.2.0 and accepts a strict subset of A2A 1.0 cards. Its independent JCS check rejects data the SDK would omit from signing, including empty extension values. Use nonempty declared capabilities for the A2A encoding; see the [profile restrictions](https://github.com/alexandermanev/agent-passport/blob/main/docs/identity-profile.md#a2a-encoding). This is not a claim of universal A2A conformance.

## Legacy CLI

The existing `init`, `issue`, `sign`, `verify`, `inspect`, `fingerprint`, `policy-check` and `key` commands retain the project-specific v0.1 envelope. They do **not** issue the new profile or provide its trust/lifecycle checks. New network integrations should use the identity SDK, not reinterpret legacy documents as credentials.

```bash
agent-passport --help
python examples/gateway_demo/run_demo.py
python examples/mcp_proxy_demo/run_demo.py
```

The MCP-style demo is a toy proxy, not an MCP authorization implementation. Legacy resource rules are literal globs, not filesystem confinement. Details: [architecture](https://github.com/alexandermanev/agent-passport/blob/main/docs/architecture.md), [threat model](https://github.com/alexandermanev/agent-passport/blob/main/THREAT_MODEL.md), [security reporting](https://github.com/alexandermanev/agent-passport/blob/main/SECURITY.md).

## Development

```bash
pip install -e '.[dev,a2a]'
ruff check .
pyright
pytest
python -m build
```

See [contributing](https://github.com/alexandermanev/agent-passport/blob/main/CONTRIBUTING.md), [changelog](https://github.com/alexandermanev/agent-passport/blob/main/CHANGELOG.md) and [publishing](https://github.com/alexandermanev/agent-passport/blob/main/docs/publishing.md).
