AgentAuth

Identity and authentication service for AI agents. Issues verifiable credentials, manages API key lifecycles, and provides OAuth-like flows for machine-to-machine interactions.

AgentAuth is available as an MCP (Model Context Protocol) server — no HTTP client code required. Any MCP-compatible agent can authenticate and manage permissions through standard tool calls.

The MCP endpoint isbuilt into the AgentAuth APIat/mcp. No separate install needed.

Add this to your MCP client config and you're done:

{ "mcpServers": { "agentauth": { "url": "https://agentauth.radi.pro/mcp" } } }

All use the same URL:https://agentauth.radi.pro/mcp

For development or air-gapped environments:

{ "mcpServers": { "agentauth": { "command": "uv", "args": ["run", "--directory", "/path/to/agent-auth/mcp-server", "agentauth-mcp"], "env": { "AGENTAUTH_URL": "https://agentauth.radi.pro" } } } }

If you run your own AgentAuth instance, the MCP endpoint is automatically available at/mcp. SetAGENTAUTH_URLto your instance:

AGENTAUTH_URL=https://your-agentauth-instance.com

When using the hosted/mcpendpoint directly, no environment variables are needed on the client.

1. quickstart → register agent + get API key + access token (first run only) 2. authenticate → exchange saved API key for a fresh access token 3. [do work] → pass access_token to list_agents, create_delegation, check_permission, etc. 4. refresh_token → get a new token pair before the access token expires 5. revoke_token → invalidate tokens when done (optional)

Get AgentAuth server capabilities and endpoints.

Returns supported grant types, available scopes, token lifetimes, and all endpoint URLs. Call this first to understand what the service offers.

Register a new root agent and get credentials in one call. The fastest way to get started.

Returns agent identity, API key (shownonce— save immediately), access token, refresh token, and expiry timestamps.

quickstart( name="my-pipeline", agent_type="autonomous", description="Processes nightly ETL jobs" )

- agent— registered identity (id, name, agent_type, trust_level, …)
- api_key— raw API key,save it now
- access_token— ready-to-use Bearer token (valid 15 min)
- refresh_token— use before access token expires
- expires_at/refresh_before— ISO-8601 timestamps

Exchange an API key for an access token (client_credentials grant).

authenticate( api_key="ak_live_...", scopes=["api.read", "agents.write"] )

Returns:access_token,refresh_token,token_type,expires_in,expires_at,refresh_before

Exchange a refresh token for a new access + refresh token pair.

Use when the access token is near expiry — checkrefresh_beforefrom theauthenticateresponse.

refresh_token(refresh_token_value="rt_...")

Check whether a token is valid and inspect its claims (RFC 7662).

Returnsactive: true/falseplus decoded claims (scopes, agent_type, trust_level, expiration) if active.

introspect_token(token="eyJ...")

Revoke an access or refresh token immediately (RFC 7009).

The token is added to the blocklist and invalidated. Idempotent — revoking an already-revoked token succeeds.

Theraw_keyis returnedonce— save it immediately. Subsequent reads only show the key prefix.

create_credential( agent_id="01927...", access_token="eyJ...", scopes=["api.read"] )

Revoke an existing API key and issue a replacement in one atomic operation.

Returns new credential fields, the newraw_key(save it), and the oldcredential_id.

rotate_credential( credential_id="01928...", access_token="eyJ..." )

Permanently revoke an API key.Irreversible.

revoke_credential( credential_id="01928...", access_token="eyJ..." )

Delegate a subset of your permissions to another agent.

The delegate can only receive scopes the delegator already holds. Delegations can be chained up tomax_chain_depthtimes.

create_delegation( delegate_agent_id="01929...", scopes=["api.read", "agents.read"], access_token="eyJ...", max_chain_depth=1, expires_in_hours=24 )

Dry-run policy evaluation — checks whether an agent is allowed to perform an action without actually enforcing it. Useful for pre-flight checks.

check_permission( agent_id="01927...", action="write", resource="/api/v1/credentials", access_token="eyJ..." )

Returns:allowed: true/false, matched policy details, decision reasoning.

list_agents(access_token="eyJ...", limit=10, offset=0)

Returns agent fields (id, name, agent_type, trust_level, status) merged with metadata (is_root, is_active).

get_agent(agent_id="01927...", access_token="eyJ...")

from mcp import ClientSession from mcp.client.streamable_http import streamablehttp_client async with streamablehttp_client("https://agentauth.radi.pro/mcp") as (read, write, _): async with ClientSession(read, write) as session: await session.initialize() # Register and get credentials result = await session.call_tool("quickstart", { "name": "my-agent", "agent_type": "autonomous", }) api_key = result.content[0].text # save this # Authenticate on subsequent runs auth = await session.call_tool("authenticate", {"api_key": api_key}) token = auth.content[0].text # access_token

The MCP server wraps the AgentAuth REST API. Interactive API docs are available at:

ALTER - identity infrastructure for the AI economy

AgentTrust is a pure MCP-only reputation and trust scoring server for AI agents.

It connects Agents to data wallet with DID and verifiable credentials

Ed25519-signed consent receipts + programmable policy engine for AI agents before they take actions.

Agent identity and trust framework — DID verification, capability attestation, agent-to-agent authentication by MEOK AI Labs

Cryptographic identity, scoped delegation, values governance, and deliberative consensus for AI agents. 11 tools, Ed25519 signatures, zero blockchain.

Trust intelligence platform for AI agents — identity certification, trust scoring, forensic audit trails, and x402 micropayments. 14 MCP tools.

A secure MCP server for AI agents to interact with the Authenticator App for 2FA codes and passwords.

Agent identity and key custody — provider keys held in a local encrypted vault and leased to agents under owner approvals, with env-var injection so secrets never enter model context and a one-command kill switch; plus a registry with Ed25519 agent identity, reputation, and messaging.

MCP server for AI-native Identity Verification & Anti-Fraud