# Agent Passport System

> Enforcement and accountability layer for AI agents. Bring your own identity (did:key, did:web, SPIFFE, OAuth, did:aps). Gateway enforcement boundary, monotonic narrowing, cascade revocation, spending controls, data lifecycle, observation governance (telemetry scopes, derivation rights, behavioral memory). Use when agents need scoped delegation, trust scoring, constraint enforcement, or cryptographic audit trails. SDK leads with the /core subpath (24 curated functions), MCP leads with APS_PROFILE=essential (25 tools covering identity, delegation, enforcement, commerce, reputation). 5,281 tests. 8 framework adapters: Stripe, Composio, IBAC/Cedar, LangChain, CrewAI, MCP, A2A, Gonka. Full surface area (107 modules, 152 MCP tools) still available under APS_PROFILE=full and the root import. SDK 6.0.1 and MCP 6.0.1 are current on npm, Python 3.0.1 on PyPI, Rust 0.3.0 on crates.io, Go v0.7.0. The 3.3.1 release added Delegated Action Evidence: bilateral pair reconciliation with five mismatch classes, verifier-side rev

- Skill: `aeoess-agent-passport-system/agent-passport-system` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add aeoess-agent-passport-system/agent-passport-system`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aeoess-agent-passport-system/agent-passport-system/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: aeoess (https://skillmd.com/u/aeoess-agent-passport-system)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/aeoess-agent-passport-system/agent-passport-system

---


# Agent Passport System

## When to use this skill

- Agent needs cryptographic identity (Ed25519 passport)
- Delegate authority between agents with scope, spend limits, depth controls
- Revoke access: one call kills all downstream delegations
- Run agent commerce with 5-gate checkout (passport, delegation, merchant, spend)
- Coordinate multi-agent tasks (assign, evidence, review, deliver)
- Track data contributions with Merkle proofs
- Encrypt agent-to-agent communication (E2E, forward secrecy)
- Score agent trust (Bayesian reputation, passport grades 0-3)
- Enforce values compliance (8 principles, graduated enforcement)
- Found institutions with charters, offices, approval policies

## Install

```bash
npm install agent-passport-system        # SDK: /core subpath is the curated default
npm install agent-passport-system-mcp    # MCP server: APS_PROFILE=essential is the default
go get github.com/aeoess/agent-passport-go@v0.7.0   # Go SDK, byte-parity subset (passport, delegation, attribution, completion, in-toto, values)
pip install agent-passport-system==3.0.1             # Python SDK
cargo add agent-passport-system@0.3.0                # Rust SDK, library crate agent_passport
```

Minimal SDK import (lead with the curated essentials):

```typescript
import {
  createPassport, createDelegation,
  evaluateIntent, commercePreflight, generateKeyPair
} from 'agent-passport-system/core'
```

Minimal MCP install (essential profile is the default; `APS_PROFILE=full` for all 152 tools):

```bash
npx agent-passport-system-mcp
```

Remote MCP (zero install): `https://mcp.aeoess.com/sse`

## Core workflow

### 1. Create identity → returns passport + keypair

```bash
npx agent-passport join --name my-agent --owner alice
```

Output: `.passport/agent.json` with Ed25519 keypair, signed passport, values attestation. Treat like an SSH key.

### 2. Delegate authority → returns signed delegation

```bash
npx agent-passport delegate --to <publicKey> --scope web_search,commerce --limit 500 --depth 1 --hours 24
```

Output: signed delegation with scope, spend limit, max depth, expiry. Authority can only narrow at each transfer.

### 3. Record work → returns signed receipt

```bash
npx agent-passport work --scope web_search --type research --result success --summary "Found 3 sources"
```

Output: Ed25519-signed receipt traceable to a human through the delegation chain.

### 4. Prove contributions → returns Merkle proof

```bash
npx agent-passport prove --beneficiary alice
```

Output: Merkle root + inclusion proofs. 100K receipts provable with ~17 hashes.

## MCP tools (152 total)

Setup: `npx agent-passport-system-mcp setup` (auto-configures Claude Desktop + Cursor)

**Identity & trust (11 tools):**
generate_keys, identify, issue_passport, verify_issuer, create_principal, endorse_agent, get_passport_grade, list_issuance_records, get_behavioral_sequence, verify_endorsement, revoke_endorsement

**Delegation & revocation (5):**
create_delegation, verify_delegation, revoke_delegation, sub_delegate, create_v2_delegation

**Commerce & wallets (4):**
commerce_preflight, get_commerce_spend, request_human_approval, create_checkout

**Coordination (11):**
create_task_brief, assign_agent, accept_assignment, submit_evidence, review_evidence, handoff_evidence, get_evidence, submit_deliverable, complete_task, get_my_role, get_task_detail

**Communication (7):**
send_message, check_messages, broadcast, list_agents, post_agora_message, register_agora_agent, register_agora_public

**Governance & policy (12):**
load_values_floor, attest_to_floor, create_intent, evaluate_intent, create_policy_context, create_agent_context, execute_with_context, create_charter, sign_charter, verify_charter, create_approval_request, add_approval_signature

**Data attribution (10):**
register_data_source, create_access_receipt, create_derivation_receipt, create_decision_lineage_receipt, record_training_use, check_data_access, check_purpose_permitted, check_retention_expired, query_contributions, generate_compliance_report

**Intent Network (5):**
publish_intent_card, remove_intent_card, search_matches, request_intro, respond_to_intro

## Framework adapters (8)

One-function governance for every major agent framework. Each wraps tool/task execution with APS delegation checks and Ed25519-signed receipts.

```typescript
import {
  governLangChainTool,              // LangChain/LangGraph
  governCrewTask,                   // CrewAI
  governMCPToolCall,                // Any MCP server
  governIBACIntent,                 // IBAC (Cedar/OPA)
  passportToA2ACard,                // A2A Agent Cards
} from 'agent-passport-system'

// Also available as standalone packages:
// npm install @aeoess/stripe-governance
// npm install @aeoess/composio-governance
```

| Adapter | Function | What it wraps |
|---------|----------|--------------|
| LangChain | `governLangChainTool()` | BaseTool.invoke() |
| CrewAI | `governCrewTask()` | Crew task execution |
| MCP | `governMCPToolCall()` | Any MCP tool call |
| IBAC/Cedar | `governIBACIntent()` | Cedar/OPA policy tuples |
| A2A | `passportToA2ACard()` | Agent Card ↔ passport bridge |
| Stripe | `governMPPPayment()` | Stripe agent payments |
| Composio | `governComposioAction()` | catalog of 250+ tool targets (subject to the upstream Composio registry and local configuration) |
| Gonka | `governGonkaInference()` | Decentralized GPU compute |

## Programmatic API

```typescript
import {
  joinSocialContract,   // → { passport, keyPair, attestation }
  createDelegation,     // → signed Delegation
  processToolCall,      // → { permitted, constraintResults, receipt }
  cascadeRevoke,        // → { revoked: string[], receipts }
  computePassportGrade, // → 0 | 1 | 2 | 3
  createIssuanceContext, // → IssuanceContext with evidence + assessment
} from 'agent-passport-system'
```

## Composition-check receipt (CompositionCheckV0)

A chain of individually rule-legal delegations can compose to a globally-unsafe target that per-hop monotonic narrowing cannot detect (each delegation narrows scope correctly, but the composed chain routes to an unsafe aggregate). The SDK carries proof that an external attestor ran a composition-hazard check; detection of the hazards is private gateway intelligence and is not in the SDK.

```typescript
import { CompositionCheckV0 } from 'agent-passport-system'

const result = CompositionCheckV0.verifyCompositionCheck(receipt, context)
// verifies the anchor: signature, binding to (chain_hash, action_ref, context_hash),
// freshness, attestor trust. Surfaces independence_is_second_anchor corroborated from the
// caller's trust context, never the receipt's self-declaration.
```

The verifier checks the anchor, not the composition. It evaluates no policy and emits no aggregate `safe` verdict: a per-check `pass` means only that the named attestor reported pass for the named profile over the bound context, never global safety. `gateway_self` is always weak (one trust domain); only a context-corroborated `independent_registered` attestor is a second anchor, mirroring how RAP-v0 gates its strong claim on `domains >= 2`. Conformance vectors in `conformance/composition-check/v0/`.

`traceBeneficiary().verified` is a real cryptographic check: true only when the receipt signature verifies at the chain tail and every delegation hop passes `verifyDelegation`. The separate `resolved` field carries lookup-success semantics (the lineage maps to known records) without making a cryptographic claim.

## Passport grades (attestation architecture)

| Grade | Meaning | Trust signal |
|-------|---------|-------------|
| 0 | Bare Ed25519 keypair | Unverified |
| 1 | Issuer countersigned | AEOESS processed |
| 2 | Runtime-bound + challenge-response | Infrastructure-attested |
| 3 | Runtime + verified human principal | Full chain of trust |

Grade travels with the passport. Any consumer reads it without understanding scoring internals.

## Key facts

- **Enforcement and accountability layer**: bring your own identity, gateway does the rest
- **SDK `/core` subpath**: 24 curated functions for 90% of integrations
- **MCP `essential` profile**: 25 tools by default (identity, delegation, enforcement, commerce, reputation)
- **Policy eval <2ms**, 403 ops/sec, 14 constraint dimensions
- **5,281 tests** including 38 adversarial scenarios. These are a developer-authored internal evaluation, not an independent red-team or neutral third-party adversarial harness.
- **Zero heavy dependencies**: Node.js crypto + uuid only
- **Apache-2.0** license
- *Full surface area: 107 modules, 152 MCP tools, available under `APS_PROFILE=full` and the root `agent-passport-system` import.*

## Links

- npm: https://www.npmjs.com/package/agent-passport-system
- MCP: https://www.npmjs.com/package/agent-passport-system-mcp
- PyPI: https://pypi.org/project/agent-passport-system/
- crates.io: https://crates.io/crates/agent-passport-system
- Go: https://pkg.go.dev/github.com/aeoess/agent-passport-go
- GitHub: https://github.com/aeoess/agent-passport-system
- Docs: https://agent-passport.org/llms-full.txt
- Paper: https://doi.org/10.5281/zenodo.18749779